{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-b1c90aae2256bd34", "name": "use of sha1 \u2014 extensions/extension/src/main/java/org/ungoogled/ui/Thumbs.java:119", "shortDescription": {"text": "use of sha1 \u2014 extensions/extension/src/main/java/org/ungoogled/ui/Thumbs.java:119"}, "fullDescription": {"text": "Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Instead, use PBKDF2 for password hashing or SHA256 or SHA512 for other hash function applications.\n\nRule: java.lang.security.audit.crypto.use-of-sha1.use-of-sha1\nSeverity: WARNING\nOWASP: A03:2017 - Sensitive Data Exposure, A02:2021 - Cryptographic Failures, A04:2025 - Cryptographic Failures\nCWE: CWE-328: Use of Weak Hash\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9d24ca77ed0b439f", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v7 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-46c644c6227e4d4a", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v7 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1838a141491ce38c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bf906c102a9f57e0", "name": "Very large file: extensions/extension/src/main/java/org/ungoogled/ui/Shapes.java (1980 lines)", "shortDescription": {"text": "Very large file: extensions/extension/src/main/java/org/ungoogled/ui/Shapes.java (1980 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4686e1b5800213ec", "name": "Very large file: extensions/extension/src/main/java/org/ungoogled/ui/YouActivity.java (1309 lines)", "shortDescription": {"text": "Very large file: extensions/extension/src/main/java/org/ungoogled/ui/YouActivity.java (1309 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "0 test file(s) for 1 source file(s) (ratio 0.00). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-11825279136b53a3", "name": "CI is configured but no tests are detected", "shortDescription": {"text": "CI is configured but no tests are detected"}, "fullDescription": {"text": "A CI pipeline exists, but the scan found no test files to gate. Opus labeled this generated-code pattern as config theater: release machinery exists, but it has little behavioral signal."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-49e72d79d2ff7851", "name": "Vulnerable dependency undici 6.28.0: GHSA-3wwx-pv8p-q78v", "shortDescription": {"text": "Vulnerable dependency undici 6.28.0: GHSA-3wwx-pv8p-q78v"}, "fullDescription": {"text": "OSV.dev reports `undici` at version `6.28.0` (resolved in `package-lock.json`) is affected by GHSA-3wwx-pv8p-q78v (aka CVE-2026-85024).\nNote: `undici` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nundici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression\n\nAliases: CVE-2026-85024\nAdvisory: https://osv.dev/vulnerability/GHSA-3wwx-pv8p-q78v\nFix: upgrade `undici` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-acfb6b40292f05df", "name": "Vulnerable dependency undici 6.28.0: GHSA-r53p-7pc4-xj5r", "shortDescription": {"text": "Vulnerable dependency undici 6.28.0: GHSA-r53p-7pc4-xj5r"}, "fullDescription": {"text": "OSV.dev reports `undici` at version `6.28.0` (resolved in `package-lock.json`) is affected by GHSA-r53p-7pc4-xj5r (aka CVE-2026-18540).\nNote: `undici` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nundici vulnerable to downstream response splitting via retry interceptor\n\nAliases: CVE-2026-18540\nAdvisory: https://osv.dev/vulnerability/GHSA-r53p-7pc4-xj5r\nFix: upgrade `undici` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-c49d8a9fbbf39434", "name": "Vulnerable dependency undici 6.28.0: GHSA-rfgv-xxqx-mfg5", "shortDescription": {"text": "Vulnerable dependency undici 6.28.0: GHSA-rfgv-xxqx-mfg5"}, "fullDescription": {"text": "OSV.dev reports `undici` at version `6.28.0` (resolved in `package-lock.json`) is affected by GHSA-rfgv-xxqx-mfg5 (aka CVE-2026-19534).\nNote: `undici` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nundici vulnerable to Denial of Service via unrequested WebSocket subprotocol\n\nAliases: CVE-2026-19534\nAdvisory: https://osv.dev/vulnerability/GHSA-rfgv-xxqx-mfg5\nFix: upgrade `undici` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-7fbaebc63c59816b", "name": "Vulnerable dependency braces 3.0.3: GHSA-vfj7-8cjw-p6xm", "shortDescription": {"text": "Vulnerable dependency braces 3.0.3: GHSA-vfj7-8cjw-p6xm"}, "fullDescription": {"text": "OSV.dev reports `braces` at version `3.0.3` (resolved in `package-lock.json`) is affected by GHSA-vfj7-8cjw-p6xm.\nNote: `braces` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-vfj7-8cjw-p6xm\nFix: upgrade `braces` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-55ecf2a60a74f1e5", "name": "Vulnerable dependency js-yaml 4.3.1: GHSA-2883-xcg3-v3hh", "shortDescription": {"text": "Vulnerable dependency js-yaml 4.3.1: GHSA-2883-xcg3-v3hh"}, "fullDescription": {"text": "OSV.dev reports `js-yaml` at version `4.3.1` (resolved in `package-lock.json`) is affected by GHSA-2883-xcg3-v3hh (aka CVE-2026-84375).\nNote: `js-yaml` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\njs-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources\n\nAliases: CVE-2026-84375\nAdvisory: https://osv.dev/vulnerability/GHSA-2883-xcg3-v3hh\nFix: upgrade `js-yaml` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-fbb2528a0571d015", "name": "Vulnerable dependency brace-expansion 5.0.7: GHSA-6j4f-fj2g-mc7p", "shortDescription": {"text": "Vulnerable dependency brace-expansion 5.0.7: GHSA-6j4f-fj2g-mc7p"}, "fullDescription": {"text": "OSV.dev reports `brace-expansion` at version `5.0.7` (resolved in `package-lock.json`) is affected by GHSA-6j4f-fj2g-mc7p.\nNote: `brace-expansion` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p\nFix: upgrade `brace-expansion` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-5d74ab6286d1e088", "name": "Vulnerable dependency brace-expansion 5.0.7: GHSA-mh99-v99m-4gvg", "shortDescription": {"text": "Vulnerable dependency brace-expansion 5.0.7: GHSA-mh99-v99m-4gvg"}, "fullDescription": {"text": "OSV.dev reports `brace-expansion` at version `5.0.7` (resolved in `package-lock.json`) is affected by GHSA-mh99-v99m-4gvg.\nNote: `brace-expansion` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-mh99-v99m-4gvg\nFix: upgrade `brace-expansion` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-d9a4358652758573", "name": "Vulnerable dependency brace-expansion 5.0.7: GHSA-q2hr-2g5m-vwhr", "shortDescription": {"text": "Vulnerable dependency brace-expansion 5.0.7: GHSA-q2hr-2g5m-vwhr"}, "fullDescription": {"text": "OSV.dev reports `brace-expansion` at version `5.0.7` (resolved in `package-lock.json`) is affected by GHSA-q2hr-2g5m-vwhr.\nNote: `brace-expansion` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-q2hr-2g5m-vwhr\nFix: upgrade `brace-expansion` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-50cf3818104fa128", "name": "Vulnerable dependency brace-expansion 5.0.7: GHSA-qhr7-859c-m2p7", "shortDescription": {"text": "Vulnerable dependency brace-expansion 5.0.7: GHSA-qhr7-859c-m2p7"}, "fullDescription": {"text": "OSV.dev reports `brace-expansion` at version `5.0.7` (resolved in `package-lock.json`) is affected by GHSA-qhr7-859c-m2p7.\nNote: `brace-expansion` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-qhr7-859c-m2p7\nFix: upgrade `brace-expansion` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-ac3cb977b9dec278", "name": "Vulnerable dependency brace-expansion 5.0.7: GHSA-rgw5-rvv9-x895", "shortDescription": {"text": "Vulnerable dependency brace-expansion 5.0.7: GHSA-rgw5-rvv9-x895"}, "fullDescription": {"text": "OSV.dev reports `brace-expansion` at version `5.0.7` (resolved in `package-lock.json`) is affected by GHSA-rgw5-rvv9-x895.\nNote: `brace-expansion` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-rgw5-rvv9-x895\nFix: upgrade `brace-expansion` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-9abeea7e0d77ed99", "name": "Vulnerable dependency http-cache-semantics 4.2.0: GHSA-ch52-4w7c-c8xp", "shortDescription": {"text": "Vulnerable dependency http-cache-semantics 4.2.0: GHSA-ch52-4w7c-c8xp"}, "fullDescription": {"text": "OSV.dev reports `http-cache-semantics` at version `4.2.0` (resolved in `package-lock.json`) is affected by GHSA-ch52-4w7c-c8xp.\nNote: `http-cache-semantics` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-ch52-4w7c-c8xp\nFix: upgrade `http-cache-semantics` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-bbc1bc36b9f33027", "name": "Vulnerable dependency ip-address 10.2.0: GHSA-22jq-vg5j-6vgg", "shortDescription": {"text": "Vulnerable dependency ip-address 10.2.0: GHSA-22jq-vg5j-6vgg"}, "fullDescription": {"text": "OSV.dev reports `ip-address` at version `10.2.0` (resolved in `package-lock.json`) is affected by GHSA-22jq-vg5j-6vgg (aka CVE-2026-54272).\nNote: `ip-address` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checks\n\nAliases: CVE-2026-54272\nAdvisory: https://osv.dev/vulnerability/GHSA-22jq-vg5j-6vgg\nFix: upgrade `ip-address` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-bd1303db6dc10585", "name": "Vulnerable dependency ip-address 10.2.0: GHSA-2vr4-cq9g-pvrc", "shortDescription": {"text": "Vulnerable dependency ip-address 10.2.0: GHSA-2vr4-cq9g-pvrc"}, "fullDescription": {"text": "OSV.dev reports `ip-address` at version `10.2.0` (resolved in `package-lock.json`) is affected by GHSA-2vr4-cq9g-pvrc (aka CVE-2026-101910).\nNote: `ip-address` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass\n\nAliases: CVE-2026-101910\nAdvisory: https://osv.dev/vulnerability/GHSA-2vr4-cq9g-pvrc\nFix: upgrade `ip-address` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-ac2ec7e584306eae", "name": "Vulnerable dependency ip-address 10.2.0: GHSA-4xrf-jv44-h6hh", "shortDescription": {"text": "Vulnerable dependency ip-address 10.2.0: GHSA-4xrf-jv44-h6hh"}, "fullDescription": {"text": "OSV.dev reports `ip-address` at version `10.2.0` (resolved in `package-lock.json`) is affected by GHSA-4xrf-jv44-h6hh (aka CVE-2026-69198).\nNote: `ip-address` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checks\n\nAliases: CVE-2026-69198\nAdvisory: https://osv.dev/vulnerability/GHSA-4xrf-jv44-h6hh\nFix: upgrade `ip-address` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-a9d5f7c11cf9b3c3", "name": "Vulnerable dependency ip-address 10.2.0: GHSA-h3mg-xc3c-68pw", "shortDescription": {"text": "Vulnerable dependency ip-address 10.2.0: GHSA-h3mg-xc3c-68pw"}, "fullDescription": {"text": "OSV.dev reports `ip-address` at version `10.2.0` (resolved in `package-lock.json`) is affected by GHSA-h3mg-xc3c-68pw.\nNote: `ip-address` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-h3mg-xc3c-68pw\nFix: upgrade `ip-address` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-27d419d958d76ca5", "name": "Vulnerable dependency ip-address 10.2.0: GHSA-j6r3-76f7-8jcv", "shortDescription": {"text": "Vulnerable dependency ip-address 10.2.0: GHSA-j6r3-76f7-8jcv"}, "fullDescription": {"text": "OSV.dev reports `ip-address` at version `10.2.0` (resolved in `package-lock.json`) is affected by GHSA-j6r3-76f7-8jcv.\nNote: `ip-address` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-j6r3-76f7-8jcv\nFix: upgrade `ip-address` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-59f22d2796e67639", "name": "Vulnerable dependency ip-address 10.2.0: GHSA-mwp4-54f8-5fhr", "shortDescription": {"text": "Vulnerable dependency ip-address 10.2.0: GHSA-mwp4-54f8-5fhr"}, "fullDescription": {"text": "OSV.dev reports `ip-address` at version `10.2.0` (resolved in `package-lock.json`) is affected by GHSA-mwp4-54f8-5fhr.\nNote: `ip-address` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-mwp4-54f8-5fhr\nFix: upgrade `ip-address` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-af14a78ff4c9319f", "name": "Vulnerable dependency ip-address 10.2.0: GHSA-rpw4-54j3-4h4q", "shortDescription": {"text": "Vulnerable dependency ip-address 10.2.0: GHSA-rpw4-54j3-4h4q"}, "fullDescription": {"text": "OSV.dev reports `ip-address` at version `10.2.0` (resolved in `package-lock.json`) is affected by GHSA-rpw4-54j3-4h4q.\nNote: `ip-address` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-rpw4-54j3-4h4q\nFix: upgrade `ip-address` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-df1480939bfa4740", "name": "Vulnerable dependency postcss-selector-parser 7.1.4: GHSA-rj75-hqrm-r3gf", "shortDescription": {"text": "Vulnerable dependency postcss-selector-parser 7.1.4: GHSA-rj75-hqrm-r3gf"}, "fullDescription": {"text": "OSV.dev reports `postcss-selector-parser` at version `7.1.4` (resolved in `package-lock.json`) is affected by GHSA-rj75-hqrm-r3gf.\nNote: `postcss-selector-parser` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-rj75-hqrm-r3gf\nFix: upgrade `postcss-selector-parser` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-d5bbefef5928a6ac", "name": "Vulnerable dependency tar 7.5.19: GHSA-r292-9mhp-454m", "shortDescription": {"text": "Vulnerable dependency tar 7.5.19: GHSA-r292-9mhp-454m"}, "fullDescription": {"text": "OSV.dev reports `tar` at version `7.5.19` (resolved in `package-lock.json`) is affected by GHSA-r292-9mhp-454m.\nNote: `tar` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-r292-9mhp-454m\nFix: upgrade `tar` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-9fe4f5cf88d8bb96", "name": "Vulnerable dependency undici 6.27.0: GHSA-3wwx-pv8p-q78v", "shortDescription": {"text": "Vulnerable dependency undici 6.27.0: GHSA-3wwx-pv8p-q78v"}, "fullDescription": {"text": "OSV.dev reports `undici` at version `6.27.0` (resolved in `package-lock.json`) is affected by GHSA-3wwx-pv8p-q78v (aka CVE-2026-85024).\nNote: `undici` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nundici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression\n\nAliases: CVE-2026-85024\nAdvisory: https://osv.dev/vulnerability/GHSA-3wwx-pv8p-q78v\nFix: upgrade `undici` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-bbdff1e423e512b3", "name": "Vulnerable dependency undici 6.27.0: GHSA-8xcm-r25x-g524", "shortDescription": {"text": "Vulnerable dependency undici 6.27.0: GHSA-8xcm-r25x-g524"}, "fullDescription": {"text": "OSV.dev reports `undici` at version `6.27.0` (resolved in `package-lock.json`) is affected by GHSA-8xcm-r25x-g524.\nNote: `undici` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-8xcm-r25x-g524\nFix: upgrade `undici` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-b5cca43631be1b10", "name": "Vulnerable dependency undici 6.27.0: GHSA-m8rv-5g2x-5cg5", "shortDescription": {"text": "Vulnerable dependency undici 6.27.0: GHSA-m8rv-5g2x-5cg5"}, "fullDescription": {"text": "OSV.dev reports `undici` at version `6.27.0` (resolved in `package-lock.json`) is affected by GHSA-m8rv-5g2x-5cg5.\nNote: `undici` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-m8rv-5g2x-5cg5\nFix: upgrade `undici` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-d5a512a88de2762a", "name": "Vulnerable dependency undici 6.27.0: GHSA-r53p-7pc4-xj5r", "shortDescription": {"text": "Vulnerable dependency undici 6.27.0: GHSA-r53p-7pc4-xj5r"}, "fullDescription": {"text": "OSV.dev reports `undici` at version `6.27.0` (resolved in `package-lock.json`) is affected by GHSA-r53p-7pc4-xj5r (aka CVE-2026-18540).\nNote: `undici` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nundici vulnerable to downstream response splitting via retry interceptor\n\nAliases: CVE-2026-18540\nAdvisory: https://osv.dev/vulnerability/GHSA-r53p-7pc4-xj5r\nFix: upgrade `undici` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-6b857dd88ae9e93c", "name": "Vulnerable dependency undici 6.27.0: GHSA-rfgv-xxqx-mfg5", "shortDescription": {"text": "Vulnerable dependency undici 6.27.0: GHSA-rfgv-xxqx-mfg5"}, "fullDescription": {"text": "OSV.dev reports `undici` at version `6.27.0` (resolved in `package-lock.json`) is affected by GHSA-rfgv-xxqx-mfg5 (aka CVE-2026-19534).\nNote: `undici` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nundici vulnerable to Denial of Service via unrequested WebSocket subprotocol\n\nAliases: CVE-2026-19534\nAdvisory: https://osv.dev/vulnerability/GHSA-rfgv-xxqx-mfg5\nFix: upgrade `undici` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-f3d2a432d5663447", "name": "Vulnerable dependency undici 6.27.0: GHSA-v3r7-h72x-cjcm", "shortDescription": {"text": "Vulnerable dependency undici 6.27.0: GHSA-v3r7-h72x-cjcm"}, "fullDescription": {"text": "OSV.dev reports `undici` at version `6.27.0` (resolved in `package-lock.json`) is affected by GHSA-v3r7-h72x-cjcm.\nNote: `undici` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-v3r7-h72x-cjcm\nFix: upgrade `undici` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-4c0340fdbeed070f", "name": "Vulnerable dependency undici 7.29.0: GHSA-2gqq-gqf2-x968", "shortDescription": {"text": "Vulnerable dependency undici 7.29.0: GHSA-2gqq-gqf2-x968"}, "fullDescription": {"text": "OSV.dev reports `undici` at version `7.29.0` (resolved in `package-lock.json`) is affected by GHSA-2gqq-gqf2-x968 (aka CVE-2026-84947).\nNote: `undici` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nundici vulnerable to response truncation via oversized chunked responses in the dump interceptor\n\nAliases: CVE-2026-84947\nAdvisory: https://osv.dev/vulnerability/GHSA-2gqq-gqf2-x968\nFix: upgrade `undici` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-1e4086db08694234", "name": "Vulnerable dependency undici 7.29.0: GHSA-2jfj-6hjv-fm6j", "shortDescription": {"text": "Vulnerable dependency undici 7.29.0: GHSA-2jfj-6hjv-fm6j"}, "fullDescription": {"text": "OSV.dev reports `undici` at version `7.29.0` (resolved in `package-lock.json`) is affected by GHSA-2jfj-6hjv-fm6j (aka CVE-2026-84933).\nNote: `undici` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nundici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches\n\nAliases: CVE-2026-84933\nAdvisory: https://osv.dev/vulnerability/GHSA-2jfj-6hjv-fm6j\nFix: upgrade `undici` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-29dbc0f3bd367321", "name": "Vulnerable dependency undici 7.29.0: GHSA-3wwx-pv8p-q78v", "shortDescription": {"text": "Vulnerable dependency undici 7.29.0: GHSA-3wwx-pv8p-q78v"}, "fullDescription": {"text": "OSV.dev reports `undici` at version `7.29.0` (resolved in `package-lock.json`) is affected by GHSA-3wwx-pv8p-q78v (aka CVE-2026-85024).\nNote: `undici` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nundici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression\n\nAliases: CVE-2026-85024\nAdvisory: https://osv.dev/vulnerability/GHSA-3wwx-pv8p-q78v\nFix: upgrade `undici` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-d52f97c636c0c865", "name": "Vulnerable dependency undici 7.29.0: GHSA-3xpg-4rpp-hhhm", "shortDescription": {"text": "Vulnerable dependency undici 7.29.0: GHSA-3xpg-4rpp-hhhm"}, "fullDescription": {"text": "OSV.dev reports `undici` at version `7.29.0` (resolved in `package-lock.json`) is affected by GHSA-3xpg-4rpp-hhhm (aka CVE-2026-84890).\nNote: `undici` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nundici vulnerable to Denial of Service via unbounded decompression of compressed responses\n\nAliases: CVE-2026-84890\nAdvisory: https://osv.dev/vulnerability/GHSA-3xpg-4rpp-hhhm\nFix: upgrade `undici` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-96c0f77e0fbbc21a", "name": "Vulnerable dependency undici 7.29.0: GHSA-8436-99hf-9mmv", "shortDescription": {"text": "Vulnerable dependency undici 7.29.0: GHSA-8436-99hf-9mmv"}, "fullDescription": {"text": "OSV.dev reports `undici` at version `7.29.0` (resolved in `package-lock.json`) is affected by GHSA-8436-99hf-9mmv.\nNote: `undici` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-8436-99hf-9mmv\nFix: upgrade `undici` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-2aee7ec65893517f", "name": "Vulnerable dependency undici 7.29.0: GHSA-pmjh-fq2x-6v4x", "shortDescription": {"text": "Vulnerable dependency undici 7.29.0: GHSA-pmjh-fq2x-6v4x"}, "fullDescription": {"text": "OSV.dev reports `undici` at version `7.29.0` (resolved in `package-lock.json`) is affected by GHSA-pmjh-fq2x-6v4x.\nNote: `undici` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-pmjh-fq2x-6v4x\nFix: upgrade `undici` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-30455ddc592b3c52", "name": "Vulnerable dependency undici 7.29.0: GHSA-r53p-7pc4-xj5r", "shortDescription": {"text": "Vulnerable dependency undici 7.29.0: GHSA-r53p-7pc4-xj5r"}, "fullDescription": {"text": "OSV.dev reports `undici` at version `7.29.0` (resolved in `package-lock.json`) is affected by GHSA-r53p-7pc4-xj5r (aka CVE-2026-18540).\nNote: `undici` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nundici vulnerable to downstream response splitting via retry interceptor\n\nAliases: CVE-2026-18540\nAdvisory: https://osv.dev/vulnerability/GHSA-r53p-7pc4-xj5r\nFix: upgrade `undici` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-44ff8e27e5e10ffa", "name": "Vulnerable dependency undici 7.29.0: GHSA-rfgv-xxqx-mfg5", "shortDescription": {"text": "Vulnerable dependency undici 7.29.0: GHSA-rfgv-xxqx-mfg5"}, "fullDescription": {"text": "OSV.dev reports `undici` at version `7.29.0` (resolved in `package-lock.json`) is affected by GHSA-rfgv-xxqx-mfg5 (aka CVE-2026-19534).\nNote: `undici` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nundici vulnerable to Denial of Service via unrequested WebSocket subprotocol\n\nAliases: CVE-2026-19534\nAdvisory: https://osv.dev/vulnerability/GHSA-rfgv-xxqx-mfg5\nFix: upgrade `undici` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-9b4a256e94a3b935", "name": "Vulnerable dependency undici 7.29.0: GHSA-rx4f-c7p8-82vq", "shortDescription": {"text": "Vulnerable dependency undici 7.29.0: GHSA-rx4f-c7p8-82vq"}, "fullDescription": {"text": "OSV.dev reports `undici` at version `7.29.0` (resolved in `package-lock.json`) is affected by GHSA-rx4f-c7p8-82vq.\nNote: `undici` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-rx4f-c7p8-82vq\nFix: upgrade `undici` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-cdb76ede04c5df03", "name": "Vulnerable dependency undici 7.29.0: GHSA-w293-vg96-wgc3", "shortDescription": {"text": "Vulnerable dependency undici 7.29.0: GHSA-w293-vg96-wgc3"}, "fullDescription": {"text": "OSV.dev reports `undici` at version `7.29.0` (resolved in `package-lock.json`) is affected by GHSA-w293-vg96-wgc3.\nNote: `undici` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-w293-vg96-wgc3\nFix: upgrade `undici` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}]}}, "automationDetails": {"id": "repobility/30839"}, "properties": {"repository": "bearinmindcat/morphe-patches", "repoUrl": "https://github.com/bearinmindcat/morphe-patches", "branch": "main"}, "results": [{"ruleId": "scanner-b1c90aae2256bd34", "level": "warning", "message": {"text": "use of sha1 \u2014 extensions/extension/src/main/java/org/ungoogled/ui/Thumbs.java:119"}, "properties": {"repobilityId": "a565a36c43f53f29", "scanner": "scanner-primary", "fingerprint": "b1c90aae2256bd34", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["semgrep", "security", "java"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "extensions/extension/src/main/java/org/ungoogled/ui/Thumbs.java"}, "region": {"startLine": 119}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-9d24ca77ed0b439f", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "24ce59e6557fe9fa", "scanner": "scanner-primary", "fingerprint": "9d24ca77ed0b439f", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/open_pull_request.yml"}, "region": {"startLine": 19}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "123746a93d080446", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 23}}}]}, {"ruleId": "scanner-1838a141491ce38c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "b8fd4f5048f96576", "scanner": "scanner-primary", "fingerprint": "1838a141491ce38c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bf906c102a9f57e0", "level": "note", "message": {"text": "Very large file: extensions/extension/src/main/java/org/ungoogled/ui/Shapes.java (1980 lines)"}, "properties": {"repobilityId": "83a34960ebbc4ef3", "scanner": "scanner-primary", "fingerprint": "bf906c102a9f57e0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-4686e1b5800213ec", "level": "note", "message": {"text": "Very large file: extensions/extension/src/main/java/org/ungoogled/ui/YouActivity.java (1309 lines)"}, "properties": {"repobilityId": "ceddb40e8ac818fa", "scanner": "scanner-primary", "fingerprint": "4686e1b5800213ec", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-11825279136b53a3", "level": "warning", "message": {"text": "CI is configured but no tests are detected"}, "properties": {"repobilityId": "c629a1c5975766d8", "scanner": "scanner-primary", "fingerprint": "11825279136b53a3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "ci", "config-theater", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-49e72d79d2ff7851", "level": "warning", "message": {"text": "Vulnerable dependency undici 6.28.0: GHSA-3wwx-pv8p-q78v"}, "properties": {"repobilityId": "527be8ceffb425c0", "scanner": "scanner-primary", "fingerprint": "49e72d79d2ff7851", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-3wwx-pv8p-q78v", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-acfb6b40292f05df", "level": "note", "message": {"text": "Vulnerable dependency undici 6.28.0: GHSA-r53p-7pc4-xj5r"}, "properties": {"repobilityId": "3de252abd07b4431", "scanner": "scanner-primary", "fingerprint": "acfb6b40292f05df", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-r53p-7pc4-xj5r", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c49d8a9fbbf39434", "level": "error", "message": {"text": "Vulnerable dependency undici 6.28.0: GHSA-rfgv-xxqx-mfg5"}, "properties": {"repobilityId": "98ce01368b15391e", "scanner": "scanner-primary", "fingerprint": "c49d8a9fbbf39434", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-rfgv-xxqx-mfg5", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7fbaebc63c59816b", "level": "warning", "message": {"text": "Vulnerable dependency braces 3.0.3: GHSA-vfj7-8cjw-p6xm"}, "properties": {"repobilityId": "fbbcc80277b25266", "scanner": "scanner-primary", "fingerprint": "7fbaebc63c59816b", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-vfj7-8cjw-p6xm", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-55ecf2a60a74f1e5", "level": "error", "message": {"text": "Vulnerable dependency js-yaml 4.3.1: GHSA-2883-xcg3-v3hh"}, "properties": {"repobilityId": "68a47a0fba38c041", "scanner": "scanner-primary", "fingerprint": "55ecf2a60a74f1e5", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-2883-xcg3-v3hh", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fbb2528a0571d015", "level": "warning", "message": {"text": "Vulnerable dependency brace-expansion 5.0.7: GHSA-6j4f-fj2g-mc7p"}, "properties": {"repobilityId": "29eb750322ac3c73", "scanner": "scanner-primary", "fingerprint": "fbb2528a0571d015", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-6j4f-fj2g-mc7p", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5d74ab6286d1e088", "level": "warning", "message": {"text": "Vulnerable dependency brace-expansion 5.0.7: GHSA-mh99-v99m-4gvg"}, "properties": {"repobilityId": "8ed819d24ba8d50f", "scanner": "scanner-primary", "fingerprint": "5d74ab6286d1e088", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-mh99-v99m-4gvg", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d9a4358652758573", "level": "warning", "message": {"text": "Vulnerable dependency brace-expansion 5.0.7: GHSA-q2hr-2g5m-vwhr"}, "properties": {"repobilityId": "61c8c3c6e322bfe5", "scanner": "scanner-primary", "fingerprint": "d9a4358652758573", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-q2hr-2g5m-vwhr", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-50cf3818104fa128", "level": "warning", "message": {"text": "Vulnerable dependency brace-expansion 5.0.7: GHSA-qhr7-859c-m2p7"}, "properties": {"repobilityId": "d35461df77742897", "scanner": "scanner-primary", "fingerprint": "50cf3818104fa128", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-qhr7-859c-m2p7", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ac3cb977b9dec278", "level": "warning", "message": {"text": "Vulnerable dependency brace-expansion 5.0.7: GHSA-rgw5-rvv9-x895"}, "properties": {"repobilityId": "de31443261a7f6eb", "scanner": "scanner-primary", "fingerprint": "ac3cb977b9dec278", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-rgw5-rvv9-x895", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9abeea7e0d77ed99", "level": "warning", "message": {"text": "Vulnerable dependency http-cache-semantics 4.2.0: GHSA-ch52-4w7c-c8xp"}, "properties": {"repobilityId": "1c34d7670afd1ae4", "scanner": "scanner-primary", "fingerprint": "9abeea7e0d77ed99", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-ch52-4w7c-c8xp", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bbc1bc36b9f33027", "level": "error", "message": {"text": "Vulnerable dependency ip-address 10.2.0: GHSA-22jq-vg5j-6vgg"}, "properties": {"repobilityId": "7b729de6a1846cb0", "scanner": "scanner-primary", "fingerprint": "bbc1bc36b9f33027", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-22jq-vg5j-6vgg", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bd1303db6dc10585", "level": "error", "message": {"text": "Vulnerable dependency ip-address 10.2.0: GHSA-2vr4-cq9g-pvrc"}, "properties": {"repobilityId": "6bcaf6856abcd64c", "scanner": "scanner-primary", "fingerprint": "bd1303db6dc10585", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-2vr4-cq9g-pvrc", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ac2ec7e584306eae", "level": "error", "message": {"text": "Vulnerable dependency ip-address 10.2.0: GHSA-4xrf-jv44-h6hh"}, "properties": {"repobilityId": "e73722143fbec189", "scanner": "scanner-primary", "fingerprint": "ac2ec7e584306eae", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-4xrf-jv44-h6hh", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a9d5f7c11cf9b3c3", "level": "warning", "message": {"text": "Vulnerable dependency ip-address 10.2.0: GHSA-h3mg-xc3c-68pw"}, "properties": {"repobilityId": "a32d0fafa96faf25", "scanner": "scanner-primary", "fingerprint": "a9d5f7c11cf9b3c3", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-h3mg-xc3c-68pw", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-27d419d958d76ca5", "level": "warning", "message": {"text": "Vulnerable dependency ip-address 10.2.0: GHSA-j6r3-76f7-8jcv"}, "properties": {"repobilityId": "be2f1a3a111b5865", "scanner": "scanner-primary", "fingerprint": "27d419d958d76ca5", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-j6r3-76f7-8jcv", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-59f22d2796e67639", "level": "warning", "message": {"text": "Vulnerable dependency ip-address 10.2.0: GHSA-mwp4-54f8-5fhr"}, "properties": {"repobilityId": "80798068e5f32910", "scanner": "scanner-primary", "fingerprint": "59f22d2796e67639", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-mwp4-54f8-5fhr", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-af14a78ff4c9319f", "level": "warning", "message": {"text": "Vulnerable dependency ip-address 10.2.0: GHSA-rpw4-54j3-4h4q"}, "properties": {"repobilityId": "83814dcd491a79ea", "scanner": "scanner-primary", "fingerprint": "af14a78ff4c9319f", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-rpw4-54j3-4h4q", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-df1480939bfa4740", "level": "warning", "message": {"text": "Vulnerable dependency postcss-selector-parser 7.1.4: GHSA-rj75-hqrm-r3gf"}, "properties": {"repobilityId": "63e11d91a4f9a102", "scanner": "scanner-primary", "fingerprint": "df1480939bfa4740", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-rj75-hqrm-r3gf", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d5bbefef5928a6ac", "level": "warning", "message": {"text": "Vulnerable dependency tar 7.5.19: GHSA-r292-9mhp-454m"}, "properties": {"repobilityId": "954178a696fcae16", "scanner": "scanner-primary", "fingerprint": "d5bbefef5928a6ac", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-r292-9mhp-454m", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9fe4f5cf88d8bb96", "level": "warning", "message": {"text": "Vulnerable dependency undici 6.27.0: GHSA-3wwx-pv8p-q78v"}, "properties": {"repobilityId": "d87b10ac7d50af79", "scanner": "scanner-primary", "fingerprint": "9fe4f5cf88d8bb96", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-3wwx-pv8p-q78v", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bbdff1e423e512b3", "level": "warning", "message": {"text": "Vulnerable dependency undici 6.27.0: GHSA-8xcm-r25x-g524"}, "properties": {"repobilityId": "61954e04fbcbb597", "scanner": "scanner-primary", "fingerprint": "bbdff1e423e512b3", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-8xcm-r25x-g524", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b5cca43631be1b10", "level": "warning", "message": {"text": "Vulnerable dependency undici 6.27.0: GHSA-m8rv-5g2x-5cg5"}, "properties": {"repobilityId": "8a1179078c7a02d4", "scanner": "scanner-primary", "fingerprint": "b5cca43631be1b10", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-m8rv-5g2x-5cg5", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d5a512a88de2762a", "level": "note", "message": {"text": "Vulnerable dependency undici 6.27.0: GHSA-r53p-7pc4-xj5r"}, "properties": {"repobilityId": "b3469232d4b216a5", "scanner": "scanner-primary", "fingerprint": "d5a512a88de2762a", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-r53p-7pc4-xj5r", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6b857dd88ae9e93c", "level": "error", "message": {"text": "Vulnerable dependency undici 6.27.0: GHSA-rfgv-xxqx-mfg5"}, "properties": {"repobilityId": "70f5f0c0cd9afbd9", "scanner": "scanner-primary", "fingerprint": "6b857dd88ae9e93c", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-rfgv-xxqx-mfg5", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f3d2a432d5663447", "level": "warning", "message": {"text": "Vulnerable dependency undici 6.27.0: GHSA-v3r7-h72x-cjcm"}, "properties": {"repobilityId": "5f4ec8c272ed7413", "scanner": "scanner-primary", "fingerprint": "f3d2a432d5663447", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-v3r7-h72x-cjcm", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4c0340fdbeed070f", "level": "note", "message": {"text": "Vulnerable dependency undici 7.29.0: GHSA-2gqq-gqf2-x968"}, "properties": {"repobilityId": "e277d95b8a40ce26", "scanner": "scanner-primary", "fingerprint": "4c0340fdbeed070f", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-2gqq-gqf2-x968", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1e4086db08694234", "level": "warning", "message": {"text": "Vulnerable dependency undici 7.29.0: GHSA-2jfj-6hjv-fm6j"}, "properties": {"repobilityId": "172921fa0f0c97a6", "scanner": "scanner-primary", "fingerprint": "1e4086db08694234", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-2jfj-6hjv-fm6j", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-29dbc0f3bd367321", "level": "warning", "message": {"text": "Vulnerable dependency undici 7.29.0: GHSA-3wwx-pv8p-q78v"}, "properties": {"repobilityId": "cab0ab8edc73159c", "scanner": "scanner-primary", "fingerprint": "29dbc0f3bd367321", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-3wwx-pv8p-q78v", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d52f97c636c0c865", "level": "warning", "message": {"text": "Vulnerable dependency undici 7.29.0: GHSA-3xpg-4rpp-hhhm"}, "properties": {"repobilityId": "b48833d79237eea6", "scanner": "scanner-primary", "fingerprint": "d52f97c636c0c865", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-3xpg-4rpp-hhhm", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-96c0f77e0fbbc21a", "level": "warning", "message": {"text": "Vulnerable dependency undici 7.29.0: GHSA-8436-99hf-9mmv"}, "properties": {"repobilityId": "cce5cd4079aa34bf", "scanner": "scanner-primary", "fingerprint": "96c0f77e0fbbc21a", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-8436-99hf-9mmv", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2aee7ec65893517f", "level": "warning", "message": {"text": "Vulnerable dependency undici 7.29.0: GHSA-pmjh-fq2x-6v4x"}, "properties": {"repobilityId": "d83d416982ab4630", "scanner": "scanner-primary", "fingerprint": "2aee7ec65893517f", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-pmjh-fq2x-6v4x", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-30455ddc592b3c52", "level": "note", "message": {"text": "Vulnerable dependency undici 7.29.0: GHSA-r53p-7pc4-xj5r"}, "properties": {"repobilityId": "90c1ed5255eda441", "scanner": "scanner-primary", "fingerprint": "30455ddc592b3c52", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-r53p-7pc4-xj5r", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-44ff8e27e5e10ffa", "level": "error", "message": {"text": "Vulnerable dependency undici 7.29.0: GHSA-rfgv-xxqx-mfg5"}, "properties": {"repobilityId": "99571be33ffd8f22", "scanner": "scanner-primary", "fingerprint": "44ff8e27e5e10ffa", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-rfgv-xxqx-mfg5", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9b4a256e94a3b935", "level": "warning", "message": {"text": "Vulnerable dependency undici 7.29.0: GHSA-rx4f-c7p8-82vq"}, "properties": {"repobilityId": "9f8f54b08fb31a58", "scanner": "scanner-primary", "fingerprint": "9b4a256e94a3b935", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-rx4f-c7p8-82vq", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cdb76ede04c5df03", "level": "warning", "message": {"text": "Vulnerable dependency undici 7.29.0: GHSA-w293-vg96-wgc3"}, "properties": {"repobilityId": "b2882b4a0c8c7cf1", "scanner": "scanner-primary", "fingerprint": "cdb76ede04c5df03", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-w293-vg96-wgc3", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}]}]}