in server-side rendering, the provided tag name is not validated or sanitized before being emitted into the HTML output. If the tag string contains unexpected characters, it can result in HTML injection in the SSR output. Client-side rendering is not affected. This vulnerability is fixed in 5.51.5.\n\nPackage: svelte\nInstalled: 5.43.12\nFixed in: 5.51.5\nSeverity: MEDIUM\nFix: Upgrade svelte to 5.51.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-eb24c55d255b4296", "name": "CVE-2026-27125: svelte 5.43.12 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-27125: svelte 5.43.12 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "svelte: Svelte SSR attribute spreading includes inherited properties from prototype chain\n\nsvelte performance oriented web framework. Prior to 5.51.5, in server-side rendering, attribute spreading on elements (e.g. ) enumerates inherited properties from the object's prototype chain rather than only own properties. In environments where Object.prototype has already been polluted \u2014 a precondition outside of Svelte's control \u2014 this can cause unexpected attributes to appear in SSR output or cause SSR to throw errors. Client-side rendering is not affected. This vulnerabilit\n\nPackage: svelte\nInstalled: 5.43.12\nFixed in: 5.51.5\nSeverity: MEDIUM\nFix: Upgrade svelte to 5.51.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f04793a17cae3d35", "name": "CVE-2026-27901: svelte 5.43.12 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-27901: svelte 5.43.12 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "svelte: Svelte: Cross-Site Scripting and HTML injection via improper escaping of bind:innerText and bind:textContent\n\nSvelte performance oriented web framework. Prior to version 5.53.5, the contents of `bind:innerText` and `bind:textContent` on `contenteditable` elements were not properly escaped. This could enable HTML injection and Cross-Site Scripting (XSS) if rendering untrusted data as the binding's initial value on the server. Version 5.53.5 fixes the issue.\n\nPackage: svelte\nInstalled: 5.43.12\nFixed in: 5.53.5\nSeverity: MEDIUM\nFix: Upgrade svelte to 5.53.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ce5f5561249f5725", "name": "CVE-2026-42573: svelte 5.43.12 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-42573: svelte 5.43.12 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "svelte: Svelte: Cross-Site Scripting via DOM Clobbering\n\nSvelte is a performance oriented web framework. Prior to version 5.55.7, Svelte was vulnerable to DOM clobbering of its internal framework state on elements, potentially leading to XSS attacks. This issue has been patched in version 5.55.7.\n\nPackage: svelte\nInstalled: 5.43.12\nFixed in: 5.55.7\nSeverity: MEDIUM\nFix: Upgrade svelte to 5.55.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0778a041c2e7cab1", "name": "CVE-2026-42599: svelte 5.43.12 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-42599: svelte 5.43.12 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "svelte: Svelte: Cross-Site Scripting via untrusted data in spread attributes\n\nSvelte is a performance oriented web framework. Prior to version 5.55.7, when using spread syntax to render attributes from untrusted data, event handler properties are included in the rendered HTML output. If an application spreads user-controlled or external data as element attributes, an attacker can inject malicious event handlers that execute in victims' browsers. Note that this vulnerability only triggers if the user's browser has JavaScript enabled but Svelte's hydration mechanism does no\n\nPackage: svelte\nInstalled: 5.43.12\nFixed in: 5.55.7\nSeverity: MEDIUM\nFix: Upgrade svelte to 5.55.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-226e1bc058ae11ed", "name": "CVE-2026-41907: uuid 8.3.2 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-41907: uuid 8.3.2 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality\n\nuuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0.\n\nPackage: uuid\nInstalled: 8.3.2\nFixed in: 11.1.1, 12.0.1, 13.0.1\nSeverity: MEDIUM\nFix: Upgrade uuid to 11.1.1, 12.0.1, 13.0.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d57769a75313f0c2", "name": "CVE-2026-41907: uuid 9.0.1 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-41907: uuid 9.0.1 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality\n\nuuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0.\n\nPackage: uuid\nInstalled: 9.0.1\nFixed in: 11.1.1, 12.0.1, 13.0.1\nSeverity: MEDIUM\nFix: Upgrade uuid to 11.1.1, 12.0.1, 13.0.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-72cf0b7b8762f7cb", "name": "CVE-2026-39363: vite 6.3.5 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-39363: vite 6.3.5 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "Vite: Vite: Information disclosure via WebSocket connection bypasses access control\n\nVite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, if it is possible to connect to the Vite dev server\u2019s WebSocket without an Origin header, an attacker can invoke fetchModule via the custom WebSocket event vite:invoke and combine file://... with ?raw (or ?inline) to retrieve the contents of arbitrary files on the server as a JavaScript string (e.g., export default \"...\"). The access control enforced in the HTTP request path (such as server.fs.allo\n\nPackage: vite\nInstalled: 6.3.5\nFixed in: 8.0.5, 7.3.2, 6.4.2\nSeverity: HIGH\nFix: Upgrade vite to 8.0.5, 7.3.2, 6.4.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ade33455487cdb17", "name": "CVE-2026-53571: vite 6.3.5 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-53571: vite 6.3.5 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "vite: `server.fs.deny` bypass on Windows alternate paths\n\nVite is a frontend tooling framework for JavaScript. Prior to 8.0.16, 7.3.5, and 6.4.3, the contents of files that are specified by server.fs.deny can be returned to the browser on Windows. Vite\u2019s dev server denies direct access to sensitive files through server.fs.deny, including entries such as .env, .env.*, and *.{crt,pem}. However, on Windows, the deny logic does not correctly normalize NTFS ADS path forms before access checks are applied. Because of this, requests such as /.env::$DATA?raw a\n\nPackage: vite\nInstalled: 6.3.5\nFixed in: 8.0.16, 7.3.5, 6.4.3\nSeverity: HIGH\nFix: Upgrade vite to 8.0.16, 7.3.5, 6.4.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a8f9ac1a855d8aa8", "name": "CVE-2025-62522: vite 6.3.5 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2025-62522: vite 6.3.5 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "vite: vite allows server.fs.deny bypass via backslash on Windows\n\nVite is a frontend tooling framework for JavaScript. In versions from 2.9.18 to before 3.0.0, 3.2.9 to before 4.0.0, 4.5.3 to before 5.0.0, 5.2.6 to before 5.4.21, 6.0.0 to before 6.4.1, 7.0.0 to before 7.0.8, and 7.1.0 to before 7.1.11, files denied by server.fs.deny were sent if the URL ended with \\ when the dev server is running on Windows. Only apps explicitly exposing the Vite dev server to the network and running the dev server on Windows were affected. This issue has been patched in versi\n\nPackage: vite\nInstalled: 6.3.5\nFixed in: 7.1.11, 7.0.8, 6.4.1, 5.4.21\nSeverity: MEDIUM\nFix: Upgrade vite to 7.1.11, 7.0.8, 6.4.1, 5.4.21"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-503728a2dbe4bdbc", "name": "CVE-2026-39365: vite 6.3.5 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-39365: vite 6.3.5 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "vite: Vite: Information disclosure via path traversal in dev server's .map request handling\n\nVite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, the dev server\u2019s handling of .map requests for optimized dependencies resolves file paths and calls readFile without restricting ../ segments in the URL. As a result, it is possible to bypass the server.fs.strict allow list and retrieve .map files located outside the project root, provided they can be parsed as valid source map JSON. This vulnerability is fixed in 6.4.2, 7.3.2, and 8.0.5.\n\nPackage: vite\nInstalled: 6.3.5\nFixed in: 8.0.5, 7.3.2, 6.4.2\nSeverity: MEDIUM\nFix: Upgrade vite to 8.0.5, 7.3.2, 6.4.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6dc2a02f44329662", "name": "CVE-2026-53632: vite 6.3.5 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-53632: vite 6.3.5 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "launch-editor: launch-editor: Credential compromise via NTLMv2 password hash leak through UNC path access\n\nlaunch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.1, the launch-editor NPM package accesses arbitrary paths including Windows UNC paths. When a UNC path is opened, Windows automatically attempts NTLM authentication to the remote host, causing the user\u2019s NTLMv2 password hash to be leaked to an attacker-controlled SMB server. This can result in credential compromise through offline hash cracking. This vulnerability is fixed in 2.14.1.\n\nPackage: vite\nInstalled: 6.3.5\nFixed in: 8.0.16, 7.3.5, 6.4.3\nSeverity: MEDIUM\nFix: Upgrade vite to 8.0.16, 7.3.5, 6.4.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-355db9ab5b78f45f", "name": "CVE-2025-58751: vite 6.3.5 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2025-58751: vite 6.3.5 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "vitejs/vite: lukeed/sirv: Vite middleware may serve files starting with the same name with the public directory\n\nVite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, files starting with the same name with the public directory were served bypassing the `server.fs` settings. Only apps that explicitly expose the Vite dev server to the network (using --host or `server.host` config option), use the public directory feature (enabled by default), and have a symlink in the public directory are affected. Versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20 fix the issue.\n\nPackage: vite\nInstalled: 6.3.5\nFixed in: 7.1.5, 7.0.7, 6.3.6, 5.4.20\nSeverity: LOW\nFix: Upgrade vite to 7.1.5, 7.0.7, 6.3.6, 5.4.20"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8c19fd1e9418b6ef", "name": "CVE-2025-58752: vite 6.3.5 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2025-58752: vite 6.3.5 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "vite: Vite's `server.fs` settings were not applied to HTML files\n\nVite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, any HTML files on the machine were served regardless of the `server.fs` settings. Only apps that explicitly expose the Vite dev server to the network (using --host or server.host config option) and use `appType: 'spa'` (default) or `appType: 'mpa'` are affected. This vulnerability also affects the preview server. The preview server allowed HTML files not under the output directory to be served\n\nPackage: vite\nInstalled: 6.3.5\nFixed in: 7.1.5, 7.0.7, 6.3.6, 5.4.20\nSeverity: LOW\nFix: Upgrade vite to 7.1.5, 7.0.7, 6.3.6, 5.4.20"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-52af6ad522e2044e", "name": "CVE-2025-68157: webpack 5.98.0 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2025-68157: webpack 5.98.0 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "webpack: webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects\n\nWebpack is a module bundler. From version 5.49.0 to before 5.104.0, when experiments.buildHttp is enabled, webpack\u2019s HTTP(S) resolver (HttpUriPlugin) enforces allowedUris only for the initial URL, but does not re-validate allowedUris after following HTTP 30x redirects. As a result, an import that appears restricted to a trusted allow-list can be redirected to HTTP(S) URLs outside the allow-list. This is a policy/allow-list bypass that enables build-time SSRF behavior (requests from the build mac\n\nPackage: webpack\nInstalled: 5.98.0\nFixed in: 5.104.0\nSeverity: LOW\nFix: Upgrade webpack to 5.104.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-12bb94944eeed0bb", "name": "CVE-2025-68458: webpack 5.98.0 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2025-68458: webpack 5.98.0 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "webpack: webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior\n\nWebpack is a module bundler. From version 5.49.0 to before 5.104.1, when experiments.buildHttp is enabled, webpack\u2019s HTTP(S) resolver (HttpUriPlugin) can be bypassed to fetch resources from hosts outside allowedUris by using crafted URLs that include userinfo (username:password@host). If allowedUris enforcement relies on a raw string prefix check (e.g., uri.startsWith(allowed)), a URL that looks allow-listed can pass validation while the actual network request is sent to a different authority/ho\n\nPackage: webpack\nInstalled: 5.98.0\nFixed in: 5.104.1\nSeverity: LOW\nFix: Upgrade webpack to 5.104.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e516c4ec9b5f681c", "name": "CVE-2025-30359: webpack-dev-server 4.15.2 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2025-30359: webpack-dev-server 4.15.2 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "webpack-dev-server: webpack-dev-server information exposure\n\nwebpack-dev-server allows users to use webpack with a development server that provides live reloading. Prior to version 5.2.1, webpack-dev-server users' source code may be stolen when they access a malicious web site. Because the request for classic script by a script tag is not subject to same origin policy, an attacker can inject a malicious script in their site and run the script. Note that the attacker has to know the port and the output entrypoint script path. Combined with prototype pollut\n\nPackage: webpack-dev-server\nInstalled: 4.15.2\nFixed in: 5.2.1\nSeverity: MEDIUM\nFix: Upgrade webpack-dev-server to 5.2.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a6415d4220a8ec79", "name": "CVE-2025-30360: webpack-dev-server 4.15.2 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2025-30360: webpack-dev-server 4.15.2 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "webpack-dev-server: webpack-dev-server information exposure\n\nwebpack-dev-server allows users to use webpack with a development server that provides live reloading. Prior to version 5.2.1, webpack-dev-server users' source code may be stolen when you access a malicious web site with non-Chromium based browser. The `Origin` header is checked to prevent Cross-site WebSocket hijacking from happening, which was reported by CVE-2018-14732. But webpack-dev-server always allows IP address `Origin` headers. This allows websites that are served on IP addresses to co\n\nPackage: webpack-dev-server\nInstalled: 4.15.2\nFixed in: 5.2.1\nSeverity: MEDIUM\nFix: Upgrade webpack-dev-server to 5.2.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a05ba0341def1929", "name": "CVE-2026-14620: webpack-dev-server 4.15.2 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-14620: webpack-dev-server 4.15.2 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "webpack-dev-server: webpack-dev-server: Arbitrary file opening and denial of service via exposed developer endpoints\n\nwebpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, that perform state-changing actions on any GET request without verifying that the request originated from the dev server's own page. Any website a developer visits while the dev server is running can trigger these endpoints cross-origin with no interaction beyond the visit. An attacker can open an arbitrary existing local file in the developer\n\nPackage: webpack-dev-server\nInstalled: 4.15.2\nFixed in: 5.2.6\nSeverity: MEDIUM\nFix: Upgrade webpack-dev-server to 5.2.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-754861273385df05", "name": "CVE-2026-14631: webpack-dev-server 4.15.2 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-14631: webpack-dev-server 4.15.2 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "webpack-dev-server: webpack-dev-server: Denial of Service via malformed headers\n\nwebpack-dev-server versions 5.2.5 and earlier terminate the whole Node.js process when an unauthenticated peer sends either a normal HTTP request with a malformed Host header or a WebSocket upgrade to the default /ws endpoint with a malformed Origin header. The malformed value causes an uncaught exception in the host-validation path and crashes the dev server. Impact is limited to availability of the development server, no data disclosure, no code execution. Patches: upgrade to webpack-dev-serve\n\nPackage: webpack-dev-server\nInstalled: 4.15.2\nFixed in: 5.2.6\nSeverity: MEDIUM\nFix: Upgrade webpack-dev-server to 5.2.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f22f7955d9695c00", "name": "CVE-2026-6402: webpack-dev-server 4.15.2 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-6402: webpack-dev-server 4.15.2 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "webpack-dev-server: webpack-dev-server: Information disclosure due to cross-origin source code exposure\n\nwebpack-dev-server versions up to and including 5.2.3 are vulnerable to cross-origin source code exposure when serving over a non-potentially trustworthy origin such as plain HTTP. The previous fix relied on the Sec-Fetch-Mode and Sec-Fetch-Site request headers, which browsers omit for non-trustworthy origins, allowing a malicious site to load the bundled source as a script and read it across origins. Impact: an attacker controlling a website visited by a developer running webpack-dev-server can\n\nPackage: webpack-dev-server\nInstalled: 4.15.2\nFixed in: 5.2.4\nSeverity: MEDIUM\nFix: Upgrade webpack-dev-server to 5.2.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7710074b3f5f60b9", "name": "CVE-2026-9595: webpack-dev-server 4.15.2 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-9595: webpack-dev-server 4.15.2 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "webpack-dev-server: webpack-dev-server: Information disclosure and denial of service via improper proxy configuration\n\nImpact: When a user-configured proxy on webpack-dev-server has a broad context (e.g. /) and ws: true, it also intercepts the dev server's own HMR WebSocket and forwards it to the proxy target. This leaks the browser's cookies and Origin header to the backend, bypasses the dev server's Host/Origin validation, and corrupts the HMR socket (both HMR and the proxy end up writing to the same socket).\n\nPatches: Fixed in webpack-dev-server@5.2.5.\n\nWorkarounds: Scope user-defined proxy context to specifi\n\nPackage: webpack-dev-server\nInstalled: 4.15.2\nFixed in: 5.2.5\nSeverity: MEDIUM\nFix: Upgrade webpack-dev-server to 5.2.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-87befcc642bb3ba3", "name": "CVE-2026-54466: websocket-driver 0.7.4 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-54466: websocket-driver 0.7.4 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "websocket-driver is a WebSocket protocol handler with pluggable I/O. P ...\n\nwebsocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, the frame format in draft versions of the WebSocket protocol includes a length header that allows an arbitrarily large integer to be encoded as a sequence of bytes with the high bit set. By sending an indefinite sequence of bytes with values 0x80 or above, a client can make the server parse these bytes into an ever-growing integer in lib/websocket/driver/draft75.js; because JavaScript numbers are 64-bit floating\n\nPackage: websocket-driver\nInstalled: 0.7.4\nFixed in: 0.7.5\nSeverity: CRITICAL\nFix: Upgrade websocket-driver to 0.7.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-7781f183a103791d", "name": "CVE-2026-54490: websocket-driver 0.7.4 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-54490: websocket-driver 0.7.4 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "websocket-driver is a WebSocket protocol handler with pluggable I/O. P ...\n\nwebsocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, if this library is used with the permessage-deflate extension, a WebSocket server or client can be made to accept messages that are larger than the configured maximum message size because the limit is checked against the message frames' length headers, which give the size of the compressed data, not the size after decompression in lib/websocket/driver/hybi.js. This can lead to applications accepting larger messa\n\nPackage: websocket-driver\nInstalled: 0.7.4\nFixed in: 0.7.5\nSeverity: MEDIUM\nFix: Upgrade websocket-driver to 0.7.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-775e3692661021cd", "name": "CVE-2026-48779: ws 7.5.10 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-48779: ws 7.5.10 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments\n\nws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memory exhaustion DoS vulnerability. A peer can send a high volume of exceptionally small fragments and data chunks, with modest network traffic, to force the remote peer into allocating and holding structural wrappers that consume far more memory than the default documented message-si\n\nPackage: ws\nInstalled: 7.5.10\nFixed in: 5.2.5, 6.2.4, 7.5.11, 8.21.0\nSeverity: HIGH\nFix: Upgrade ws to 5.2.5, 6.2.4, 7.5.11, 8.21.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c747daf7aa05756f", "name": "CVE-2026-48779: ws 8.18.1 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-48779: ws 8.18.1 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments\n\nws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memory exhaustion DoS vulnerability. A peer can send a high volume of exceptionally small fragments and data chunks, with modest network traffic, to force the remote peer into allocating and holding structural wrappers that consume far more memory than the default documented message-si\n\nPackage: ws\nInstalled: 8.18.1\nFixed in: 5.2.5, 6.2.4, 7.5.11, 8.21.0\nSeverity: HIGH\nFix: Upgrade ws to 5.2.5, 6.2.4, 7.5.11, 8.21.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b397f5095cc73d37", "name": "CVE-2026-45736: ws 8.18.1 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-45736: ws 8.18.1 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray`\n\nws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.\n\nPackage: ws\nInstalled: 8.18.1\nFixed in: 8.20.1\nSeverity: MEDIUM\nFix: Upgrade ws to 8.20.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6700ef239846cd0e", "name": "CVE-2026-48779: ws 8.18.3 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-48779: ws 8.18.3 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments\n\nws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memory exhaustion DoS vulnerability. A peer can send a high volume of exceptionally small fragments and data chunks, with modest network traffic, to force the remote peer into allocating and holding structural wrappers that consume far more memory than the default documented message-si\n\nPackage: ws\nInstalled: 8.18.3\nFixed in: 5.2.5, 6.2.4, 7.5.11, 8.21.0\nSeverity: HIGH\nFix: Upgrade ws to 5.2.5, 6.2.4, 7.5.11, 8.21.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6c362237ea6c86e8", "name": "CVE-2026-45736: ws 8.18.3 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-45736: ws 8.18.3 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray`\n\nws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.\n\nPackage: ws\nInstalled: 8.18.3\nFixed in: 8.20.1\nSeverity: MEDIUM\nFix: Upgrade ws to 8.20.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-86848316fecd06ca", "name": "CVE-2026-33532: yaml 1.10.2 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-33532: yaml 1.10.2 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "yaml: yaml: Denial of Service via deeply nested YAML document parsing\n\n`yaml` is a YAML parser and serialiser for JavaScript. Parsing a YAML document with a version of `yaml` on the 1.x branch prior to 1.10.3 or on the 2.x branch prior to 2.8.3 may throw a RangeError due to a stack overflow. The node resolution/composition phase uses recursive function calls without a depth bound. An attacker who can supply YAML for parsing can trigger a `RangeError: Maximum call stack size exceeded` with a small payload (~2\u201310 KB). The `RangeError` is not a `YAMLParseError`, so ap\n\nPackage: yaml\nInstalled: 1.10.2\nFixed in: 2.8.3, 1.10.3\nSeverity: MEDIUM\nFix: Upgrade yaml to 2.8.3, 1.10.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f45eec7a084ceeda", "name": "CVE-2026-33532: yaml 2.7.0 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-33532: yaml 2.7.0 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "yaml: yaml: Denial of Service via deeply nested YAML document parsing\n\n`yaml` is a YAML parser and serialiser for JavaScript. Parsing a YAML document with a version of `yaml` on the 1.x branch prior to 1.10.3 or on the 2.x branch prior to 2.8.3 may throw a RangeError due to a stack overflow. The node resolution/composition phase uses recursive function calls without a depth bound. An attacker who can supply YAML for parsing can trigger a `RangeError: Maximum call stack size exceeded` with a small payload (~2\u201310 KB). The `RangeError` is not a `YAMLParseError`, so ap\n\nPackage: yaml\nInstalled: 2.7.0\nFixed in: 2.8.3, 1.10.3\nSeverity: MEDIUM\nFix: Upgrade yaml to 2.8.3, 1.10.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-06b2c99d6a4a1501", "name": "DS-0001: ':latest' tag used \u2014 Dockerfile", "shortDescription": {"text": "DS-0001: ':latest' tag used \u2014 Dockerfile"}, "fullDescription": {"text": "':latest' tag used\n\nSpecify a tag in the 'FROM' statement for image 'rust'\n\nRule: DS-0001\nSeverity: MEDIUM\nTarget: Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3a3527e70129fb18", "name": "DS-0002: Image user should not be 'root' \u2014 Dockerfile", "shortDescription": {"text": "DS-0002: Image user should not be 'root' \u2014 Dockerfile"}, "fullDescription": {"text": "Image user should not be 'root'\n\nSpecify at least 1 USER command in Dockerfile with non-root user as argument\n\nRule: DS-0002\nSeverity: HIGH\nTarget: Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3c4041c454cda88e", "name": "DS-0026: No HEALTHCHECK defined \u2014 Dockerfile", "shortDescription": {"text": "DS-0026: No HEALTHCHECK defined \u2014 Dockerfile"}, "fullDescription": {"text": "No HEALTHCHECK defined\n\nAdd HEALTHCHECK instruction in your Dockerfile\n\nRule: DS-0026\nSeverity: LOW\nTarget: Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a4b9283354e8accd", "name": "DS-0029: 'apt-get' missing '--no-install-recommends' \u2014 Dockerfile", "shortDescription": {"text": "DS-0029: 'apt-get' missing '--no-install-recommends' \u2014 Dockerfile"}, "fullDescription": {"text": "'apt-get' missing '--no-install-recommends'\n\n'--no-install-recommends' flag is missed: 'apt-get update && apt-get install git parallel -y'\n\nRule: DS-0029\nSeverity: HIGH\nTarget: Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2679282aa1c484b5", "name": "Agent authority lacks a verifier contract: AGENTS.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: AGENTS.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d63da3583b14afc0", "name": "Dockerfile runs as root: Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-13fc0767c11e2d59", "name": "Docker base image uses a mutable or implicit tag: rust:latest", "shortDescription": {"text": "Docker base image uses a mutable or implicit tag: rust:latest"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea0769065ed41804", "name": "Docker base image is tag-pinned but not digest-pinned: node:${NODE_VERSION}", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:${NODE_VERSION}"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1f89c4fa54a9b2a1", "name": "Insecure pattern 'node_child_process' in packages/chrome-plugin/vglrunWrapper.js:3", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/chrome-plugin/vglrunWrapper.js:3"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.9}}, {"id": "scanner-ee9566b557b3c518", "name": "Insecure pattern 'direct_outerhtml_assignment' in packages/lint-framework/src/lint/RenderBox.ts:45", "shortDescription": {"text": "Insecure pattern 'direct_outerhtml_assignment' in packages/lint-framework/src/lint/RenderBox.ts:45"}, "fullDescription": {"text": "Found a known-risky pattern (direct_outerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-b4137be90e726165", "name": "Possible secret in packages/web/vite.config.ts", "shortDescription": {"text": "Possible secret in packages/web/vite.config.ts"}, "fullDescription": {"text": "Detected 1 occurrence(s) matching generic_api_key. Rotate real credentials and move them to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.72}}, {"id": "scanner-a2a0b4c35eaaf88e", "name": "Possible secret in packages/web/src/lib/marketing/data.ts", "shortDescription": {"text": "Possible secret in packages/web/src/lib/marketing/data.ts"}, "fullDescription": {"text": "Detected 1 occurrence(s) matching generic_api_key. Rotate real credentials and move them to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.72}}, {"id": "scanner-238c79d69d09da3a", "name": "Insecure pattern 'cors_wildcard' in packages/web/src/routes/latestversion/+server.ts:14", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in packages/web/src/routes/latestversion/+server.ts:14"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2f768bba179ab82a", "name": "Insecure pattern 'direct_innerhtml_assignment' in packages/obsidian-plugin/src/State.ts:225", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/obsidian-plugin/src/State.ts:225"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-6f9297722b3c21fb", "name": "Insecure pattern 'direct_innerhtml_assignment' in packages/obsidian-plugin/src/index.ts:99", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/obsidian-plugin/src/index.ts:99"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-29626265210e84af", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-node@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4bd0f79aaa3e50c2", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/upload-artifact@v7 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-86a73356f1680380", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-node@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0cb389e43c5b975e", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-node@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4e997fb60124cd88", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/upload-artifact@v7 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a1de794a1554670f", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v7.0.0 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c303c2542f43a2da", "name": "package.json defines install-time lifecycle scripts", "shortDescription": {"text": "package.json defines install-time lifecycle scripts"}, "fullDescription": {"text": "preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6916939a786a8e97", "name": "package.json defines install-time lifecycle scripts", "shortDescription": {"text": "package.json defines install-time lifecycle scripts"}, "fullDescription": {"text": "preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cf2aeb9f349f044f", "name": "Very large file: harper-core/src/dict_word_metadata.rs (2056 lines)", "shortDescription": {"text": "Very large file: harper-core/src/dict_word_metadata.rs (2056 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-82529d8b13f38565", "name": "Very large file: harper-core/src/linting/there_is_agreement.rs (1482 lines)", "shortDescription": {"text": "Very large file: harper-core/src/linting/there_is_agreement.rs (1482 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8c30481885bd9687", "name": "Very large file: harper-core/src/linting/phrase_set_corrections/tests.rs (4010 lines)", "shortDescription": {"text": "Very large file: harper-core/src/linting/phrase_set_corrections/tests.rs (4010 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea3b5e389d8c9c0f", "name": "Low test-to-source ratio", "shortDescription": {"text": "Low test-to-source ratio"}, "fullDescription": {"text": "77 tests / 711 src (ratio 0.11)."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ce8f04c6ed505b7d", "name": "82 TODO/FIXME markers", "shortDescription": {"text": "82 TODO/FIXME markers"}, "fullDescription": {"text": "High count of TODO/FIXME/HACK markers \u2014 track them as issues so they're not forgotten."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f3ef0b0fedf51494", "name": "Node manifest has dependencies but no lockfile: packages/chrome-plugin/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/chrome-plugin/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c9f0bbd2249efa17", "name": "Node manifest has dependencies but no lockfile: packages/lint-framework/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/lint-framework/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ceec06a9962a06e7", "name": "Node manifest has dependencies but no lockfile: packages/harper-editor/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/harper-editor/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8ec8546f57542ac1", "name": "Node manifest has dependencies but no lockfile: packages/components/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/components/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a21d9e3b7b5efad1", "name": "Node manifest has dependencies but no lockfile: packages/vscode-plugin/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/vscode-plugin/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6e827b68790f9205", "name": "Node manifest has dependencies but no lockfile: packages/web/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/web/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 1.0}}, {"id": "scanner-499c1e3c3e3b5b16", "name": "Node manifest has dependencies but no lockfile: packages/wordpress-plugin/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/wordpress-plugin/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f354053a775475a0", "name": "Node manifest has dependencies but no lockfile: packages/harper.js/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/harper.js/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e0ccbadfc1a96d57", "name": "Node manifest has dependencies but no lockfile: packages/harper.js/examples/commonjs-simple/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/harper.js/examples/commonjs-simple/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5f8c98aa69b3404d", "name": "Node manifest has dependencies but no lockfile: packages/obsidian-plugin/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/obsidian-plugin/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ce2bf8e9d1ca230e", "name": "Node manifest has dependencies but no lockfile: harper-desktop/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: harper-desktop/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 24 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing lockfile. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-819d6198ee294c44", "name": "Commented-code block (5 lines) in packages/components/src/app.d.ts:5", "shortDescription": {"text": "Commented-code block (5 lines) in packages/components/src/app.d.ts:5"}, "fullDescription": {"text": "5 of 5 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-869ec55852c944e8", "name": "Vulnerable dependency ammonia 4.1.2: RUSTSEC-2026-0193", "shortDescription": {"text": "Vulnerable dependency ammonia 4.1.2: RUSTSEC-2026-0193"}, "fullDescription": {"text": "OSV.dev reports `ammonia` at version `4.1.2` (resolved in `Cargo.lock`) is affected by RUSTSEC-2026-0193.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/RUSTSEC-2026-0193\nFix: upgrade `ammonia` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ba0d7171128f0a39", "name": "Vulnerable dependency ammonia 4.1.2: RUSTSEC-2026-0213", "shortDescription": {"text": "Vulnerable dependency ammonia 4.1.2: RUSTSEC-2026-0213"}, "fullDescription": {"text": "OSV.dev reports `ammonia` at version `4.1.2` (resolved in `Cargo.lock`) is affected by RUSTSEC-2026-0213.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/RUSTSEC-2026-0213\nFix: upgrade `ammonia` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f76611a699d1cf61", "name": "Vulnerable dependency anyhow 1.0.102: RUSTSEC-2026-0190", "shortDescription": {"text": "Vulnerable dependency anyhow 1.0.102: RUSTSEC-2026-0190"}, "fullDescription": {"text": "OSV.dev reports `anyhow` at version `1.0.102` (resolved in `Cargo.lock`) is affected by RUSTSEC-2026-0190.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/RUSTSEC-2026-0190\nFix: upgrade `anyhow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-70d05205310955f7", "name": "Vulnerable dependency paste 1.0.15: RUSTSEC-2024-0436", "shortDescription": {"text": "Vulnerable dependency paste 1.0.15: RUSTSEC-2024-0436"}, "fullDescription": {"text": "OSV.dev reports `paste` at version `1.0.15` (resolved in `Cargo.lock`) is affected by RUSTSEC-2024-0436.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/RUSTSEC-2024-0436\nFix: upgrade `paste` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6ca2501f8285c2bf", "name": "Vulnerable dependency rand 0.8.5: GHSA-cq8v-f236-94qc", "shortDescription": {"text": "Vulnerable dependency rand 0.8.5: GHSA-cq8v-f236-94qc"}, "fullDescription": {"text": "OSV.dev reports `rand` at version `0.8.5` (resolved in `Cargo.lock`) is affected by GHSA-cq8v-f236-94qc.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-cq8v-f236-94qc\nFix: upgrade `rand` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0325a246f7c1753d", "name": "Vulnerable dependency rand 0.8.5: RUSTSEC-2026-0097", "shortDescription": {"text": "Vulnerable dependency rand 0.8.5: RUSTSEC-2026-0097"}, "fullDescription": {"text": "OSV.dev reports `rand` at version `0.8.5` (resolved in `Cargo.lock`) is affected by RUSTSEC-2026-0097.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/RUSTSEC-2026-0097\nFix: upgrade `rand` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6d22029acf93c203", "name": "Vulnerable dependency rand 0.9.2: GHSA-cq8v-f236-94qc", "shortDescription": {"text": "Vulnerable dependency rand 0.9.2: GHSA-cq8v-f236-94qc"}, "fullDescription": {"text": "OSV.dev reports `rand` at version `0.9.2` (resolved in `Cargo.lock`) is affected by GHSA-cq8v-f236-94qc.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-cq8v-f236-94qc\nFix: upgrade `rand` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0478e3a348858130", "name": "Vulnerable dependency rand 0.9.2: RUSTSEC-2026-0097", "shortDescription": {"text": "Vulnerable dependency rand 0.9.2: RUSTSEC-2026-0097"}, "fullDescription": {"text": "OSV.dev reports `rand` at version `0.9.2` (resolved in `Cargo.lock`) is affected by RUSTSEC-2026-0097.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/RUSTSEC-2026-0097\nFix: upgrade `rand` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-51eec1ff197a43f2", "name": "Vulnerable dependency @babel/runtime 7.25.7: GHSA-968p-4wvh-cqc8", "shortDescription": {"text": "Vulnerable dependency @babel/runtime 7.25.7: GHSA-968p-4wvh-cqc8"}, "fullDescription": {"text": "OSV.dev reports `@babel/runtime` at version `7.25.7` (resolved in `pnpm-lock.yaml`) is affected by GHSA-968p-4wvh-cqc8.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-968p-4wvh-cqc8\nFix: upgrade `@babel/runtime` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dd74546df761950e", "name": "Vulnerable dependency @sveltejs/kit 2.48.5: GHSA-2crg-3p73-43xp", "shortDescription": {"text": "Vulnerable dependency @sveltejs/kit 2.48.5: GHSA-2crg-3p73-43xp"}, "fullDescription": {"text": "OSV.dev reports `@sveltejs/kit` at version `2.48.5` (resolved in `pnpm-lock.yaml`) is affected by GHSA-2crg-3p73-43xp.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-2crg-3p73-43xp\nFix: upgrade `@sveltejs/kit` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-ca43efd3fae7680f", "name": "Vulnerable dependency @sveltejs/kit 2.48.5: GHSA-3f6h-2hrp-w5wx", "shortDescription": {"text": "Vulnerable dependency @sveltejs/kit 2.48.5: GHSA-3f6h-2hrp-w5wx"}, "fullDescription": {"text": "OSV.dev reports `@sveltejs/kit` at version `2.48.5` (resolved in `pnpm-lock.yaml`) is affected by GHSA-3f6h-2hrp-w5wx.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-3f6h-2hrp-w5wx\nFix: upgrade `@sveltejs/kit` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-6d68ef5a7b7493cb", "name": "Vulnerable dependency @sveltejs/kit 2.48.5: GHSA-hgv7-v322-mmgr", "shortDescription": {"text": "Vulnerable dependency @sveltejs/kit 2.48.5: GHSA-hgv7-v322-mmgr"}, "fullDescription": {"text": "OSV.dev reports `@sveltejs/kit` at version `2.48.5` (resolved in `pnpm-lock.yaml`) is affected by GHSA-hgv7-v322-mmgr.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-hgv7-v322-mmgr\nFix: upgrade `@sveltejs/kit` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-b565383f1178892c", "name": "Vulnerable dependency @sveltejs/kit 2.48.5: GHSA-j62c-4x62-9r35", "shortDescription": {"text": "Vulnerable dependency @sveltejs/kit 2.48.5: GHSA-j62c-4x62-9r35"}, "fullDescription": {"text": "OSV.dev reports `@sveltejs/kit` at version `2.48.5` (resolved in `pnpm-lock.yaml`) is affected by GHSA-j62c-4x62-9r35.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-j62c-4x62-9r35\nFix: upgrade `@sveltejs/kit` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-7647d70179c0ee2d", "name": "Vulnerable dependency @vitest/browser 4.0.16: GHSA-g8mr-85jm-7xhm", "shortDescription": {"text": "Vulnerable dependency @vitest/browser 4.0.16: GHSA-g8mr-85jm-7xhm"}, "fullDescription": {"text": "OSV.dev reports `@vitest/browser` at version `4.0.16` (resolved in `pnpm-lock.yaml`) is affected by GHSA-g8mr-85jm-7xhm.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-g8mr-85jm-7xhm\nFix: upgrade `@vitest/browser` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-b818cfb0c24b5289", "name": "Vulnerable dependency @vitest/browser 4.0.16: GHSA-p63j-vcc4-9vmv", "shortDescription": {"text": "Vulnerable dependency @vitest/browser 4.0.16: GHSA-p63j-vcc4-9vmv"}, "fullDescription": {"text": "OSV.dev reports `@vitest/browser` at version `4.0.16` (resolved in `pnpm-lock.yaml`) is affected by GHSA-p63j-vcc4-9vmv.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-p63j-vcc4-9vmv\nFix: upgrade `@vitest/browser` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-b2090be9565c6dfc", "name": "Vulnerable dependency drizzle-orm 0.44.6: GHSA-gpj5-g38j-94v9", "shortDescription": {"text": "Vulnerable dependency drizzle-orm 0.44.6: GHSA-gpj5-g38j-94v9"}, "fullDescription": {"text": "OSV.dev reports `drizzle-orm` at version `0.44.6` (resolved in `pnpm-lock.yaml`) is affected by GHSA-gpj5-g38j-94v9.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-gpj5-g38j-94v9\nFix: upgrade `drizzle-orm` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-de1b96f6ccc2018f", "name": "Vulnerable dependency esbuild 0.18.20: GHSA-67mh-4wv8-2f99", "shortDescription": {"text": "Vulnerable dependency esbuild 0.18.20: GHSA-67mh-4wv8-2f99"}, "fullDescription": {"text": "OSV.dev reports `esbuild` at version `0.18.20` (resolved in `pnpm-lock.yaml`) is affected by GHSA-67mh-4wv8-2f99.\n\nesbuild enables any website to send any requests to the development server and read the response\n\nAdvisory: https://osv.dev/vulnerability/GHSA-67mh-4wv8-2f99\nFix: upgrade `esbuild` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f2a785452881004e", "name": "Vulnerable dependency esbuild 0.21.5: GHSA-67mh-4wv8-2f99", "shortDescription": {"text": "Vulnerable dependency esbuild 0.21.5: GHSA-67mh-4wv8-2f99"}, "fullDescription": {"text": "OSV.dev reports `esbuild` at version `0.21.5` (resolved in `pnpm-lock.yaml`) is affected by GHSA-67mh-4wv8-2f99.\n\nesbuild enables any website to send any requests to the development server and read the response\n\nAdvisory: https://osv.dev/vulnerability/GHSA-67mh-4wv8-2f99\nFix: upgrade `esbuild` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bae0a3f4ea305b1b", "name": "Vulnerable dependency esbuild 0.23.1: GHSA-67mh-4wv8-2f99", "shortDescription": {"text": "Vulnerable dependency esbuild 0.23.1: GHSA-67mh-4wv8-2f99"}, "fullDescription": {"text": "OSV.dev reports `esbuild` at version `0.23.1` (resolved in `pnpm-lock.yaml`) is affected by GHSA-67mh-4wv8-2f99.\n\nesbuild enables any website to send any requests to the development server and read the response\n\nAdvisory: https://osv.dev/vulnerability/GHSA-67mh-4wv8-2f99\nFix: upgrade `esbuild` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-08a0e0c71a8193d1", "name": "Vulnerable dependency lodash-es 4.17.21: GHSA-f23m-r3pf-42rh", "shortDescription": {"text": "Vulnerable dependency lodash-es 4.17.21: GHSA-f23m-r3pf-42rh"}, "fullDescription": {"text": "OSV.dev reports `lodash-es` at version `4.17.21` (resolved in `pnpm-lock.yaml`) is affected by GHSA-f23m-r3pf-42rh.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-f23m-r3pf-42rh\nFix: upgrade `lodash-es` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5a3d1f291f10cd0d", "name": "Vulnerable dependency lodash-es 4.17.21: GHSA-r5fr-rjxr-66jc", "shortDescription": {"text": "Vulnerable dependency lodash-es 4.17.21: GHSA-r5fr-rjxr-66jc"}, "fullDescription": {"text": "OSV.dev reports `lodash-es` at version `4.17.21` (resolved in `pnpm-lock.yaml`) is affected by GHSA-r5fr-rjxr-66jc.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-r5fr-rjxr-66jc\nFix: upgrade `lodash-es` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-49a99a6600677eb0", "name": "Vulnerable dependency lodash-es 4.17.21: GHSA-xxjr-mmjv-4gpg", "shortDescription": {"text": "Vulnerable dependency lodash-es 4.17.21: GHSA-xxjr-mmjv-4gpg"}, "fullDescription": {"text": "OSV.dev reports `lodash-es` at version `4.17.21` (resolved in `pnpm-lock.yaml`) is affected by GHSA-xxjr-mmjv-4gpg.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-xxjr-mmjv-4gpg\nFix: upgrade `lodash-es` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-71d13decb3f1f1ca", "name": "Vulnerable dependency minimatch 10.0.1: GHSA-23c5-xmqv-rm74", "shortDescription": {"text": "Vulnerable dependency minimatch 10.0.1: GHSA-23c5-xmqv-rm74"}, "fullDescription": {"text": "OSV.dev reports `minimatch` at version `10.0.1` (resolved in `pnpm-lock.yaml`) is affected by GHSA-23c5-xmqv-rm74 (aka CVE-2026-27904).\n\nminimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions\n\nAliases: CVE-2026-27904\nAdvisory: https://osv.dev/vulnerability/GHSA-23c5-xmqv-rm74\nFix: upgrade `minimatch` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0d887101f1cafa22", "name": "Vulnerable dependency minimatch 10.0.1: GHSA-3ppc-4f35-3m26", "shortDescription": {"text": "Vulnerable dependency minimatch 10.0.1: GHSA-3ppc-4f35-3m26"}, "fullDescription": {"text": "OSV.dev reports `minimatch` at version `10.0.1` (resolved in `pnpm-lock.yaml`) is affected by GHSA-3ppc-4f35-3m26 (aka CVE-2026-26996).\n\nminimatch has a ReDoS via repeated wildcards with non-matching literal in pattern\n\nAliases: CVE-2026-26996\nAdvisory: https://osv.dev/vulnerability/GHSA-3ppc-4f35-3m26\nFix: upgrade `minimatch` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-44e8ed790dfb948d", "name": "Vulnerable dependency minimatch 10.0.1: GHSA-7r86-cg39-jmmj", "shortDescription": {"text": "Vulnerable dependency minimatch 10.0.1: GHSA-7r86-cg39-jmmj"}, "fullDescription": {"text": "OSV.dev reports `minimatch` at version `10.0.1` (resolved in `pnpm-lock.yaml`) is affected by GHSA-7r86-cg39-jmmj (aka CVE-2026-27903).\n\nminimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments\n\nAliases: CVE-2026-27903\nAdvisory: https://osv.dev/vulnerability/GHSA-7r86-cg39-jmmj\nFix: upgrade `minimatch` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f681485b948b6354", "name": "Vulnerable dependency minimatch 10.0.3: GHSA-23c5-xmqv-rm74", "shortDescription": {"text": "Vulnerable dependency minimatch 10.0.3: GHSA-23c5-xmqv-rm74"}, "fullDescription": {"text": "OSV.dev reports `minimatch` at version `10.0.3` (resolved in `pnpm-lock.yaml`) is affected by GHSA-23c5-xmqv-rm74 (aka CVE-2026-27904).\n\nminimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions\n\nAliases: CVE-2026-27904\nAdvisory: https://osv.dev/vulnerability/GHSA-23c5-xmqv-rm74\nFix: upgrade `minimatch` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-80f13cd2235c6ed4", "name": "Vulnerable dependency minimatch 10.0.3: GHSA-3ppc-4f35-3m26", "shortDescription": {"text": "Vulnerable dependency minimatch 10.0.3: GHSA-3ppc-4f35-3m26"}, "fullDescription": {"text": "OSV.dev reports `minimatch` at version `10.0.3` (resolved in `pnpm-lock.yaml`) is affected by GHSA-3ppc-4f35-3m26 (aka CVE-2026-26996).\n\nminimatch has a ReDoS via repeated wildcards with non-matching literal in pattern\n\nAliases: CVE-2026-26996\nAdvisory: https://osv.dev/vulnerability/GHSA-3ppc-4f35-3m26\nFix: upgrade `minimatch` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9d37ca5305ef54b8", "name": "Vulnerable dependency minimatch 10.0.3: GHSA-7r86-cg39-jmmj", "shortDescription": {"text": "Vulnerable dependency minimatch 10.0.3: GHSA-7r86-cg39-jmmj"}, "fullDescription": {"text": "OSV.dev reports `minimatch` at version `10.0.3` (resolved in `pnpm-lock.yaml`) is affected by GHSA-7r86-cg39-jmmj (aka CVE-2026-27903).\n\nminimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments\n\nAliases: CVE-2026-27903\nAdvisory: https://osv.dev/vulnerability/GHSA-7r86-cg39-jmmj\nFix: upgrade `minimatch` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-035e7c548040df38", "name": "Vulnerable dependency minimatch 3.0.8: GHSA-23c5-xmqv-rm74", "shortDescription": {"text": "Vulnerable dependency minimatch 3.0.8: GHSA-23c5-xmqv-rm74"}, "fullDescription": {"text": "OSV.dev reports `minimatch` at version `3.0.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-23c5-xmqv-rm74 (aka CVE-2026-27904).\n\nminimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions\n\nAliases: CVE-2026-27904\nAdvisory: https://osv.dev/vulnerability/GHSA-23c5-xmqv-rm74\nFix: upgrade `minimatch` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f624ac9457a6c5d9", "name": "Vulnerable dependency minimatch 3.0.8: GHSA-3ppc-4f35-3m26", "shortDescription": {"text": "Vulnerable dependency minimatch 3.0.8: GHSA-3ppc-4f35-3m26"}, "fullDescription": {"text": "OSV.dev reports `minimatch` at version `3.0.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-3ppc-4f35-3m26 (aka CVE-2026-26996).\n\nminimatch has a ReDoS via repeated wildcards with non-matching literal in pattern\n\nAliases: CVE-2026-26996\nAdvisory: https://osv.dev/vulnerability/GHSA-3ppc-4f35-3m26\nFix: upgrade `minimatch` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-413287385f084105", "name": "Vulnerable dependency minimatch 3.0.8: GHSA-7r86-cg39-jmmj", "shortDescription": {"text": "Vulnerable dependency minimatch 3.0.8: GHSA-7r86-cg39-jmmj"}, "fullDescription": {"text": "OSV.dev reports `minimatch` at version `3.0.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-7r86-cg39-jmmj (aka CVE-2026-27903).\n\nminimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments\n\nAliases: CVE-2026-27903\nAdvisory: https://osv.dev/vulnerability/GHSA-7r86-cg39-jmmj\nFix: upgrade `minimatch` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3e0ab6ef811f0b4d", "name": "Vulnerable dependency minimatch 3.1.2: GHSA-23c5-xmqv-rm74", "shortDescription": {"text": "Vulnerable dependency minimatch 3.1.2: GHSA-23c5-xmqv-rm74"}, "fullDescription": {"text": "OSV.dev reports `minimatch` at version `3.1.2` (resolved in `pnpm-lock.yaml`) is affected by GHSA-23c5-xmqv-rm74 (aka CVE-2026-27904).\n\nminimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions\n\nAliases: CVE-2026-27904\nAdvisory: https://osv.dev/vulnerability/GHSA-23c5-xmqv-rm74\nFix: upgrade `minimatch` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1db0ed7f82e2cc7b", "name": "Vulnerable dependency minimatch 3.1.2: GHSA-3ppc-4f35-3m26", "shortDescription": {"text": "Vulnerable dependency minimatch 3.1.2: GHSA-3ppc-4f35-3m26"}, "fullDescription": {"text": "OSV.dev reports `minimatch` at version `3.1.2` (resolved in `pnpm-lock.yaml`) is affected by GHSA-3ppc-4f35-3m26 (aka CVE-2026-26996).\n\nminimatch has a ReDoS via repeated wildcards with non-matching literal in pattern\n\nAliases: CVE-2026-26996\nAdvisory: https://osv.dev/vulnerability/GHSA-3ppc-4f35-3m26\nFix: upgrade `minimatch` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5500b45af7440f9f", "name": "Vulnerable dependency minimatch 3.1.2: GHSA-7r86-cg39-jmmj", "shortDescription": {"text": "Vulnerable dependency minimatch 3.1.2: GHSA-7r86-cg39-jmmj"}, "fullDescription": {"text": "OSV.dev reports `minimatch` at version `3.1.2` (resolved in `pnpm-lock.yaml`) is affected by GHSA-7r86-cg39-jmmj (aka CVE-2026-27903).\n\nminimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments\n\nAliases: CVE-2026-27903\nAdvisory: https://osv.dev/vulnerability/GHSA-7r86-cg39-jmmj\nFix: upgrade `minimatch` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d596ada94fc9f8b1", "name": "Vulnerable dependency minimatch 5.1.6: GHSA-23c5-xmqv-rm74", "shortDescription": {"text": "Vulnerable dependency minimatch 5.1.6: GHSA-23c5-xmqv-rm74"}, "fullDescription": {"text": "OSV.dev reports `minimatch` at version `5.1.6` (resolved in `pnpm-lock.yaml`) is affected by GHSA-23c5-xmqv-rm74 (aka CVE-2026-27904).\n\nminimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions\n\nAliases: CVE-2026-27904\nAdvisory: https://osv.dev/vulnerability/GHSA-23c5-xmqv-rm74\nFix: upgrade `minimatch` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9124e66e5f52f8cd", "name": "Vulnerable dependency minimatch 5.1.6: GHSA-3ppc-4f35-3m26", "shortDescription": {"text": "Vulnerable dependency minimatch 5.1.6: GHSA-3ppc-4f35-3m26"}, "fullDescription": {"text": "OSV.dev reports `minimatch` at version `5.1.6` (resolved in `pnpm-lock.yaml`) is affected by GHSA-3ppc-4f35-3m26 (aka CVE-2026-26996).\n\nminimatch has a ReDoS via repeated wildcards with non-matching literal in pattern\n\nAliases: CVE-2026-26996\nAdvisory: https://osv.dev/vulnerability/GHSA-3ppc-4f35-3m26\nFix: upgrade `minimatch` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9b3d8e1ae44f10f6", "name": "Vulnerable dependency minimatch 5.1.6: GHSA-7r86-cg39-jmmj", "shortDescription": {"text": "Vulnerable dependency minimatch 5.1.6: GHSA-7r86-cg39-jmmj"}, "fullDescription": {"text": "OSV.dev reports `minimatch` at version `5.1.6` (resolved in `pnpm-lock.yaml`) is affected by GHSA-7r86-cg39-jmmj (aka CVE-2026-27903).\n\nminimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments\n\nAliases: CVE-2026-27903\nAdvisory: https://osv.dev/vulnerability/GHSA-7r86-cg39-jmmj\nFix: upgrade `minimatch` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-73a288b8d92b124f", "name": "Vulnerable dependency minimatch 9.0.3: GHSA-23c5-xmqv-rm74", "shortDescription": {"text": "Vulnerable dependency minimatch 9.0.3: GHSA-23c5-xmqv-rm74"}, "fullDescription": {"text": "OSV.dev reports `minimatch` at version `9.0.3` (resolved in `pnpm-lock.yaml`) is affected by GHSA-23c5-xmqv-rm74 (aka CVE-2026-27904).\n\nminimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions\n\nAliases: CVE-2026-27904\nAdvisory: https://osv.dev/vulnerability/GHSA-23c5-xmqv-rm74\nFix: upgrade `minimatch` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f71bd5c93720b781", "name": "Vulnerable dependency minimatch 9.0.3: GHSA-3ppc-4f35-3m26", "shortDescription": {"text": "Vulnerable dependency minimatch 9.0.3: GHSA-3ppc-4f35-3m26"}, "fullDescription": {"text": "OSV.dev reports `minimatch` at version `9.0.3` (resolved in `pnpm-lock.yaml`) is affected by GHSA-3ppc-4f35-3m26 (aka CVE-2026-26996).\n\nminimatch has a ReDoS via repeated wildcards with non-matching literal in pattern\n\nAliases: CVE-2026-26996\nAdvisory: https://osv.dev/vulnerability/GHSA-3ppc-4f35-3m26\nFix: upgrade `minimatch` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9f43e077467c5a43", "name": "Vulnerable dependency minimatch 9.0.3: GHSA-7r86-cg39-jmmj", "shortDescription": {"text": "Vulnerable dependency minimatch 9.0.3: GHSA-7r86-cg39-jmmj"}, "fullDescription": {"text": "OSV.dev reports `minimatch` at version `9.0.3` (resolved in `pnpm-lock.yaml`) is affected by GHSA-7r86-cg39-jmmj (aka CVE-2026-27903).\n\nminimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments\n\nAliases: CVE-2026-27903\nAdvisory: https://osv.dev/vulnerability/GHSA-7r86-cg39-jmmj\nFix: upgrade `minimatch` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8e951b0e56d9d24d", "name": "Vulnerable dependency minimatch 9.0.5: GHSA-23c5-xmqv-rm74", "shortDescription": {"text": "Vulnerable dependency minimatch 9.0.5: GHSA-23c5-xmqv-rm74"}, "fullDescription": {"text": "OSV.dev reports `minimatch` at version `9.0.5` (resolved in `pnpm-lock.yaml`) is affected by GHSA-23c5-xmqv-rm74 (aka CVE-2026-27904).\n\nminimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions\n\nAliases: CVE-2026-27904\nAdvisory: https://osv.dev/vulnerability/GHSA-23c5-xmqv-rm74\nFix: upgrade `minimatch` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9c9c43733733335d", "name": "Vulnerable dependency minimatch 9.0.5: GHSA-3ppc-4f35-3m26", "shortDescription": {"text": "Vulnerable dependency minimatch 9.0.5: GHSA-3ppc-4f35-3m26"}, "fullDescription": {"text": "OSV.dev reports `minimatch` at version `9.0.5` (resolved in `pnpm-lock.yaml`) is affected by GHSA-3ppc-4f35-3m26 (aka CVE-2026-26996).\n\nminimatch has a ReDoS via repeated wildcards with non-matching literal in pattern\n\nAliases: CVE-2026-26996\nAdvisory: https://osv.dev/vulnerability/GHSA-3ppc-4f35-3m26\nFix: upgrade `minimatch` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-503705cb1d1abb6a", "name": "Vulnerable dependency minimatch 9.0.5: GHSA-7r86-cg39-jmmj", "shortDescription": {"text": "Vulnerable dependency minimatch 9.0.5: GHSA-7r86-cg39-jmmj"}, "fullDescription": {"text": "OSV.dev reports `minimatch` at version `9.0.5` (resolved in `pnpm-lock.yaml`) is affected by GHSA-7r86-cg39-jmmj (aka CVE-2026-27903).\n\nminimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments\n\nAliases: CVE-2026-27903\nAdvisory: https://osv.dev/vulnerability/GHSA-7r86-cg39-jmmj\nFix: upgrade `minimatch` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9b93b01792761f90", "name": "Vulnerable dependency svelte 5.0.0: GHSA-crpf-4hrx-3jrp", "shortDescription": {"text": "Vulnerable dependency svelte 5.0.0: GHSA-crpf-4hrx-3jrp"}, "fullDescription": {"text": "OSV.dev reports `svelte` at version `5.0.0` (declared in `harper-desktop/package.json`) is affected by GHSA-crpf-4hrx-3jrp (aka CVE-2026-27125).\nNote: `5.0.0` is the declared floor of a range \u2014 the installed version may be newer.\n\nSvelte SSR attribute spreading includes inherited properties from prototype chain\n\nAliases: CVE-2026-27125\nAdvisory: https://osv.dev/vulnerability/GHSA-crpf-4hrx-3jrp\nFix: upgrade `svelte` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-183c94558d7cde45", "name": "Vulnerable dependency svelte 5.0.0: GHSA-f7gr-6p89-r883", "shortDescription": {"text": "Vulnerable dependency svelte 5.0.0: GHSA-f7gr-6p89-r883"}, "fullDescription": {"text": "OSV.dev reports `svelte` at version `5.0.0` (declared in `harper-desktop/package.json`) is affected by GHSA-f7gr-6p89-r883.\nNote: `5.0.0` is the declared floor of a range \u2014 the installed version may be newer.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-f7gr-6p89-r883\nFix: upgrade `svelte` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-a94dc7752bf1aac6", "name": "Vulnerable dependency svelte 5.0.0: GHSA-m56q-vw4c-c2cp", "shortDescription": {"text": "Vulnerable dependency svelte 5.0.0: GHSA-m56q-vw4c-c2cp"}, "fullDescription": {"text": "OSV.dev reports `svelte` at version `5.0.0` (declared in `harper-desktop/package.json`) is affected by GHSA-m56q-vw4c-c2cp.\nNote: `5.0.0` is the declared floor of a range \u2014 the installed version may be newer.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-m56q-vw4c-c2cp\nFix: upgrade `svelte` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-2983a635204a7b23", "name": "Vulnerable dependency svelte 5.0.0: GHSA-phwv-c562-gvmh", "shortDescription": {"text": "Vulnerable dependency svelte 5.0.0: GHSA-phwv-c562-gvmh"}, "fullDescription": {"text": "OSV.dev reports `svelte` at version `5.0.0` (declared in `harper-desktop/package.json`) is affected by GHSA-phwv-c562-gvmh.\nNote: `5.0.0` is the declared floor of a range \u2014 the installed version may be newer.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-phwv-c562-gvmh\nFix: upgrade `svelte` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-7fddb1e043ad2b44", "name": "Vulnerable dependency svelte 5.0.0: GHSA-pr6f-5x2q-rwfp", "shortDescription": {"text": "Vulnerable dependency svelte 5.0.0: GHSA-pr6f-5x2q-rwfp"}, "fullDescription": {"text": "OSV.dev reports `svelte` at version `5.0.0` (declared in `harper-desktop/package.json`) is affected by GHSA-pr6f-5x2q-rwfp.\nNote: `5.0.0` is the declared floor of a range \u2014 the installed version may be newer.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-pr6f-5x2q-rwfp\nFix: upgrade `svelte` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-ef0c8298d1a7bce8", "name": "Vulnerable dependency svelte 5.0.0: GHSA-rcqx-6q8c-2c42", "shortDescription": {"text": "Vulnerable dependency svelte 5.0.0: GHSA-rcqx-6q8c-2c42"}, "fullDescription": {"text": "OSV.dev reports `svelte` at version `5.0.0` (declared in `harper-desktop/package.json`) is affected by GHSA-rcqx-6q8c-2c42.\nNote: `5.0.0` is the declared floor of a range \u2014 the installed version may be newer.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-rcqx-6q8c-2c42\nFix: upgrade `svelte` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-d5705e9b058894c9", "name": "Vulnerable dependency vite 6.0.3: GHSA-356w-63v5-8wf4", "shortDescription": {"text": "Vulnerable dependency vite 6.0.3: GHSA-356w-63v5-8wf4"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `6.0.3` (declared in `harper-desktop/package.json`) is affected by GHSA-356w-63v5-8wf4 (aka CVE-2025-32395).\nNote: `6.0.3` is the declared floor of a range \u2014 the installed version may be newer.\n\nVite has an `server.fs.deny` bypass with an invalid `request-target`\n\nAliases: CVE-2025-32395\nAdvisory: https://osv.dev/vulnerability/GHSA-356w-63v5-8wf4\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-3deda3cd0b18c097", "name": "Vulnerable dependency vite 6.0.3: GHSA-4r4m-qw57-chr8", "shortDescription": {"text": "Vulnerable dependency vite 6.0.3: GHSA-4r4m-qw57-chr8"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `6.0.3` (declared in `harper-desktop/package.json`) is affected by GHSA-4r4m-qw57-chr8 (aka CVE-2025-31125).\nNote: `6.0.3` is the declared floor of a range \u2014 the installed version may be newer.\n\nVite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query\n\nAliases: CVE-2025-31125\nAdvisory: https://osv.dev/vulnerability/GHSA-4r4m-qw57-chr8\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-a2f2b9a3bba4eb94", "name": "Vulnerable dependency vite 6.0.3: GHSA-4w7w-66w2-5vf9", "shortDescription": {"text": "Vulnerable dependency vite 6.0.3: GHSA-4w7w-66w2-5vf9"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `6.0.3` (declared in `harper-desktop/package.json`) is affected by GHSA-4w7w-66w2-5vf9 (aka CVE-2026-39365).\nNote: `6.0.3` is the declared floor of a range \u2014 the installed version may be newer.\n\nVite Vulnerable to Path Traversal in Optimized Deps `.map` Handling\n\nAliases: CVE-2026-39365\nAdvisory: https://osv.dev/vulnerability/GHSA-4w7w-66w2-5vf9\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-77af4072b0b8ae44", "name": "Vulnerable dependency vite 6.0.3: GHSA-859w-5945-r5v3", "shortDescription": {"text": "Vulnerable dependency vite 6.0.3: GHSA-859w-5945-r5v3"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `6.0.3` (declared in `harper-desktop/package.json`) is affected by GHSA-859w-5945-r5v3 (aka CVE-2025-46565).\nNote: `6.0.3` is the declared floor of a range \u2014 the installed version may be newer.\n\nVite's server.fs.deny bypassed with /. for files under project root\n\nAliases: CVE-2025-46565\nAdvisory: https://osv.dev/vulnerability/GHSA-859w-5945-r5v3\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-205eeb624af409cd", "name": "Vulnerable dependency vite 6.0.3: GHSA-93m4-6634-74q7", "shortDescription": {"text": "Vulnerable dependency vite 6.0.3: GHSA-93m4-6634-74q7"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `6.0.3` (declared in `harper-desktop/package.json`) is affected by GHSA-93m4-6634-74q7 (aka CVE-2025-62522).\nNote: `6.0.3` is the declared floor of a range \u2014 the installed version may be newer.\n\nvite allows server.fs.deny bypass via backslash on Windows\n\nAliases: CVE-2025-62522\nAdvisory: https://osv.dev/vulnerability/GHSA-93m4-6634-74q7\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-800b1df197d1d485", "name": "Vulnerable dependency vite 6.0.3: GHSA-fx2h-pf6j-xcff", "shortDescription": {"text": "Vulnerable dependency vite 6.0.3: GHSA-fx2h-pf6j-xcff"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `6.0.3` (declared in `harper-desktop/package.json`) is affected by GHSA-fx2h-pf6j-xcff (aka CVE-2026-53571).\nNote: `6.0.3` is the declared floor of a range \u2014 the installed version may be newer.\n\nvite: `server.fs.deny` bypass on Windows alternate paths\n\nAliases: CVE-2026-53571\nAdvisory: https://osv.dev/vulnerability/GHSA-fx2h-pf6j-xcff\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.7}}, {"id": "scanner-4698cb911178c35d", "name": "Vulnerable dependency vite 6.0.3: GHSA-g4jq-h2w9-997c", "shortDescription": {"text": "Vulnerable dependency vite 6.0.3: GHSA-g4jq-h2w9-997c"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `6.0.3` (declared in `harper-desktop/package.json`) is affected by GHSA-g4jq-h2w9-997c (aka CVE-2025-58751).\nNote: `6.0.3` is the declared floor of a range \u2014 the installed version may be newer.\n\nVite middleware may serve files starting with the same name with the public directory\n\nAliases: CVE-2025-58751\nAdvisory: https://osv.dev/vulnerability/GHSA-g4jq-h2w9-997c\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.7}}, {"id": "scanner-960349129d8d9632", "name": "Vulnerable dependency vite 6.0.3: GHSA-jqfw-vq24-v9c3", "shortDescription": {"text": "Vulnerable dependency vite 6.0.3: GHSA-jqfw-vq24-v9c3"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `6.0.3` (declared in `harper-desktop/package.json`) is affected by GHSA-jqfw-vq24-v9c3 (aka CVE-2025-58752).\nNote: `6.0.3` is the declared floor of a range \u2014 the installed version may be newer.\n\nVite's `server.fs` settings were not applied to HTML files\n\nAliases: CVE-2025-58752\nAdvisory: https://osv.dev/vulnerability/GHSA-jqfw-vq24-v9c3\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.7}}, {"id": "scanner-2dd4b59048ece9b8", "name": "Vulnerable dependency vite 6.0.3: GHSA-p9ff-h696-f583", "shortDescription": {"text": "Vulnerable dependency vite 6.0.3: GHSA-p9ff-h696-f583"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `6.0.3` (declared in `harper-desktop/package.json`) is affected by GHSA-p9ff-h696-f583 (aka CVE-2026-39363).\nNote: `6.0.3` is the declared floor of a range \u2014 the installed version may be newer.\n\nVite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket\n\nAliases: CVE-2026-39363\nAdvisory: https://osv.dev/vulnerability/GHSA-p9ff-h696-f583\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.7}}, {"id": "scanner-f681f212cde7f3b8", "name": "Vulnerable dependency vite 6.0.3: GHSA-v6wh-96g9-6wx3", "shortDescription": {"text": "Vulnerable dependency vite 6.0.3: GHSA-v6wh-96g9-6wx3"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `6.0.3` (declared in `harper-desktop/package.json`) is affected by GHSA-v6wh-96g9-6wx3 (aka CVE-2026-53632).\nNote: `6.0.3` is the declared floor of a range \u2014 the installed version may be newer.\n\nlaunch-editor: NTLMv2 hash disclosure via UNC path handling on Windows\n\nAliases: CVE-2026-53632\nAdvisory: https://osv.dev/vulnerability/GHSA-v6wh-96g9-6wx3\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-36390ade96e987c6", "name": "Vulnerable dependency vite 6.0.3: GHSA-vg6x-rcgg-rjx6", "shortDescription": {"text": "Vulnerable dependency vite 6.0.3: GHSA-vg6x-rcgg-rjx6"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `6.0.3` (declared in `harper-desktop/package.json`) is affected by GHSA-vg6x-rcgg-rjx6.\nNote: `6.0.3` is the declared floor of a range \u2014 the installed version may be newer.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-vg6x-rcgg-rjx6\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-1d1a22ae3e26c126", "name": "Vulnerable dependency vite 6.0.3: GHSA-x574-m823-4x7w", "shortDescription": {"text": "Vulnerable dependency vite 6.0.3: GHSA-x574-m823-4x7w"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `6.0.3` (declared in `harper-desktop/package.json`) is affected by GHSA-x574-m823-4x7w.\nNote: `6.0.3` is the declared floor of a range \u2014 the installed version may be newer.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-x574-m823-4x7w\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-2a58d0d0849b5195", "name": "Vulnerable dependency vite 6.0.3: GHSA-xcj6-pq6g-qj4x", "shortDescription": {"text": "Vulnerable dependency vite 6.0.3: GHSA-xcj6-pq6g-qj4x"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `6.0.3` (declared in `harper-desktop/package.json`) is affected by GHSA-xcj6-pq6g-qj4x.\nNote: `6.0.3` is the declared floor of a range \u2014 the installed version may be newer.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-xcj6-pq6g-qj4x\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-53ce4c71398fbd4a", "name": "Vulnerable dependency vite 5.4.10: GHSA-356w-63v5-8wf4", "shortDescription": {"text": "Vulnerable dependency vite 5.4.10: GHSA-356w-63v5-8wf4"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `5.4.10` (declared in `packages/chrome-plugin/package.json`) is affected by GHSA-356w-63v5-8wf4 (aka CVE-2025-32395).\nNote: `5.4.10` is the declared floor of a range \u2014 the installed version may be newer.\n\nVite has an `server.fs.deny` bypass with an invalid `request-target`\n\nAliases: CVE-2025-32395\nAdvisory: https://osv.dev/vulnerability/GHSA-356w-63v5-8wf4\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-05091a532d68d311", "name": "Vulnerable dependency vite 5.4.10: GHSA-4r4m-qw57-chr8", "shortDescription": {"text": "Vulnerable dependency vite 5.4.10: GHSA-4r4m-qw57-chr8"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `5.4.10` (declared in `packages/chrome-plugin/package.json`) is affected by GHSA-4r4m-qw57-chr8 (aka CVE-2025-31125).\nNote: `5.4.10` is the declared floor of a range \u2014 the installed version may be newer.\n\nVite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query\n\nAliases: CVE-2025-31125\nAdvisory: https://osv.dev/vulnerability/GHSA-4r4m-qw57-chr8\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-c9898f55fcb9cd97", "name": "Vulnerable dependency vite 5.4.10: GHSA-4w7w-66w2-5vf9", "shortDescription": {"text": "Vulnerable dependency vite 5.4.10: GHSA-4w7w-66w2-5vf9"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `5.4.10` (declared in `packages/chrome-plugin/package.json`) is affected by GHSA-4w7w-66w2-5vf9 (aka CVE-2026-39365).\nNote: `5.4.10` is the declared floor of a range \u2014 the installed version may be newer.\n\nVite Vulnerable to Path Traversal in Optimized Deps `.map` Handling\n\nAliases: CVE-2026-39365\nAdvisory: https://osv.dev/vulnerability/GHSA-4w7w-66w2-5vf9\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-a3e42f932c9a87cb", "name": "Vulnerable dependency vite 5.4.10: GHSA-859w-5945-r5v3", "shortDescription": {"text": "Vulnerable dependency vite 5.4.10: GHSA-859w-5945-r5v3"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `5.4.10` (declared in `packages/chrome-plugin/package.json`) is affected by GHSA-859w-5945-r5v3 (aka CVE-2025-46565).\nNote: `5.4.10` is the declared floor of a range \u2014 the installed version may be newer.\n\nVite's server.fs.deny bypassed with /. for files under project root\n\nAliases: CVE-2025-46565\nAdvisory: https://osv.dev/vulnerability/GHSA-859w-5945-r5v3\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-ea4321fb04539e35", "name": "Vulnerable dependency vite 5.4.10: GHSA-93m4-6634-74q7", "shortDescription": {"text": "Vulnerable dependency vite 5.4.10: GHSA-93m4-6634-74q7"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `5.4.10` (declared in `packages/chrome-plugin/package.json`) is affected by GHSA-93m4-6634-74q7 (aka CVE-2025-62522).\nNote: `5.4.10` is the declared floor of a range \u2014 the installed version may be newer.\n\nvite allows server.fs.deny bypass via backslash on Windows\n\nAliases: CVE-2025-62522\nAdvisory: https://osv.dev/vulnerability/GHSA-93m4-6634-74q7\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-922f3d02c78c45e1", "name": "Vulnerable dependency vite 5.4.10: GHSA-fx2h-pf6j-xcff", "shortDescription": {"text": "Vulnerable dependency vite 5.4.10: GHSA-fx2h-pf6j-xcff"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `5.4.10` (declared in `packages/chrome-plugin/package.json`) is affected by GHSA-fx2h-pf6j-xcff (aka CVE-2026-53571).\nNote: `5.4.10` is the declared floor of a range \u2014 the installed version may be newer.\n\nvite: `server.fs.deny` bypass on Windows alternate paths\n\nAliases: CVE-2026-53571\nAdvisory: https://osv.dev/vulnerability/GHSA-fx2h-pf6j-xcff\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.7}}, {"id": "scanner-48f771d23c9cf567", "name": "Vulnerable dependency vite 5.4.10: GHSA-g4jq-h2w9-997c", "shortDescription": {"text": "Vulnerable dependency vite 5.4.10: GHSA-g4jq-h2w9-997c"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `5.4.10` (declared in `packages/chrome-plugin/package.json`) is affected by GHSA-g4jq-h2w9-997c (aka CVE-2025-58751).\nNote: `5.4.10` is the declared floor of a range \u2014 the installed version may be newer.\n\nVite middleware may serve files starting with the same name with the public directory\n\nAliases: CVE-2025-58751\nAdvisory: https://osv.dev/vulnerability/GHSA-g4jq-h2w9-997c\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.7}}, {"id": "scanner-1f541e479755832a", "name": "Vulnerable dependency vite 5.4.10: GHSA-jqfw-vq24-v9c3", "shortDescription": {"text": "Vulnerable dependency vite 5.4.10: GHSA-jqfw-vq24-v9c3"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `5.4.10` (declared in `packages/chrome-plugin/package.json`) is affected by GHSA-jqfw-vq24-v9c3 (aka CVE-2025-58752).\nNote: `5.4.10` is the declared floor of a range \u2014 the installed version may be newer.\n\nVite's `server.fs` settings were not applied to HTML files\n\nAliases: CVE-2025-58752\nAdvisory: https://osv.dev/vulnerability/GHSA-jqfw-vq24-v9c3\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.7}}, {"id": "scanner-ec9c1a95996cbbd4", "name": "Vulnerable dependency vite 5.4.10: GHSA-v6wh-96g9-6wx3", "shortDescription": {"text": "Vulnerable dependency vite 5.4.10: GHSA-v6wh-96g9-6wx3"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `5.4.10` (declared in `packages/chrome-plugin/package.json`) is affected by GHSA-v6wh-96g9-6wx3 (aka CVE-2026-53632).\nNote: `5.4.10` is the declared floor of a range \u2014 the installed version may be newer.\n\nlaunch-editor: NTLMv2 hash disclosure via UNC path handling on Windows\n\nAliases: CVE-2026-53632\nAdvisory: https://osv.dev/vulnerability/GHSA-v6wh-96g9-6wx3\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-f835997b262ae834", "name": "Vulnerable dependency vite 5.4.10: GHSA-vg6x-rcgg-rjx6", "shortDescription": {"text": "Vulnerable dependency vite 5.4.10: GHSA-vg6x-rcgg-rjx6"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `5.4.10` (declared in `packages/chrome-plugin/package.json`) is affected by GHSA-vg6x-rcgg-rjx6.\nNote: `5.4.10` is the declared floor of a range \u2014 the installed version may be newer.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-vg6x-rcgg-rjx6\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-361ba0b4c5347127", "name": "Vulnerable dependency vite 5.4.10: GHSA-x574-m823-4x7w", "shortDescription": {"text": "Vulnerable dependency vite 5.4.10: GHSA-x574-m823-4x7w"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `5.4.10` (declared in `packages/chrome-plugin/package.json`) is affected by GHSA-x574-m823-4x7w.\nNote: `5.4.10` is the declared floor of a range \u2014 the installed version may be newer.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-x574-m823-4x7w\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-e863ac2241a6d362", "name": "Vulnerable dependency vite 5.4.10: GHSA-xcj6-pq6g-qj4x", "shortDescription": {"text": "Vulnerable dependency vite 5.4.10: GHSA-xcj6-pq6g-qj4x"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `5.4.10` (declared in `packages/chrome-plugin/package.json`) is affected by GHSA-xcj6-pq6g-qj4x.\nNote: `5.4.10` is the declared floor of a range \u2014 the installed version may be newer.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-xcj6-pq6g-qj4x\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-5432f6b231c8a27c", "name": "Vulnerable dependency svelte 5.41.0: GHSA-crpf-4hrx-3jrp", "shortDescription": {"text": "Vulnerable dependency svelte 5.41.0: GHSA-crpf-4hrx-3jrp"}, "fullDescription": {"text": "OSV.dev reports `svelte` at version `5.41.0` (declared in `packages/components/package.json`) is affected by GHSA-crpf-4hrx-3jrp (aka CVE-2026-27125).\nNote: `5.41.0` is the declared floor of a range \u2014 the installed version may be newer.\n\nSvelte SSR attribute spreading includes inherited properties from prototype chain\n\nAliases: CVE-2026-27125\nAdvisory: https://osv.dev/vulnerability/GHSA-crpf-4hrx-3jrp\nFix: upgrade `svelte` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-28439efde3dc4246", "name": "Vulnerable dependency svelte 5.41.0: GHSA-f7gr-6p89-r883", "shortDescription": {"text": "Vulnerable dependency svelte 5.41.0: GHSA-f7gr-6p89-r883"}, "fullDescription": {"text": "OSV.dev reports `svelte` at version `5.41.0` (declared in `packages/components/package.json`) is affected by GHSA-f7gr-6p89-r883.\nNote: `5.41.0` is the declared floor of a range \u2014 the installed version may be newer.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-f7gr-6p89-r883\nFix: upgrade `svelte` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-06b36164f2c2be2d", "name": "Vulnerable dependency svelte 5.41.0: GHSA-h7h7-mm68-gmrc", "shortDescription": {"text": "Vulnerable dependency svelte 5.41.0: GHSA-h7h7-mm68-gmrc"}, "fullDescription": {"text": "OSV.dev reports `svelte` at version `5.41.0` (declared in `packages/components/package.json`) is affected by GHSA-h7h7-mm68-gmrc.\nNote: `5.41.0` is the declared floor of a range \u2014 the installed version may be newer.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-h7h7-mm68-gmrc\nFix: upgrade `svelte` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-00badf488cdafa5f", "name": "Vulnerable dependency svelte 5.41.0: GHSA-m56q-vw4c-c2cp", "shortDescription": {"text": "Vulnerable dependency svelte 5.41.0: GHSA-m56q-vw4c-c2cp"}, "fullDescription": {"text": "OSV.dev reports `svelte` at version `5.41.0` (declared in `packages/components/package.json`) is affected by GHSA-m56q-vw4c-c2cp.\nNote: `5.41.0` is the declared floor of a range \u2014 the installed version may be newer.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-m56q-vw4c-c2cp\nFix: upgrade `svelte` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-a7d7c6c73e6f262f", "name": "Vulnerable dependency svelte 5.41.0: GHSA-phwv-c562-gvmh", "shortDescription": {"text": "Vulnerable dependency svelte 5.41.0: GHSA-phwv-c562-gvmh"}, "fullDescription": {"text": "OSV.dev reports `svelte` at version `5.41.0` (declared in `packages/components/package.json`) is affected by GHSA-phwv-c562-gvmh.\nNote: `5.41.0` is the declared floor of a range \u2014 the installed version may be newer.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-phwv-c562-gvmh\nFix: upgrade `svelte` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-193d7d802956cf3a", "name": "Vulnerable dependency svelte 5.41.0: GHSA-pr6f-5x2q-rwfp", "shortDescription": {"text": "Vulnerable dependency svelte 5.41.0: GHSA-pr6f-5x2q-rwfp"}, "fullDescription": {"text": "OSV.dev reports `svelte` at version `5.41.0` (declared in `packages/components/package.json`) is affected by GHSA-pr6f-5x2q-rwfp.\nNote: `5.41.0` is the declared floor of a range \u2014 the installed version may be newer.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-pr6f-5x2q-rwfp\nFix: upgrade `svelte` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-e1eba50e01b9f478", "name": "Vulnerable dependency svelte 5.41.0: GHSA-rcqx-6q8c-2c42", "shortDescription": {"text": "Vulnerable dependency svelte 5.41.0: GHSA-rcqx-6q8c-2c42"}, "fullDescription": {"text": "OSV.dev reports `svelte` at version `5.41.0` (declared in `packages/components/package.json`) is affected by GHSA-rcqx-6q8c-2c42.\nNote: `5.41.0` is the declared floor of a range \u2014 the installed version may be newer.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-rcqx-6q8c-2c42\nFix: upgrade `svelte` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-c8ef85d46ab997d6", "name": "Vulnerable dependency vite 7.1.10: GHSA-4w7w-66w2-5vf9", "shortDescription": {"text": "Vulnerable dependency vite 7.1.10: GHSA-4w7w-66w2-5vf9"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `7.1.10` (declared in `packages/components/package.json`) is affected by GHSA-4w7w-66w2-5vf9 (aka CVE-2026-39365).\nNote: `7.1.10` is the declared floor of a range \u2014 the installed version may be newer.\n\nVite Vulnerable to Path Traversal in Optimized Deps `.map` Handling\n\nAliases: CVE-2026-39365\nAdvisory: https://osv.dev/vulnerability/GHSA-4w7w-66w2-5vf9\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-1fbbab4c903542fe", "name": "Vulnerable dependency vite 7.1.10: GHSA-93m4-6634-74q7", "shortDescription": {"text": "Vulnerable dependency vite 7.1.10: GHSA-93m4-6634-74q7"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `7.1.10` (declared in `packages/components/package.json`) is affected by GHSA-93m4-6634-74q7 (aka CVE-2025-62522).\nNote: `7.1.10` is the declared floor of a range \u2014 the installed version may be newer.\n\nvite allows server.fs.deny bypass via backslash on Windows\n\nAliases: CVE-2025-62522\nAdvisory: https://osv.dev/vulnerability/GHSA-93m4-6634-74q7\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-7cda7e3e9c9e4ef3", "name": "Vulnerable dependency vite 7.1.10: GHSA-fx2h-pf6j-xcff", "shortDescription": {"text": "Vulnerable dependency vite 7.1.10: GHSA-fx2h-pf6j-xcff"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `7.1.10` (declared in `packages/components/package.json`) is affected by GHSA-fx2h-pf6j-xcff (aka CVE-2026-53571).\nNote: `7.1.10` is the declared floor of a range \u2014 the installed version may be newer.\n\nvite: `server.fs.deny` bypass on Windows alternate paths\n\nAliases: CVE-2026-53571\nAdvisory: https://osv.dev/vulnerability/GHSA-fx2h-pf6j-xcff\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.7}}, {"id": "scanner-9a7b187706d83313", "name": "Vulnerable dependency vite 7.1.10: GHSA-p9ff-h696-f583", "shortDescription": {"text": "Vulnerable dependency vite 7.1.10: GHSA-p9ff-h696-f583"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `7.1.10` (declared in `packages/components/package.json`) is affected by GHSA-p9ff-h696-f583 (aka CVE-2026-39363).\nNote: `7.1.10` is the declared floor of a range \u2014 the installed version may be newer.\n\nVite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket\n\nAliases: CVE-2026-39363\nAdvisory: https://osv.dev/vulnerability/GHSA-p9ff-h696-f583\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.7}}, {"id": "scanner-71289d45d087f312", "name": "Vulnerable dependency vite 7.1.10: GHSA-v2wj-q39q-566r", "shortDescription": {"text": "Vulnerable dependency vite 7.1.10: GHSA-v2wj-q39q-566r"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `7.1.10` (declared in `packages/components/package.json`) is affected by GHSA-v2wj-q39q-566r.\nNote: `7.1.10` is the declared floor of a range \u2014 the installed version may be newer.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-v2wj-q39q-566r\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-a848c12e7509a721", "name": "Vulnerable dependency vite 7.1.10: GHSA-v6wh-96g9-6wx3", "shortDescription": {"text": "Vulnerable dependency vite 7.1.10: GHSA-v6wh-96g9-6wx3"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `7.1.10` (declared in `packages/components/package.json`) is affected by GHSA-v6wh-96g9-6wx3 (aka CVE-2026-53632).\nNote: `7.1.10` is the declared floor of a range \u2014 the installed version may be newer.\n\nlaunch-editor: NTLMv2 hash disclosure via UNC path handling on Windows\n\nAliases: CVE-2026-53632\nAdvisory: https://osv.dev/vulnerability/GHSA-v6wh-96g9-6wx3\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-f3d9a68decee1bee", "name": "Vulnerable dependency quill 2.0.3: GHSA-v3m3-f69x-jf25", "shortDescription": {"text": "Vulnerable dependency quill 2.0.3: GHSA-v3m3-f69x-jf25"}, "fullDescription": {"text": "OSV.dev reports `quill` at version `2.0.3` (declared in `packages/harper-editor/package.json`) is affected by GHSA-v3m3-f69x-jf25.\nNote: `2.0.3` is the declared floor of a range \u2014 the installed version may be newer.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-v3m3-f69x-jf25\nFix: upgrade `quill` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-2762c1fd931ec4b1", "name": "Vulnerable dependency vite 6.1.0: GHSA-356w-63v5-8wf4", "shortDescription": {"text": "Vulnerable dependency vite 6.1.0: GHSA-356w-63v5-8wf4"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `6.1.0` (declared in `packages/harper.js/package.json`) is affected by GHSA-356w-63v5-8wf4 (aka CVE-2025-32395).\nNote: `6.1.0` is the declared floor of a range \u2014 the installed version may be newer.\n\nVite has an `server.fs.deny` bypass with an invalid `request-target`\n\nAliases: CVE-2025-32395\nAdvisory: https://osv.dev/vulnerability/GHSA-356w-63v5-8wf4\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-64c6a3504a3931c9", "name": "Vulnerable dependency vite 6.1.0: GHSA-4r4m-qw57-chr8", "shortDescription": {"text": "Vulnerable dependency vite 6.1.0: GHSA-4r4m-qw57-chr8"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `6.1.0` (declared in `packages/harper.js/package.json`) is affected by GHSA-4r4m-qw57-chr8 (aka CVE-2025-31125).\nNote: `6.1.0` is the declared floor of a range \u2014 the installed version may be newer.\n\nVite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query\n\nAliases: CVE-2025-31125\nAdvisory: https://osv.dev/vulnerability/GHSA-4r4m-qw57-chr8\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-cfd9c4dda8da1737", "name": "Vulnerable dependency vite 6.1.0: GHSA-4w7w-66w2-5vf9", "shortDescription": {"text": "Vulnerable dependency vite 6.1.0: GHSA-4w7w-66w2-5vf9"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `6.1.0` (declared in `packages/harper.js/package.json`) is affected by GHSA-4w7w-66w2-5vf9 (aka CVE-2026-39365).\nNote: `6.1.0` is the declared floor of a range \u2014 the installed version may be newer.\n\nVite Vulnerable to Path Traversal in Optimized Deps `.map` Handling\n\nAliases: CVE-2026-39365\nAdvisory: https://osv.dev/vulnerability/GHSA-4w7w-66w2-5vf9\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-60ad12755bb52ef1", "name": "Vulnerable dependency vite 6.1.0: GHSA-859w-5945-r5v3", "shortDescription": {"text": "Vulnerable dependency vite 6.1.0: GHSA-859w-5945-r5v3"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `6.1.0` (declared in `packages/harper.js/package.json`) is affected by GHSA-859w-5945-r5v3 (aka CVE-2025-46565).\nNote: `6.1.0` is the declared floor of a range \u2014 the installed version may be newer.\n\nVite's server.fs.deny bypassed with /. for files under project root\n\nAliases: CVE-2025-46565\nAdvisory: https://osv.dev/vulnerability/GHSA-859w-5945-r5v3\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-d4affbb61f87d513", "name": "Vulnerable dependency vite 6.1.0: GHSA-93m4-6634-74q7", "shortDescription": {"text": "Vulnerable dependency vite 6.1.0: GHSA-93m4-6634-74q7"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `6.1.0` (declared in `packages/harper.js/package.json`) is affected by GHSA-93m4-6634-74q7 (aka CVE-2025-62522).\nNote: `6.1.0` is the declared floor of a range \u2014 the installed version may be newer.\n\nvite allows server.fs.deny bypass via backslash on Windows\n\nAliases: CVE-2025-62522\nAdvisory: https://osv.dev/vulnerability/GHSA-93m4-6634-74q7\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-0bae5b54119ae067", "name": "Vulnerable dependency vite 6.1.0: GHSA-fx2h-pf6j-xcff", "shortDescription": {"text": "Vulnerable dependency vite 6.1.0: GHSA-fx2h-pf6j-xcff"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `6.1.0` (declared in `packages/harper.js/package.json`) is affected by GHSA-fx2h-pf6j-xcff (aka CVE-2026-53571).\nNote: `6.1.0` is the declared floor of a range \u2014 the installed version may be newer.\n\nvite: `server.fs.deny` bypass on Windows alternate paths\n\nAliases: CVE-2026-53571\nAdvisory: https://osv.dev/vulnerability/GHSA-fx2h-pf6j-xcff\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.7}}, {"id": "scanner-b2e38b924f162007", "name": "Vulnerable dependency vite 6.1.0: GHSA-g4jq-h2w9-997c", "shortDescription": {"text": "Vulnerable dependency vite 6.1.0: GHSA-g4jq-h2w9-997c"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `6.1.0` (declared in `packages/harper.js/package.json`) is affected by GHSA-g4jq-h2w9-997c (aka CVE-2025-58751).\nNote: `6.1.0` is the declared floor of a range \u2014 the installed version may be newer.\n\nVite middleware may serve files starting with the same name with the public directory\n\nAliases: CVE-2025-58751\nAdvisory: https://osv.dev/vulnerability/GHSA-g4jq-h2w9-997c\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.7}}, {"id": "scanner-baf6beeda7cc25cb", "name": "Vulnerable dependency vite 6.1.0: GHSA-jqfw-vq24-v9c3", "shortDescription": {"text": "Vulnerable dependency vite 6.1.0: GHSA-jqfw-vq24-v9c3"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `6.1.0` (declared in `packages/harper.js/package.json`) is affected by GHSA-jqfw-vq24-v9c3 (aka CVE-2025-58752).\nNote: `6.1.0` is the declared floor of a range \u2014 the installed version may be newer.\n\nVite's `server.fs` settings were not applied to HTML files\n\nAliases: CVE-2025-58752\nAdvisory: https://osv.dev/vulnerability/GHSA-jqfw-vq24-v9c3\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.7}}, {"id": "scanner-e26da22a7fc8777e", "name": "Vulnerable dependency vite 6.1.0: GHSA-p9ff-h696-f583", "shortDescription": {"text": "Vulnerable dependency vite 6.1.0: GHSA-p9ff-h696-f583"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `6.1.0` (declared in `packages/harper.js/package.json`) is affected by GHSA-p9ff-h696-f583 (aka CVE-2026-39363).\nNote: `6.1.0` is the declared floor of a range \u2014 the installed version may be newer.\n\nVite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket\n\nAliases: CVE-2026-39363\nAdvisory: https://osv.dev/vulnerability/GHSA-p9ff-h696-f583\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.7}}, {"id": "scanner-4dddc5f9b08c5483", "name": "Vulnerable dependency vite 6.1.0: GHSA-v6wh-96g9-6wx3", "shortDescription": {"text": "Vulnerable dependency vite 6.1.0: GHSA-v6wh-96g9-6wx3"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `6.1.0` (declared in `packages/harper.js/package.json`) is affected by GHSA-v6wh-96g9-6wx3 (aka CVE-2026-53632).\nNote: `6.1.0` is the declared floor of a range \u2014 the installed version may be newer.\n\nlaunch-editor: NTLMv2 hash disclosure via UNC path handling on Windows\n\nAliases: CVE-2026-53632\nAdvisory: https://osv.dev/vulnerability/GHSA-v6wh-96g9-6wx3\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-74bda95750eca852", "name": "Vulnerable dependency vite 6.1.0: GHSA-x574-m823-4x7w", "shortDescription": {"text": "Vulnerable dependency vite 6.1.0: GHSA-x574-m823-4x7w"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `6.1.0` (declared in `packages/harper.js/package.json`) is affected by GHSA-x574-m823-4x7w.\nNote: `6.1.0` is the declared floor of a range \u2014 the installed version may be newer.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-x574-m823-4x7w\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-1a6b0cbffa80753b", "name": "Vulnerable dependency vite 6.1.0: GHSA-xcj6-pq6g-qj4x", "shortDescription": {"text": "Vulnerable dependency vite 6.1.0: GHSA-xcj6-pq6g-qj4x"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `6.1.0` (declared in `packages/harper.js/package.json`) is affected by GHSA-xcj6-pq6g-qj4x.\nNote: `6.1.0` is the declared floor of a range \u2014 the installed version may be newer.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-xcj6-pq6g-qj4x\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-574f2c00956186c7", "name": "Vulnerable dependency vitest 4.0.16: GHSA-5xrq-8626-4rwp", "shortDescription": {"text": "Vulnerable dependency vitest 4.0.16: GHSA-5xrq-8626-4rwp"}, "fullDescription": {"text": "OSV.dev reports `vitest` at version `4.0.16` (declared in `packages/harper.js/package.json`) is affected by GHSA-5xrq-8626-4rwp.\nNote: `4.0.16` is the declared floor of a range \u2014 the installed version may be newer.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-5xrq-8626-4rwp\nFix: upgrade `vitest` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-f65438052df9f8cc", "name": "Vulnerable dependency vite 6.3.5: GHSA-4w7w-66w2-5vf9", "shortDescription": {"text": "Vulnerable dependency vite 6.3.5: GHSA-4w7w-66w2-5vf9"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `6.3.5` (declared in `packages/obsidian-plugin/package.json`) is affected by GHSA-4w7w-66w2-5vf9 (aka CVE-2026-39365).\nNote: `6.3.5` is the declared floor of a range \u2014 the installed version may be newer.\n\nVite Vulnerable to Path Traversal in Optimized Deps `.map` Handling\n\nAliases: CVE-2026-39365\nAdvisory: https://osv.dev/vulnerability/GHSA-4w7w-66w2-5vf9\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-2b038b949935fdf1", "name": "Vulnerable dependency vite 6.3.5: GHSA-93m4-6634-74q7", "shortDescription": {"text": "Vulnerable dependency vite 6.3.5: GHSA-93m4-6634-74q7"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `6.3.5` (declared in `packages/obsidian-plugin/package.json`) is affected by GHSA-93m4-6634-74q7 (aka CVE-2025-62522).\nNote: `6.3.5` is the declared floor of a range \u2014 the installed version may be newer.\n\nvite allows server.fs.deny bypass via backslash on Windows\n\nAliases: CVE-2025-62522\nAdvisory: https://osv.dev/vulnerability/GHSA-93m4-6634-74q7\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-79ea9b26af7aef66", "name": "Vulnerable dependency vite 6.3.5: GHSA-fx2h-pf6j-xcff", "shortDescription": {"text": "Vulnerable dependency vite 6.3.5: GHSA-fx2h-pf6j-xcff"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `6.3.5` (declared in `packages/obsidian-plugin/package.json`) is affected by GHSA-fx2h-pf6j-xcff (aka CVE-2026-53571).\nNote: `6.3.5` is the declared floor of a range \u2014 the installed version may be newer.\n\nvite: `server.fs.deny` bypass on Windows alternate paths\n\nAliases: CVE-2026-53571\nAdvisory: https://osv.dev/vulnerability/GHSA-fx2h-pf6j-xcff\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.7}}, {"id": "scanner-4765a0b06a075196", "name": "Vulnerable dependency vite 6.3.5: GHSA-g4jq-h2w9-997c", "shortDescription": {"text": "Vulnerable dependency vite 6.3.5: GHSA-g4jq-h2w9-997c"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `6.3.5` (declared in `packages/obsidian-plugin/package.json`) is affected by GHSA-g4jq-h2w9-997c (aka CVE-2025-58751).\nNote: `6.3.5` is the declared floor of a range \u2014 the installed version may be newer.\n\nVite middleware may serve files starting with the same name with the public directory\n\nAliases: CVE-2025-58751\nAdvisory: https://osv.dev/vulnerability/GHSA-g4jq-h2w9-997c\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.7}}, {"id": "scanner-c6b9131697ba07ad", "name": "Vulnerable dependency vite 6.3.5: GHSA-jqfw-vq24-v9c3", "shortDescription": {"text": "Vulnerable dependency vite 6.3.5: GHSA-jqfw-vq24-v9c3"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `6.3.5` (declared in `packages/obsidian-plugin/package.json`) is affected by GHSA-jqfw-vq24-v9c3 (aka CVE-2025-58752).\nNote: `6.3.5` is the declared floor of a range \u2014 the installed version may be newer.\n\nVite's `server.fs` settings were not applied to HTML files\n\nAliases: CVE-2025-58752\nAdvisory: https://osv.dev/vulnerability/GHSA-jqfw-vq24-v9c3\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.7}}, {"id": "scanner-62c30f39347c03cf", "name": "Vulnerable dependency vite 6.3.5: GHSA-p9ff-h696-f583", "shortDescription": {"text": "Vulnerable dependency vite 6.3.5: GHSA-p9ff-h696-f583"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `6.3.5` (declared in `packages/obsidian-plugin/package.json`) is affected by GHSA-p9ff-h696-f583 (aka CVE-2026-39363).\nNote: `6.3.5` is the declared floor of a range \u2014 the installed version may be newer.\n\nVite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket\n\nAliases: CVE-2026-39363\nAdvisory: https://osv.dev/vulnerability/GHSA-p9ff-h696-f583\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.7}}, {"id": "scanner-72a254e8116d7ff9", "name": "Vulnerable dependency vite 6.3.5: GHSA-v6wh-96g9-6wx3", "shortDescription": {"text": "Vulnerable dependency vite 6.3.5: GHSA-v6wh-96g9-6wx3"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `6.3.5` (declared in `packages/obsidian-plugin/package.json`) is affected by GHSA-v6wh-96g9-6wx3 (aka CVE-2026-53632).\nNote: `6.3.5` is the declared floor of a range \u2014 the installed version may be newer.\n\nlaunch-editor: NTLMv2 hash disclosure via UNC path handling on Windows\n\nAliases: CVE-2026-53632\nAdvisory: https://osv.dev/vulnerability/GHSA-v6wh-96g9-6wx3\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-6a303133e5be96df", "name": "Vulnerable dependency svelte 5.15.0: GHSA-crpf-4hrx-3jrp", "shortDescription": {"text": "Vulnerable dependency svelte 5.15.0: GHSA-crpf-4hrx-3jrp"}, "fullDescription": {"text": "OSV.dev reports `svelte` at version `5.15.0` (declared in `packages/web/package.json`) is affected by GHSA-crpf-4hrx-3jrp (aka CVE-2026-27125).\nNote: `5.15.0` is the declared floor of a range \u2014 the installed version may be newer.\n\nSvelte SSR attribute spreading includes inherited properties from prototype chain\n\nAliases: CVE-2026-27125\nAdvisory: https://osv.dev/vulnerability/GHSA-crpf-4hrx-3jrp\nFix: upgrade `svelte` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-7538f13c49e6c87f", "name": "Vulnerable dependency svelte 5.15.0: GHSA-f7gr-6p89-r883", "shortDescription": {"text": "Vulnerable dependency svelte 5.15.0: GHSA-f7gr-6p89-r883"}, "fullDescription": {"text": "OSV.dev reports `svelte` at version `5.15.0` (declared in `packages/web/package.json`) is affected by GHSA-f7gr-6p89-r883.\nNote: `5.15.0` is the declared floor of a range \u2014 the installed version may be newer.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-f7gr-6p89-r883\nFix: upgrade `svelte` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-468499255da0441b", "name": "Vulnerable dependency svelte 5.15.0: GHSA-m56q-vw4c-c2cp", "shortDescription": {"text": "Vulnerable dependency svelte 5.15.0: GHSA-m56q-vw4c-c2cp"}, "fullDescription": {"text": "OSV.dev reports `svelte` at version `5.15.0` (declared in `packages/web/package.json`) is affected by GHSA-m56q-vw4c-c2cp.\nNote: `5.15.0` is the declared floor of a range \u2014 the installed version may be newer.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-m56q-vw4c-c2cp\nFix: upgrade `svelte` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-94c1a5f585bdc10b", "name": "Vulnerable dependency svelte 5.15.0: GHSA-phwv-c562-gvmh", "shortDescription": {"text": "Vulnerable dependency svelte 5.15.0: GHSA-phwv-c562-gvmh"}, "fullDescription": {"text": "OSV.dev reports `svelte` at version `5.15.0` (declared in `packages/web/package.json`) is affected by GHSA-phwv-c562-gvmh.\nNote: `5.15.0` is the declared floor of a range \u2014 the installed version may be newer.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-phwv-c562-gvmh\nFix: upgrade `svelte` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-bd5c7614f11ac5d7", "name": "Vulnerable dependency svelte 5.15.0: GHSA-pr6f-5x2q-rwfp", "shortDescription": {"text": "Vulnerable dependency svelte 5.15.0: GHSA-pr6f-5x2q-rwfp"}, "fullDescription": {"text": "OSV.dev reports `svelte` at version `5.15.0` (declared in `packages/web/package.json`) is affected by GHSA-pr6f-5x2q-rwfp.\nNote: `5.15.0` is the declared floor of a range \u2014 the installed version may be newer.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-pr6f-5x2q-rwfp\nFix: upgrade `svelte` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-816ed9beec52f4d8", "name": "Vulnerable dependency svelte 5.15.0: GHSA-rcqx-6q8c-2c42", "shortDescription": {"text": "Vulnerable dependency svelte 5.15.0: GHSA-rcqx-6q8c-2c42"}, "fullDescription": {"text": "OSV.dev reports `svelte` at version `5.15.0` (declared in `packages/web/package.json`) is affected by GHSA-rcqx-6q8c-2c42.\nNote: `5.15.0` is the declared floor of a range \u2014 the installed version may be newer.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-rcqx-6q8c-2c42\nFix: upgrade `svelte` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-c4ac8e6d271c9885", "name": "Vulnerable dependency atk 0.18.2: RUSTSEC-2024-0413", "shortDescription": {"text": "Vulnerable dependency atk 0.18.2: RUSTSEC-2024-0413"}, "fullDescription": {"text": "OSV.dev reports `atk` at version `0.18.2` (resolved in `Cargo.lock`) is affected by RUSTSEC-2024-0413.\nNote: `atk` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/RUSTSEC-2024-0413\nFix: upgrade `atk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-842c917ae827e02e", "name": "Vulnerable dependency atk-sys 0.18.2: RUSTSEC-2024-0416", "shortDescription": {"text": "Vulnerable dependency atk-sys 0.18.2: RUSTSEC-2024-0416"}, "fullDescription": {"text": "OSV.dev reports `atk-sys` at version `0.18.2` (resolved in `Cargo.lock`) is affected by RUSTSEC-2024-0416.\nNote: `atk-sys` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/RUSTSEC-2024-0416\nFix: upgrade `atk-sys` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-1134105a662ae9d6", "name": "Vulnerable dependency bincode 2.0.1: RUSTSEC-2025-0141", "shortDescription": {"text": "Vulnerable dependency bincode 2.0.1: RUSTSEC-2025-0141"}, "fullDescription": {"text": "OSV.dev reports `bincode` at version `2.0.1` (resolved in `Cargo.lock`) is affected by RUSTSEC-2025-0141.\nNote: `bincode` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/RUSTSEC-2025-0141\nFix: upgrade `bincode` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-1395070335461b7b", "name": "Vulnerable dependency crossbeam-epoch 0.9.18: RUSTSEC-2026-0204", "shortDescription": {"text": "Vulnerable dependency crossbeam-epoch 0.9.18: RUSTSEC-2026-0204"}, "fullDescription": {"text": "OSV.dev reports `crossbeam-epoch` at version `0.9.18` (resolved in `Cargo.lock`) is affected by RUSTSEC-2026-0204.\nNote: `crossbeam-epoch` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/RUSTSEC-2026-0204\nFix: upgrade `crossbeam-epoch` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-b9694ff8993cfc5f", "name": "Dependency cached is two or more major versions behind", "shortDescription": {"text": "Dependency cached is two or more major versions behind"}, "fullDescription": {"text": "`cached` is pinned at `0.59.0` in `harper-core/Cargo.toml` while the latest release on the cargo registry is `2.0.2` \u2014 2 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `cached` to `2.0.2`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}]}}, "automationDetails": {"id": "repobility/30789"}, "properties": {"repository": "Automattic/harper", "repoUrl": "https://github.com/Automattic/harper", "branch": "main"}, "results": [{"ruleId": "scanner-a17ec23161c6c706", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 packages/chrome-plugin/src/popup/Main.svelte:59"}, "properties": {"repobilityId": "e4c275faa7325586", "scanner": "scanner-primary", "fingerprint": "a17ec23161c6c706", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/chrome-plugin/src/popup/Main.svelte"}, "region": {"startLine": 59}}}]}, {"ruleId": "scanner-d2f5b4c44817f80d", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 packages/harper-editor/src/lib/Editor.svelte:82"}, "properties": {"repobilityId": "af335b36b7f94824", "scanner": "scanner-primary", "fingerprint": "d2f5b4c44817f80d", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/harper-editor/src/lib/Editor.svelte"}, "region": {"startLine": 82}}}]}, {"ruleId": "scanner-b212826f21f902f2", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 packages/vscode-plugin/src/extension.ts:206"}, "properties": {"repobilityId": "b12de8d417a596f6", "scanner": "scanner-primary", "fingerprint": "b212826f21f902f2", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/vscode-plugin/src/extension.ts"}, "region": {"startLine": 206}}}]}, {"ruleId": "scanner-d45c9d191e779e7e", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 packages/web/src/hooks.server.ts:8"}, "properties": {"repobilityId": "0c3a90e89062afab", "scanner": "scanner-primary", "fingerprint": "d45c9d191e779e7e", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/web/src/hooks.server.ts"}, "region": {"startLine": 8}}}]}, {"ruleId": "scanner-13739ae516bf57a0", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 packages/web/src/routes/download-harper-desktop/[target]/[arch]/[current_version]/+server.ts:118"}, "properties": {"repobilityId": "e8c7247e98cbaa3a", "scanner": "scanner-primary", "fingerprint": "13739ae516bf57a0", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/web/src/routes/download-harper-desktop/[target]/[arch]/[current_version]/+server.ts"}, "region": {"startLine": 118}}}]}, {"ruleId": "scanner-b4e52921ac8cb88a", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 packages/web/src/routes/latestversion/+server.ts:10"}, "properties": {"repobilityId": "9d837e6567117dec", "scanner": "scanner-primary", "fingerprint": "b4e52921ac8cb88a", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/web/src/routes/latestversion/+server.ts"}, "region": {"startLine": 10}}}]}, {"ruleId": "scanner-6f9ea96f45561be9", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 packages/wordpress-plugin/src/harper/useLintBoxes.ts:85"}, "properties": {"repobilityId": "a0efd39062895cc1", "scanner": "scanner-primary", "fingerprint": "6f9ea96f45561be9", "layer": "frontend", "severity": "info", "confidence": 0.7, "tags": ["frontend-quality", "fq.todo-marker"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/wordpress-plugin/src/harper/useLintBoxes.ts"}, "region": {"startLine": 85}}}]}, {"ruleId": "scanner-432a5c60aa316ff8", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 packages/obsidian-plugin/src/State.ts:364"}, "properties": {"repobilityId": "7e76d910d44da269", "scanner": "scanner-primary", "fingerprint": "432a5c60aa316ff8", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/obsidian-plugin/src/State.ts"}, "region": {"startLine": 364}}}]}, {"ruleId": "scanner-f68a21e11f6fdc1c", "level": "warning", "message": {"text": "detect child process \u2014 packages/chrome-plugin/vglrunWrapper.js:10"}, "properties": {"repobilityId": "a8fdb0dee911c383", "scanner": "scanner-primary", "fingerprint": "f68a21e11f6fdc1c", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "javascript"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/chrome-plugin/vglrunWrapper.js"}, "region": {"startLine": 10}}}]}, {"ruleId": "scanner-7d85a0952942c106", "level": "warning", "message": {"text": "GHSA-wrw7-89jp-8q8g: glib 0.18.5 \u2014 Cargo.lock"}, "properties": {"repobilityId": "ea7fb90c0d6c704b", "scanner": "scanner-primary", "fingerprint": "7d85a0952942c106", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-wrw7-89jp-8q8g"]}}, {"ruleId": "scanner-4afd10043e1b4dc6", "level": "error", "message": {"text": "CVE-2026-31812: quinn-proto 0.11.13 \u2014 Cargo.lock"}, "properties": {"repobilityId": "e0c028de9e19afa6", "scanner": "scanner-primary", "fingerprint": "4afd10043e1b4dc6", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-31812"]}}, {"ruleId": "scanner-84b7b224a9f6ecf6", "level": "note", "message": {"text": "GHSA-cq8v-f236-94qc: rand 0.8.5 \u2014 Cargo.lock"}, "properties": {"repobilityId": "327289a7bfee0a2a", "scanner": "scanner-primary", "fingerprint": "84b7b224a9f6ecf6", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-cq8v-f236-94qc"]}}, {"ruleId": "scanner-18c6948c17abd567", "level": "note", "message": {"text": "GHSA-cq8v-f236-94qc: rand 0.9.2 \u2014 Cargo.lock"}, "properties": {"repobilityId": "327289a7bfee0a2a", "scanner": "scanner-primary", "fingerprint": "18c6948c17abd567", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-cq8v-f236-94qc"]}}, {"ruleId": "scanner-9ae74d16e1fc389a", "level": "error", "message": {"text": "GHSA-82j2-j2ch-gfr8: rustls-webpki 0.103.10 \u2014 Cargo.lock"}, "properties": {"repobilityId": "691e87dd066207fd", "scanner": "scanner-primary", "fingerprint": "9ae74d16e1fc389a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-82j2-j2ch-gfr8"]}}, {"ruleId": "scanner-09a8b2efa9b45563", "level": "note", "message": {"text": "GHSA-965h-392x-2mh5: rustls-webpki 0.103.10 \u2014 Cargo.lock"}, "properties": {"repobilityId": "62703cd2499f7de4", "scanner": "scanner-primary", "fingerprint": "09a8b2efa9b45563", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-965h-392x-2mh5"]}}, {"ruleId": "scanner-3ef267016de1492d", "level": "note", "message": {"text": "GHSA-xgp8-3hg3-c2mh: rustls-webpki 0.103.10 \u2014 Cargo.lock"}, "properties": {"repobilityId": "6a8c11d4b68e8af3", "scanner": "scanner-primary", "fingerprint": "3ef267016de1492d", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-xgp8-3hg3-c2mh"]}}, {"ruleId": "scanner-322b7699f11a74fc", "level": "warning", "message": {"text": "GHSA-7gcf-g7xr-8hxj: serde_with 3.20.0 \u2014 Cargo.lock"}, "properties": {"repobilityId": "47a6724ca8234261", "scanner": "scanner-primary", "fingerprint": "322b7699f11a74fc", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-7gcf-g7xr-8hxj"]}}, {"ruleId": "scanner-a9d71a1d95aea3b7", "level": "warning", "message": {"text": "CVE-2026-54171: excon 0.112.0 \u2014 Gemfile.lock"}, "properties": {"repobilityId": "7ec3e8abba9036f4", "scanner": "scanner-primary", "fingerprint": "a9d71a1d95aea3b7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54171"]}}, {"ruleId": "scanner-75426b7fc6d1b2b1", "level": "note", "message": {"text": "CVE-2026-54696: json 2.19.5 \u2014 Gemfile.lock"}, "properties": {"repobilityId": "5b290210c5fa6196", "scanner": "scanner-primary", "fingerprint": "75426b7fc6d1b2b1", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54696"]}}, {"ruleId": "scanner-2e2dd25b7c6e28b5", "level": "note", "message": {"text": "CVE-2026-49356: @babel/core 7.25.7 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "5ed9b7327a0bdc8f", "scanner": "scanner-primary", "fingerprint": "2e2dd25b7c6e28b5", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-49356"]}}, {"ruleId": "scanner-93eac9e80f51138b", "level": "note", "message": {"text": "CVE-2026-49356: @babel/core 7.26.10 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "5ed9b7327a0bdc8f", "scanner": "scanner-primary", "fingerprint": "93eac9e80f51138b", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-49356"]}}, {"ruleId": "scanner-5540740a142503fa", "level": "error", "message": {"text": "CVE-2026-44728: @babel/plugin-transform-modules-systemjs 7.25.9 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "4328a4f69236abbc", "scanner": "scanner-primary", "fingerprint": "5540740a142503fa", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44728"]}}, {"ruleId": "scanner-91a82da543470e59", "level": "warning", "message": {"text": "CVE-2025-27789: @babel/runtime 7.25.7 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "c304280d9bd5cfb7", "scanner": "scanner-primary", "fingerprint": "91a82da543470e59", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-27789"]}}, {"ruleId": "scanner-8d3a2708a74b447e", "level": "error", "message": {"text": "CVE-2026-25547: @isaacs/brace-expansion 5.0.0 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "cd42053b6a0dd92c", "scanner": "scanner-primary", "fingerprint": "8d3a2708a74b447e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-25547"]}}, {"ruleId": "scanner-4c53c1d2e619c664", "level": "error", "message": {"text": "CVE-2025-67647: @sveltejs/kit 2.48.5 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "4df3fba731936a21", "scanner": "scanner-primary", "fingerprint": "4c53c1d2e619c664", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-67647"]}}, {"ruleId": "scanner-e559adb0e3bc313c", "level": "error", "message": {"text": "CVE-2026-40073: @sveltejs/kit 2.48.5 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "1ec938d2d0943425", "scanner": "scanner-primary", "fingerprint": "e559adb0e3bc313c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-40073"]}}, {"ruleId": "scanner-5d794d79879459b2", "level": "warning", "message": {"text": "CVE-2026-40074: @sveltejs/kit 2.48.5 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "54dbe5d9a8ddb58f", "scanner": "scanner-primary", "fingerprint": "5d794d79879459b2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-40074"]}}, {"ruleId": "scanner-13574e613dfc6d98", "level": "warning", "message": {"text": "GHSA-hgv7-v322-mmgr: @sveltejs/kit 2.48.5 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "eb65535099e25ac4", "scanner": "scanner-primary", "fingerprint": "13574e613dfc6d98", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-hgv7-v322-mmgr"]}}, {"ruleId": "scanner-7742df00435b0e26", "level": "warning", "message": {"text": "CVE-2025-69873: ajv 8.17.1 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "cc82c757e3c8e035", "scanner": "scanner-primary", "fingerprint": "7742df00435b0e26", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-69873"]}}, {"ruleId": "scanner-b74256f301137a0b", "level": "note", "message": {"text": "CVE-2026-12590: body-parser 1.20.3 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "c52a5d8da171f050", "scanner": "scanner-primary", "fingerprint": "b74256f301137a0b", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-12590"]}}, {"ruleId": "scanner-7cd31f07cc1c38c3", "level": "error", "message": {"text": "CVE-2026-13149: brace-expansion 1.1.11 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "eedf4eae95361bb4", "scanner": "scanner-primary", "fingerprint": "7cd31f07cc1c38c3", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-13149"]}}, {"ruleId": "scanner-42aa28ec4ba4cd51", "level": "warning", "message": {"text": "CVE-2026-33750: brace-expansion 1.1.11 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "0e051d7cc2692dd1", "scanner": "scanner-primary", "fingerprint": "42aa28ec4ba4cd51", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33750"]}}, {"ruleId": "scanner-086fc54252425b42", "level": "note", "message": {"text": "CVE-2025-5889: brace-expansion 1.1.11 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "c1b0c76a19bb4d70", "scanner": "scanner-primary", "fingerprint": "086fc54252425b42", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-5889"]}}, {"ruleId": "scanner-7930d6b98cdba8ed", "level": "error", "message": {"text": "CVE-2026-13149: brace-expansion 2.0.1 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "eedf4eae95361bb4", "scanner": "scanner-primary", "fingerprint": "7930d6b98cdba8ed", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-13149"]}}, {"ruleId": "scanner-7acd1e5367e77501", "level": "warning", "message": {"text": "CVE-2026-33750: brace-expansion 2.0.1 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "0e051d7cc2692dd1", "scanner": "scanner-primary", "fingerprint": "7acd1e5367e77501", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33750"]}}, {"ruleId": "scanner-9839f4db3598fc41", "level": "note", "message": {"text": "CVE-2025-5889: brace-expansion 2.0.1 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "c1b0c76a19bb4d70", "scanner": "scanner-primary", "fingerprint": "9839f4db3598fc41", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-5889"]}}, {"ruleId": "scanner-46ea18c6fa9905b8", "level": "note", "message": {"text": "CVE-2024-47764: cookie 0.6.0 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "c3bc5d6f270bf983", "scanner": "scanner-primary", "fingerprint": "46ea18c6fa9905b8", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2024-47764"]}}, {"ruleId": "scanner-6c56593dc59d308a", "level": "error", "message": {"text": "CVE-2026-35209: defu 6.1.4 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "18b13b2b1c1ecdba", "scanner": "scanner-primary", "fingerprint": "6c56593dc59d308a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-35209"]}}, {"ruleId": "scanner-102a7f3c47f40336", "level": "error", "message": {"text": "CVE-2026-22774: devalue 5.4.1 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "878303b7e5f04eea", "scanner": "scanner-primary", "fingerprint": "102a7f3c47f40336", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-22774"]}}, {"ruleId": "scanner-d4880459eff712a8", "level": "error", "message": {"text": "CVE-2026-22775: devalue 5.4.1 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "590915d1fd971a60", "scanner": "scanner-primary", "fingerprint": "d4880459eff712a8", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-22775"]}}, {"ruleId": "scanner-5c12edc025024ada", "level": "warning", "message": {"text": "CVE-2026-30226: devalue 5.4.1 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "54f1ef7094ddf854", "scanner": "scanner-primary", "fingerprint": "5c12edc025024ada", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-30226"]}}, {"ruleId": "scanner-7d55ea55b4dae5ae", "level": "note", "message": {"text": "GHSA-33hq-fvwr-56pm: devalue 5.4.1 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "11880025b25b934b", "scanner": "scanner-primary", "fingerprint": "7d55ea55b4dae5ae", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-33hq-fvwr-56pm"]}}, {"ruleId": "scanner-d06ba26402c45a36", "level": "note", "message": {"text": "GHSA-8qm3-746x-r74r: devalue 5.4.1 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "474c19b68a67b1dd", "scanner": "scanner-primary", "fingerprint": "d06ba26402c45a36", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-8qm3-746x-r74r"]}}, {"ruleId": "scanner-249f2af646723b02", "level": "note", "message": {"text": "GHSA-mwv9-gp5h-frr4: devalue 5.4.1 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "0ca1ac30b4e4788e", "scanner": "scanner-primary", "fingerprint": "249f2af646723b02", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-mwv9-gp5h-frr4"]}}, {"ruleId": "scanner-3e0995344d2a3910", "level": "note", "message": {"text": "CVE-2026-24001: diff 4.0.2 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "9b00d51cd6038a1d", "scanner": "scanner-primary", "fingerprint": "3e0995344d2a3910", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-24001"]}}, {"ruleId": "scanner-7bb5fe23695d5639", "level": "error", "message": {"text": "CVE-2026-39356: drizzle-orm 0.44.6 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "07b7f1b142714c8a", "scanner": "scanner-primary", "fingerprint": "7bb5fe23695d5639", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-39356"]}}, {"ruleId": "scanner-32e13204b6c09413", "level": "warning", "message": {"text": "GHSA-67mh-4wv8-2f99: esbuild 0.23.1 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "13032fffba065b44", "scanner": "scanner-primary", "fingerprint": "32e13204b6c09413", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-67mh-4wv8-2f99"]}}, {"ruleId": "scanner-defc0cd8e4807f3c", "level": "error", "message": {"text": "CVE-2026-13676: fast-uri 3.0.6 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "22f3458cd6c077d8", "scanner": "scanner-primary", "fingerprint": "defc0cd8e4807f3c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-13676"]}}, {"ruleId": "scanner-4b9a1c941059f97c", "level": "error", "message": {"text": "CVE-2026-16221: fast-uri 3.0.6 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "d0a482fb1283ccc4", "scanner": "scanner-primary", "fingerprint": "4b9a1c941059f97c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-16221"]}}, {"ruleId": "scanner-9cd28a13feb01197", "level": "error", "message": {"text": "CVE-2026-6321: fast-uri 3.0.6 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "235bcfe30a3ee7f4", "scanner": "scanner-primary", "fingerprint": "9cd28a13feb01197", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-6321"]}}, {"ruleId": "scanner-58de08735a181768", "level": "error", "message": {"text": "CVE-2026-6322: fast-uri 3.0.6 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "45d19c683e75019e", "scanner": "scanner-primary", "fingerprint": "58de08735a181768", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-6322"]}}, {"ruleId": "scanner-93b9173ab51f5316", "level": "warning", "message": {"text": "GHSA-r4q5-vmmm-2653: follow-redirects 1.15.9 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "0e739f4a9d3280e1", "scanner": "scanner-primary", "fingerprint": "93b9173ab51f5316", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-r4q5-vmmm-2653"]}}, {"ruleId": "scanner-44abeabbc3f294f9", "level": "warning", "message": {"text": "CVE-2025-32996: http-proxy-middleware 2.0.7 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "9b5183ba432e1163", "scanner": "scanner-primary", "fingerprint": "44abeabbc3f294f9", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-32996"]}}, {"ruleId": "scanner-475e4baba849f2f3", "level": "warning", "message": {"text": "CVE-2025-32997: http-proxy-middleware 2.0.7 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "0800fafa7a2e1be8", "scanner": "scanner-primary", "fingerprint": "475e4baba849f2f3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-32997"]}}, {"ruleId": "scanner-ac4ce35af55c8234", "level": "warning", "message": {"text": "CVE-2026-55602: http-proxy-middleware 2.0.7 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "f88dbda180c549a2", "scanner": "scanner-primary", "fingerprint": "ac4ce35af55c8234", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-55602"]}}, {"ruleId": "scanner-b28d830d60a0ed77", "level": "error", "message": {"text": "CVE-2026-29063: immutable 5.0.3 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "ef5e0ed935f6585f", "scanner": "scanner-primary", "fingerprint": "b28d830d60a0ed77", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-29063"]}}, {"ruleId": "scanner-7fb2cf840e24b8c2", "level": "error", "message": {"text": "CVE-2026-59879: immutable 5.0.3 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "552b36a4d281cd20", "scanner": "scanner-primary", "fingerprint": "7fb2cf840e24b8c2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59879"]}}, {"ruleId": "scanner-bffef8b1d531bfcc", "level": "error", "message": {"text": "CVE-2026-59880: immutable 5.0.3 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "78445119c837fde2", "scanner": "scanner-primary", "fingerprint": "bffef8b1d531bfcc", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59880"]}}, {"ruleId": "scanner-243e66c0f9bba4c2", "level": "warning", "message": {"text": "CVE-2026-53632: launch-editor 2.10.0 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "67bf37587cce8ba0", "scanner": "scanner-primary", "fingerprint": "243e66c0f9bba4c2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-53632"]}}, {"ruleId": "scanner-9ffec2536f1b91cb", "level": "error", "message": {"text": "CVE-2026-4800: lodash 4.17.21 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "37f324e8a4e67afb", "scanner": "scanner-primary", "fingerprint": "9ffec2536f1b91cb", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-4800"]}}, {"ruleId": "scanner-ecead3cea58aa459", "level": "warning", "message": {"text": "CVE-2025-13465: lodash 4.17.21 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "141eea096734c902", "scanner": "scanner-primary", "fingerprint": "ecead3cea58aa459", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-13465"]}}, {"ruleId": "scanner-c380dbc7e8ad1284", "level": "warning", "message": {"text": "CVE-2026-2950: lodash 4.17.21 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "3accb0e7cad0f953", "scanner": "scanner-primary", "fingerprint": "c380dbc7e8ad1284", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-2950"]}}, {"ruleId": "scanner-693d36861b537d20", "level": "error", "message": {"text": "CVE-2026-4800: lodash-es 4.17.21 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "9d209189a798223a", "scanner": "scanner-primary", "fingerprint": "693d36861b537d20", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-4800"]}}, {"ruleId": "scanner-54d8efaee3f14b51", "level": "warning", "message": {"text": "CVE-2025-13465: lodash-es 4.17.21 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "9081d1a405a97937", "scanner": "scanner-primary", "fingerprint": "54d8efaee3f14b51", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-13465"]}}, {"ruleId": "scanner-58afeacd92324a10", "level": "warning", "message": {"text": "CVE-2026-2950: lodash-es 4.17.21 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "88659273123e03cd", "scanner": "scanner-primary", "fingerprint": "58afeacd92324a10", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-2950"]}}, {"ruleId": "scanner-06ec3d5f63aa1e6d", "level": "warning", "message": {"text": "CVE-2025-66400: mdast-util-to-hast 13.2.0 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "d7374cfb09824d70", "scanner": "scanner-primary", "fingerprint": "06ec3d5f63aa1e6d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-66400"]}}, {"ruleId": "scanner-f4ec1ccc63f0651d", "level": "note", "message": {"text": "CVE-2025-57352: min-document 2.19.0 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "9cf62c3a7ea0b3d2", "scanner": "scanner-primary", "fingerprint": "f4ec1ccc63f0651d", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-57352"]}}, {"ruleId": "scanner-2a8296c2437a8a0a", "level": "error", "message": {"text": "CVE-2026-26996: minimatch 10.0.3 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "e2a395fe6819feac", "scanner": "scanner-primary", "fingerprint": "2a8296c2437a8a0a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-26996"]}}, {"ruleId": "scanner-542b583c9f682ad0", "level": "error", "message": {"text": "CVE-2026-27903: minimatch 10.0.3 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "15646bbdc36cf8b3", "scanner": "scanner-primary", "fingerprint": "542b583c9f682ad0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-27903"]}}, {"ruleId": "scanner-a5f88d40426fc08f", "level": "error", "message": {"text": "CVE-2026-27904: minimatch 10.0.3 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "405f59b73c5ee99c", "scanner": "scanner-primary", "fingerprint": "a5f88d40426fc08f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-27904"]}}, {"ruleId": "scanner-d1198af69edc91d4", "level": "error", "message": {"text": "CVE-2026-26996: minimatch 3.1.2 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "e2a395fe6819feac", "scanner": "scanner-primary", "fingerprint": "d1198af69edc91d4", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-26996"]}}, {"ruleId": "scanner-1cb458c5bf92e1d7", "level": "error", "message": {"text": "CVE-2026-27903: minimatch 3.1.2 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "15646bbdc36cf8b3", "scanner": "scanner-primary", "fingerprint": "1cb458c5bf92e1d7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-27903"]}}, {"ruleId": "scanner-f93d2ee2f205a1ed", "level": "error", "message": {"text": "CVE-2026-27904: minimatch 3.1.2 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "405f59b73c5ee99c", "scanner": "scanner-primary", "fingerprint": "f93d2ee2f205a1ed", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-27904"]}}, {"ruleId": "scanner-9703440b90c58134", "level": "error", "message": {"text": "CVE-2026-26996: minimatch 5.1.6 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "e2a395fe6819feac", "scanner": "scanner-primary", "fingerprint": "9703440b90c58134", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-26996"]}}, {"ruleId": "scanner-488396ddc060b9da", "level": "error", "message": {"text": "CVE-2026-27903: minimatch 5.1.6 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "15646bbdc36cf8b3", "scanner": "scanner-primary", "fingerprint": "488396ddc060b9da", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-27903"]}}, {"ruleId": "scanner-ce49452ecddac867", "level": "error", "message": {"text": "CVE-2026-27904: minimatch 5.1.6 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "405f59b73c5ee99c", "scanner": "scanner-primary", "fingerprint": "ce49452ecddac867", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-27904"]}}, {"ruleId": "scanner-05a240f394bea34b", "level": "error", "message": {"text": "CVE-2025-12816: node-forge 1.3.1 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "5b6b15fe9e07f59e", "scanner": "scanner-primary", "fingerprint": "05a240f394bea34b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-12816"]}}, {"ruleId": "scanner-1eebe3704d522550", "level": "error", "message": {"text": "CVE-2025-66031: node-forge 1.3.1 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "3c745a629a45720e", "scanner": "scanner-primary", "fingerprint": "1eebe3704d522550", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-66031"]}}, {"ruleId": "scanner-4616d4b046c477a0", "level": "error", "message": {"text": "CVE-2026-33891: node-forge 1.3.1 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "c1a1bf0af27e3b20", "scanner": "scanner-primary", "fingerprint": "4616d4b046c477a0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33891"]}}, {"ruleId": "scanner-0f7a8dd2580f6ba4", "level": "error", "message": {"text": "CVE-2026-33894: node-forge 1.3.1 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "1d74dea34f43da33", "scanner": "scanner-primary", "fingerprint": "0f7a8dd2580f6ba4", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33894"]}}, {"ruleId": "scanner-c2b183047e00ed03", "level": "error", "message": {"text": "CVE-2026-33895: node-forge 1.3.1 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "752c2d406fe205c2", "scanner": "scanner-primary", "fingerprint": "c2b183047e00ed03", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33895"]}}, {"ruleId": "scanner-078b4163276ba80e", "level": "error", "message": {"text": "CVE-2026-33896: node-forge 1.3.1 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "a09e52fc01d1555c", "scanner": "scanner-primary", "fingerprint": "078b4163276ba80e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33896"]}}, {"ruleId": "scanner-9a633ddeb807269a", "level": "warning", "message": {"text": "CVE-2025-66030: node-forge 1.3.1 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "46396bc48b662687", "scanner": "scanner-primary", "fingerprint": "9a633ddeb807269a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-66030"]}}, {"ruleId": "scanner-7c7ac08e2c76e9f6", "level": "note", "message": {"text": "CVE-2025-7339: on-headers 1.0.2 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "cd735438e9bb2562", "scanner": "scanner-primary", "fingerprint": "7c7ac08e2c76e9f6", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-7339"]}}, {"ruleId": "scanner-02ec568c496a12b1", "level": "error", "message": {"text": "CVE-2026-4867: path-to-regexp 0.1.12 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "a8ecc14481127259", "scanner": "scanner-primary", "fingerprint": "02ec568c496a12b1", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-4867"]}}, {"ruleId": "scanner-9f244378a555a1b2", "level": "error", "message": {"text": "CVE-2026-33671: picomatch 2.3.1 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "50a1ca22af0e3548", "scanner": "scanner-primary", "fingerprint": "9f244378a555a1b2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33671"]}}, {"ruleId": "scanner-ab0a11af7be1bb84", "level": "warning", "message": {"text": "CVE-2026-33672: picomatch 2.3.1 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "25c4f7c7e1781532", "scanner": "scanner-primary", "fingerprint": "ab0a11af7be1bb84", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33672"]}}, {"ruleId": "scanner-7464ff545d451e8d", "level": "error", "message": {"text": "CVE-2026-33671: picomatch 4.0.2 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "50a1ca22af0e3548", "scanner": "scanner-primary", "fingerprint": "7464ff545d451e8d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33671"]}}, {"ruleId": "scanner-e930dd5a2fd60aad", "level": "warning", "message": {"text": "CVE-2026-33672: picomatch 4.0.2 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "25c4f7c7e1781532", "scanner": "scanner-primary", "fingerprint": "e930dd5a2fd60aad", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33672"]}}, {"ruleId": "scanner-7866fbdeb8170431", "level": "error", "message": {"text": "CVE-2026-33671: picomatch 4.0.3 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "50a1ca22af0e3548", "scanner": "scanner-primary", "fingerprint": "7866fbdeb8170431", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33671"]}}, {"ruleId": "scanner-06749a9e2eb8965d", "level": "warning", "message": {"text": "CVE-2026-33672: picomatch 4.0.3 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "25c4f7c7e1781532", "scanner": "scanner-primary", "fingerprint": "06749a9e2eb8965d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33672"]}}, {"ruleId": "scanner-63faace6dc01dd7f", "level": "warning", "message": {"text": "CVE-2026-41305: postcss 8.5.3 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "9177cf1e6ab13411", "scanner": "scanner-primary", "fingerprint": "63faace6dc01dd7f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41305"]}}, {"ruleId": "scanner-53e9bc1b33b97e2e", "level": "warning", "message": {"text": "CVE-2026-41305: postcss 8.5.6 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "9177cf1e6ab13411", "scanner": "scanner-primary", "fingerprint": "53e9bc1b33b97e2e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41305"]}}, {"ruleId": "scanner-3a0fb7ca3e517bfc", "level": "warning", "message": {"text": "CVE-2025-15284: qs 6.13.0 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "c705e4e5d114df77", "scanner": "scanner-primary", "fingerprint": "3a0fb7ca3e517bfc", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-15284"]}}, {"ruleId": "scanner-cc0939017dd44a9c", "level": "warning", "message": {"text": "CVE-2026-8723: qs 6.13.0 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "a7adafc808d1b7c4", "scanner": "scanner-primary", "fingerprint": "cc0939017dd44a9c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-8723"]}}, {"ruleId": "scanner-490cc92e73a70201", "level": "note", "message": {"text": "CVE-2026-2391: qs 6.13.0 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "49b027c6f2d929d4", "scanner": "scanner-primary", "fingerprint": "490cc92e73a70201", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-2391"]}}, {"ruleId": "scanner-2173c3b41e48f1e1", "level": "error", "message": {"text": "CVE-2026-27606: rollup 2.79.2 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "e5591644941a72fe", "scanner": "scanner-primary", "fingerprint": "2173c3b41e48f1e1", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-27606"]}}, {"ruleId": "scanner-3eab1398d3997e08", "level": "error", "message": {"text": "CVE-2026-27606: rollup 4.35.0 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "e5591644941a72fe", "scanner": "scanner-primary", "fingerprint": "3eab1398d3997e08", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-27606"]}}, {"ruleId": "scanner-46ecbc29acff5ef8", "level": "error", "message": {"text": "CVE-2026-27606: rollup 4.53.3 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "e5591644941a72fe", "scanner": "scanner-primary", "fingerprint": "46ecbc29acff5ef8", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-27606"]}}, {"ruleId": "scanner-6b7708ba03353bcb", "level": "error", "message": {"text": "GHSA-5c6j-r48x-rmvq: serialize-javascript 6.0.2 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "69c719f74befc8e7", "scanner": "scanner-primary", "fingerprint": "6b7708ba03353bcb", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-5c6j-r48x-rmvq"]}}, {"ruleId": "scanner-9dcf5cb12f043c02", "level": "warning", "message": {"text": "CVE-2026-34043: serialize-javascript 6.0.2 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "dd81acc2e2f0cc0b", "scanner": "scanner-primary", "fingerprint": "9dcf5cb12f043c02", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-34043"]}}, {"ruleId": "scanner-9ebf46c2a62fd364", "level": "error", "message": {"text": "CVE-2026-9277: shell-quote 1.8.2 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "60e72d10f3d8c5c6", "scanner": "scanner-primary", "fingerprint": "9ebf46c2a62fd364", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-9277"]}}, {"ruleId": "scanner-1497dca89f55b6ce", "level": "error", "message": {"text": "CVE-2026-13311: shell-quote 1.8.2 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "d5d8d9e7214d3472", "scanner": "scanner-primary", "fingerprint": "1497dca89f55b6ce", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-13311"]}}, {"ruleId": "scanner-912b21fc020a0926", "level": "warning", "message": {"text": "CVE-2024-1899: showdown 1.9.1 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "4655c5d76b85fad1", "scanner": "scanner-primary", "fingerprint": "912b21fc020a0926", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2024-1899"]}}, {"ruleId": "scanner-4f712762a7466d39", "level": "warning", "message": {"text": "CVE-2026-27119: svelte 5.43.12 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "91b2e19c44b0d1c2", "scanner": "scanner-primary", "fingerprint": "4f712762a7466d39", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-27119"]}}, {"ruleId": "scanner-d7c3ed9325589b3f", "level": "warning", "message": {"text": "CVE-2026-27121: svelte 5.43.12 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "a274b5cfe57e5c0d", "scanner": "scanner-primary", "fingerprint": "d7c3ed9325589b3f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-27121"]}}, {"ruleId": "scanner-1e6d467f0a479c6d", "level": "warning", "message": {"text": "CVE-2026-27122: svelte 5.43.12 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "620dbb6043309d66", "scanner": "scanner-primary", "fingerprint": "1e6d467f0a479c6d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-27122"]}}, {"ruleId": "scanner-eb24c55d255b4296", "level": "warning", "message": {"text": "CVE-2026-27125: svelte 5.43.12 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "978d675aac52b233", "scanner": "scanner-primary", "fingerprint": "eb24c55d255b4296", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-27125"]}}, {"ruleId": "scanner-f04793a17cae3d35", "level": "warning", "message": {"text": "CVE-2026-27901: svelte 5.43.12 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "ff7a84a0da37a3fe", "scanner": "scanner-primary", "fingerprint": "f04793a17cae3d35", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-27901"]}}, {"ruleId": "scanner-ce5f5561249f5725", "level": "warning", "message": {"text": "CVE-2026-42573: svelte 5.43.12 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "e8146337c1e88ac0", "scanner": "scanner-primary", "fingerprint": "ce5f5561249f5725", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42573"]}}, {"ruleId": "scanner-0778a041c2e7cab1", "level": "warning", "message": {"text": "CVE-2026-42599: svelte 5.43.12 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "63a1593ea61fa13a", "scanner": "scanner-primary", "fingerprint": "0778a041c2e7cab1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42599"]}}, {"ruleId": "scanner-226e1bc058ae11ed", "level": "warning", "message": {"text": "CVE-2026-41907: uuid 8.3.2 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "ce64d4a91b418955", "scanner": "scanner-primary", "fingerprint": "226e1bc058ae11ed", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41907"]}}, {"ruleId": "scanner-d57769a75313f0c2", "level": "warning", "message": {"text": "CVE-2026-41907: uuid 9.0.1 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "ce64d4a91b418955", "scanner": "scanner-primary", "fingerprint": "d57769a75313f0c2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41907"]}}, {"ruleId": "scanner-72cf0b7b8762f7cb", "level": "error", "message": {"text": "CVE-2026-39363: vite 6.3.5 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "e8c596ccc4098abb", "scanner": "scanner-primary", "fingerprint": "72cf0b7b8762f7cb", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-39363"]}}, {"ruleId": "scanner-ade33455487cdb17", "level": "error", "message": {"text": "CVE-2026-53571: vite 6.3.5 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "d7a98de180351e0a", "scanner": "scanner-primary", "fingerprint": "ade33455487cdb17", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-53571"]}}, {"ruleId": "scanner-a8f9ac1a855d8aa8", "level": "warning", "message": {"text": "CVE-2025-62522: vite 6.3.5 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "684fe41ada843e0c", "scanner": "scanner-primary", "fingerprint": "a8f9ac1a855d8aa8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-62522"]}}, {"ruleId": "scanner-503728a2dbe4bdbc", "level": "warning", "message": {"text": "CVE-2026-39365: vite 6.3.5 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "a29de5381b3c4eae", "scanner": "scanner-primary", "fingerprint": "503728a2dbe4bdbc", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-39365"]}}, {"ruleId": "scanner-6dc2a02f44329662", "level": "warning", "message": {"text": "CVE-2026-53632: vite 6.3.5 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "2298f85d16a68c92", "scanner": "scanner-primary", "fingerprint": "6dc2a02f44329662", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-53632"]}}, {"ruleId": "scanner-355db9ab5b78f45f", "level": "note", "message": {"text": "CVE-2025-58751: vite 6.3.5 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "354d990ad9c37665", "scanner": "scanner-primary", "fingerprint": "355db9ab5b78f45f", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-58751"]}}, {"ruleId": "scanner-8c19fd1e9418b6ef", "level": "note", "message": {"text": "CVE-2025-58752: vite 6.3.5 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "a560c399348eceed", "scanner": "scanner-primary", "fingerprint": "8c19fd1e9418b6ef", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-58752"]}}, {"ruleId": "scanner-52af6ad522e2044e", "level": "note", "message": {"text": "CVE-2025-68157: webpack 5.98.0 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "813a79cea211c745", "scanner": "scanner-primary", "fingerprint": "52af6ad522e2044e", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-68157"]}}, {"ruleId": "scanner-12bb94944eeed0bb", "level": "note", "message": {"text": "CVE-2025-68458: webpack 5.98.0 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "6ad4427b54c82da8", "scanner": "scanner-primary", "fingerprint": "12bb94944eeed0bb", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-68458"]}}, {"ruleId": "scanner-e516c4ec9b5f681c", "level": "warning", "message": {"text": "CVE-2025-30359: webpack-dev-server 4.15.2 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "15974162ab95250f", "scanner": "scanner-primary", "fingerprint": "e516c4ec9b5f681c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-30359"]}}, {"ruleId": "scanner-a6415d4220a8ec79", "level": "warning", "message": {"text": "CVE-2025-30360: webpack-dev-server 4.15.2 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "4e748eb2206f7866", "scanner": "scanner-primary", "fingerprint": "a6415d4220a8ec79", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-30360"]}}, {"ruleId": "scanner-a05ba0341def1929", "level": "warning", "message": {"text": "CVE-2026-14620: webpack-dev-server 4.15.2 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "8de543808664105d", "scanner": "scanner-primary", "fingerprint": "a05ba0341def1929", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-14620"]}}, {"ruleId": "scanner-754861273385df05", "level": "warning", "message": {"text": "CVE-2026-14631: webpack-dev-server 4.15.2 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "1776d6350dd6a2fd", "scanner": "scanner-primary", "fingerprint": "754861273385df05", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-14631"]}}, {"ruleId": "scanner-f22f7955d9695c00", "level": "warning", "message": {"text": "CVE-2026-6402: webpack-dev-server 4.15.2 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "b4e1bc9700b4ff62", "scanner": "scanner-primary", "fingerprint": "f22f7955d9695c00", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-6402"]}}, {"ruleId": "scanner-7710074b3f5f60b9", "level": "warning", "message": {"text": "CVE-2026-9595: webpack-dev-server 4.15.2 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "945f80c35b672d13", "scanner": "scanner-primary", "fingerprint": "7710074b3f5f60b9", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-9595"]}}, {"ruleId": "scanner-87befcc642bb3ba3", "level": "error", "message": {"text": "CVE-2026-54466: websocket-driver 0.7.4 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "8a223cc4268f9c89", "scanner": "scanner-primary", "fingerprint": "87befcc642bb3ba3", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54466"]}}, {"ruleId": "scanner-7781f183a103791d", "level": "warning", "message": {"text": "CVE-2026-54490: websocket-driver 0.7.4 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "7c25a4aa9588b13c", "scanner": "scanner-primary", "fingerprint": "7781f183a103791d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54490"]}}, {"ruleId": "scanner-775e3692661021cd", "level": "error", "message": {"text": "CVE-2026-48779: ws 7.5.10 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "3e3e7c29f5745cfa", "scanner": "scanner-primary", "fingerprint": "775e3692661021cd", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48779"]}}, {"ruleId": "scanner-c747daf7aa05756f", "level": "error", "message": {"text": "CVE-2026-48779: ws 8.18.1 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "3e3e7c29f5745cfa", "scanner": "scanner-primary", "fingerprint": "c747daf7aa05756f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48779"]}}, {"ruleId": "scanner-b397f5095cc73d37", "level": "warning", "message": {"text": "CVE-2026-45736: ws 8.18.1 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "641d2b16c8bb5383", "scanner": "scanner-primary", "fingerprint": "b397f5095cc73d37", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45736"]}}, {"ruleId": "scanner-6700ef239846cd0e", "level": "error", "message": {"text": "CVE-2026-48779: ws 8.18.3 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "3e3e7c29f5745cfa", "scanner": "scanner-primary", "fingerprint": "6700ef239846cd0e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48779"]}}, {"ruleId": "scanner-6c362237ea6c86e8", "level": "warning", "message": {"text": "CVE-2026-45736: ws 8.18.3 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "641d2b16c8bb5383", "scanner": "scanner-primary", "fingerprint": "6c362237ea6c86e8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45736"]}}, {"ruleId": "scanner-86848316fecd06ca", "level": "warning", "message": {"text": "CVE-2026-33532: yaml 1.10.2 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "af8a550184bdaf3a", "scanner": "scanner-primary", "fingerprint": "86848316fecd06ca", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33532"]}}, {"ruleId": "scanner-f45eec7a084ceeda", "level": "warning", "message": {"text": "CVE-2026-33532: yaml 2.7.0 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "af8a550184bdaf3a", "scanner": "scanner-primary", "fingerprint": "f45eec7a084ceeda", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33532"]}}, {"ruleId": "scanner-06b2c99d6a4a1501", "level": "warning", "message": {"text": "DS-0001: ':latest' tag used \u2014 Dockerfile"}, "properties": {"repobilityId": "b1709ca12858d701", "scanner": "scanner-primary", "fingerprint": "06b2c99d6a4a1501", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-3a3527e70129fb18", "level": "error", "message": {"text": "DS-0002: Image user should not be 'root' \u2014 Dockerfile"}, "properties": {"repobilityId": "691787f6b20605df", "scanner": "scanner-primary", "fingerprint": "3a3527e70129fb18", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-3c4041c454cda88e", "level": "note", "message": {"text": "DS-0026: No HEALTHCHECK defined \u2014 Dockerfile"}, "properties": {"repobilityId": "da995bb2cfa21f65", "scanner": "scanner-primary", "fingerprint": "3c4041c454cda88e", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-a4b9283354e8accd", "level": "error", "message": {"text": "DS-0029: 'apt-get' missing '--no-install-recommends' \u2014 Dockerfile"}, "properties": {"repobilityId": "c484f9f5427be180", "scanner": "scanner-primary", "fingerprint": "a4b9283354e8accd", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-2679282aa1c484b5", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: AGENTS.md"}, "properties": {"repobilityId": "27d579812e6be614", "scanner": "scanner-primary", "fingerprint": "2679282aa1c484b5", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "agents_md"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "AGENTS.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d63da3583b14afc0", "level": "warning", "message": {"text": "Dockerfile runs as root: Dockerfile"}, "properties": {"repobilityId": "a2ed1bd120e507db", "scanner": "scanner-primary", "fingerprint": "d63da3583b14afc0", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-13fc0767c11e2d59", "level": "warning", "message": {"text": "Docker base image uses a mutable or implicit tag: rust:latest"}, "properties": {"repobilityId": "603088d233fdcb09", "scanner": "scanner-primary", "fingerprint": "13fc0767c11e2d59", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 5}}}]}, {"ruleId": "scanner-ea0769065ed41804", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:${NODE_VERSION}"}, "properties": {"repobilityId": "7c162fa2e89308df", "scanner": "scanner-primary", "fingerprint": "ea0769065ed41804", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-1f89c4fa54a9b2a1", "level": "error", "message": {"text": "Insecure pattern 'node_child_process' in packages/chrome-plugin/vglrunWrapper.js:3"}, "properties": {"repobilityId": "c43c46c254367a0d", "scanner": "scanner-primary", "fingerprint": "1f89c4fa54a9b2a1", "layer": "security", "severity": "high", "confidence": 0.9, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/chrome-plugin/vglrunWrapper.js"}, "region": {"startLine": 3}}}]}, {"ruleId": "scanner-ee9566b557b3c518", "level": "warning", "message": {"text": "Insecure pattern 'direct_outerhtml_assignment' in packages/lint-framework/src/lint/RenderBox.ts:45"}, "properties": {"repobilityId": "83b73e9e05ee225a", "scanner": "scanner-primary", "fingerprint": "ee9566b557b3c518", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "direct_outerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/lint-framework/src/lint/RenderBox.ts"}, "region": {"startLine": 45}}}]}, {"ruleId": "scanner-b4137be90e726165", "level": "error", "message": {"text": "Possible secret in packages/web/vite.config.ts"}, "properties": {"repobilityId": "801456f696e9b6ab", "scanner": "scanner-primary", "fingerprint": "b4137be90e726165", "layer": "security", "severity": "high", "confidence": 0.72, "tags": ["secrets", "generic_api_key"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/web/vite.config.ts"}, "region": {"startLine": 57}}}]}, {"ruleId": "scanner-a2a0b4c35eaaf88e", "level": "error", "message": {"text": "Possible secret in packages/web/src/lib/marketing/data.ts"}, "properties": {"repobilityId": "3b3b54f3aed56310", "scanner": "scanner-primary", "fingerprint": "a2a0b4c35eaaf88e", "layer": "security", "severity": "high", "confidence": 0.72, "tags": ["secrets", "generic_api_key"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/web/src/lib/marketing/data.ts"}, "region": {"startLine": 259}}}]}, {"ruleId": "scanner-238c79d69d09da3a", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in packages/web/src/routes/latestversion/+server.ts:14"}, "properties": {"repobilityId": "f1dd1705e91742ce", "scanner": "scanner-primary", "fingerprint": "238c79d69d09da3a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/web/src/routes/latestversion/+server.ts"}, "region": {"startLine": 14}}}]}, {"ruleId": "scanner-2f768bba179ab82a", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/obsidian-plugin/src/State.ts:225"}, "properties": {"repobilityId": "2a1ffe778e877ed6", "scanner": "scanner-primary", "fingerprint": "2f768bba179ab82a", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/obsidian-plugin/src/State.ts"}, "region": {"startLine": 225}}}]}, {"ruleId": "scanner-6f9297722b3c21fb", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/obsidian-plugin/src/index.ts:99"}, "properties": {"repobilityId": "80dcc4275a2c4e23", "scanner": "scanner-primary", "fingerprint": "6f9297722b3c21fb", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/obsidian-plugin/src/index.ts"}, "region": {"startLine": 99}}}]}, {"ruleId": "scanner-29626265210e84af", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a61e41b5ade72739", "scanner": "scanner-primary", "fingerprint": "29626265210e84af", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "harper-desktop/.github/workflows/build_artifacts.yml"}, "region": {"startLine": 46}}}]}, {"ruleId": "scanner-4bd0f79aaa3e50c2", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "19042edc6aa40b59", "scanner": "scanner-primary", "fingerprint": "4bd0f79aaa3e50c2", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/chrome_plugin.yml"}, "region": {"startLine": 33}}}]}, {"ruleId": "scanner-86a73356f1680380", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "11fdaf69671b736a", "scanner": "scanner-primary", "fingerprint": "86a73356f1680380", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/just_checks.yml"}, "region": {"startLine": 40}}}]}, {"ruleId": "scanner-0cb389e43c5b975e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "642179e97ad4ddbd", "scanner": "scanner-primary", "fingerprint": "0cb389e43c5b975e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build_web.yml"}, "region": {"startLine": 16}}}]}, {"ruleId": "scanner-4e997fb60124cd88", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "bb7ef6459a286be7", "scanner": "scanner-primary", "fingerprint": "4e997fb60124cd88", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/wp_plugin.yml"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-a1de794a1554670f", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e0217069a5e807ed", "scanner": "scanner-primary", "fingerprint": "a1de794a1554670f", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/binaries.yml"}, "region": {"startLine": 119}}}]}, {"ruleId": "scanner-c303c2542f43a2da", "level": "note", "message": {"text": "package.json defines install-time lifecycle scripts"}, "properties": {"repobilityId": "fca4b68164b1a152", "scanner": "scanner-primary", "fingerprint": "c303c2542f43a2da", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "npm", "install-scripts"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/harper-editor/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6916939a786a8e97", "level": "note", "message": {"text": "package.json defines install-time lifecycle scripts"}, "properties": {"repobilityId": "bfc774b5e086c9e8", "scanner": "scanner-primary", "fingerprint": "6916939a786a8e97", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "npm", "install-scripts"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/components/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cf2aeb9f349f044f", "level": "note", "message": {"text": "Very large file: harper-core/src/dict_word_metadata.rs (2056 lines)"}, "properties": {"repobilityId": "5655edfc0bcd30d9", "scanner": "scanner-primary", "fingerprint": "cf2aeb9f349f044f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-82529d8b13f38565", "level": "note", "message": {"text": "Very large file: harper-core/src/linting/there_is_agreement.rs (1482 lines)"}, "properties": {"repobilityId": "204542386fc5583e", "scanner": "scanner-primary", "fingerprint": "82529d8b13f38565", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-8c30481885bd9687", "level": "note", "message": {"text": "Very large file: harper-core/src/linting/phrase_set_corrections/tests.rs (4010 lines)"}, "properties": {"repobilityId": "6c56fb125b20d61a", "scanner": "scanner-primary", "fingerprint": "8c30481885bd9687", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ea3b5e389d8c9c0f", "level": "note", "message": {"text": "Low test-to-source ratio"}, "properties": {"repobilityId": "ef7b2552cc00a375", "scanner": "scanner-primary", "fingerprint": "ea3b5e389d8c9c0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["tests"]}}, {"ruleId": "scanner-ce8f04c6ed505b7d", "level": "note", "message": {"text": "82 TODO/FIXME markers"}, "properties": {"repobilityId": "4b38c118003e07d2", "scanner": "scanner-primary", "fingerprint": "ce8f04c6ed505b7d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["maintenance"]}}, {"ruleId": "scanner-f3ef0b0fedf51494", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/chrome-plugin/package.json"}, "properties": {"repobilityId": "83909a3766eba6ce", "scanner": "scanner-primary", "fingerprint": "f3ef0b0fedf51494", "layer": "dependencies", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/chrome-plugin/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c9f0bbd2249efa17", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/lint-framework/package.json"}, "properties": {"repobilityId": "8aa6b9b83567b9f8", "scanner": "scanner-primary", "fingerprint": "c9f0bbd2249efa17", "layer": "dependencies", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/lint-framework/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ceec06a9962a06e7", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/harper-editor/package.json"}, "properties": {"repobilityId": "de6891f20f63c525", "scanner": "scanner-primary", "fingerprint": "ceec06a9962a06e7", "layer": "dependencies", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/harper-editor/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8ec8546f57542ac1", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/components/package.json"}, "properties": {"repobilityId": "26d7ccba6a49d7f8", "scanner": "scanner-primary", "fingerprint": "8ec8546f57542ac1", "layer": "dependencies", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/components/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a21d9e3b7b5efad1", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/vscode-plugin/package.json"}, "properties": {"repobilityId": "ab1d0074eba599e5", "scanner": "scanner-primary", "fingerprint": "a21d9e3b7b5efad1", "layer": "dependencies", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/vscode-plugin/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6e827b68790f9205", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/web/package.json"}, "properties": {"repobilityId": "8f313f0fe526a925", "scanner": "scanner-primary", "fingerprint": "6e827b68790f9205", "layer": "dependencies", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/web/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-499c1e3c3e3b5b16", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/wordpress-plugin/package.json"}, "properties": {"repobilityId": "4ffb5f88d5684f88", "scanner": "scanner-primary", "fingerprint": "499c1e3c3e3b5b16", "layer": "dependencies", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/wordpress-plugin/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f354053a775475a0", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/harper.js/package.json"}, "properties": {"repobilityId": "58ab485e14814970", "scanner": "scanner-primary", "fingerprint": "f354053a775475a0", "layer": "dependencies", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/harper.js/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e0ccbadfc1a96d57", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/harper.js/examples/commonjs-simple/package.json"}, "properties": {"repobilityId": "f29465cd6b2e4998", "scanner": "scanner-primary", "fingerprint": "e0ccbadfc1a96d57", "layer": "dependencies", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/harper.js/examples/commonjs-simple/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5f8c98aa69b3404d", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/obsidian-plugin/package.json"}, "properties": {"repobilityId": "902b95087b5f70ec", "scanner": "scanner-primary", "fingerprint": "5f8c98aa69b3404d", "layer": "dependencies", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/obsidian-plugin/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ce2bf8e9d1ca230e", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: harper-desktop/package.json"}, "properties": {"repobilityId": "2403ef6b8c176c3b", "scanner": "scanner-primary", "fingerprint": "ce2bf8e9d1ca230e", "layer": "dependencies", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "harper-desktop/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "00ef5aedc4be0cdf", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "1771bf8105ec7ae7", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "39e9dbee5fc25eef", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-819d6198ee294c44", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/components/src/app.d.ts:5"}, "properties": {"repobilityId": "79817acef1114a98", "scanner": "scanner-primary", "fingerprint": "819d6198ee294c44", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/components/src/app.d.ts"}, "region": {"startLine": 5}}}]}, {"ruleId": "scanner-869ec55852c944e8", "level": "warning", "message": {"text": "Vulnerable dependency ammonia 4.1.2: RUSTSEC-2026-0193"}, "properties": {"repobilityId": "4eb658ed8a2445fe", "scanner": "scanner-primary", "fingerprint": "869ec55852c944e8", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "RUSTSEC-2026-0193"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "harper-core/Cargo.toml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ba0d7171128f0a39", "level": "warning", "message": {"text": "Vulnerable dependency ammonia 4.1.2: RUSTSEC-2026-0213"}, "properties": {"repobilityId": "32f2885bfb530229", "scanner": "scanner-primary", "fingerprint": "ba0d7171128f0a39", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "RUSTSEC-2026-0213"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "harper-core/Cargo.toml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f76611a699d1cf61", "level": "warning", "message": {"text": "Vulnerable dependency anyhow 1.0.102: RUSTSEC-2026-0190"}, "properties": {"repobilityId": "b0f8e201981c9769", "scanner": "scanner-primary", "fingerprint": "f76611a699d1cf61", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "RUSTSEC-2026-0190"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "harper-cli/Cargo.toml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-70d05205310955f7", "level": "warning", "message": {"text": "Vulnerable dependency paste 1.0.15: RUSTSEC-2024-0436"}, "properties": {"repobilityId": "de501cde0592e0b2", "scanner": "scanner-primary", "fingerprint": "70d05205310955f7", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "RUSTSEC-2024-0436"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "harper-asciidoc/Cargo.toml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6ca2501f8285c2bf", "level": "warning", "message": {"text": "Vulnerable dependency rand 0.8.5: GHSA-cq8v-f236-94qc"}, "properties": {"repobilityId": "ba2e00fa76b72ddf", "scanner": "scanner-primary", "fingerprint": "6ca2501f8285c2bf", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-cq8v-f236-94qc"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Cargo.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0325a246f7c1753d", "level": "warning", "message": {"text": "Vulnerable dependency rand 0.8.5: RUSTSEC-2026-0097"}, "properties": {"repobilityId": "75d6effecb82820a", "scanner": "scanner-primary", "fingerprint": "0325a246f7c1753d", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "RUSTSEC-2026-0097"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Cargo.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6d22029acf93c203", "level": "warning", "message": {"text": "Vulnerable dependency rand 0.9.2: GHSA-cq8v-f236-94qc"}, "properties": {"repobilityId": "8b40e66ae7f26243", "scanner": "scanner-primary", "fingerprint": "6d22029acf93c203", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-cq8v-f236-94qc"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Cargo.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0478e3a348858130", "level": "warning", "message": {"text": "Vulnerable dependency rand 0.9.2: RUSTSEC-2026-0097"}, "properties": {"repobilityId": "7926df4b271c7a82", "scanner": "scanner-primary", "fingerprint": "0478e3a348858130", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "RUSTSEC-2026-0097"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Cargo.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-51eec1ff197a43f2", "level": "warning", "message": {"text": "Vulnerable dependency @babel/runtime 7.25.7: GHSA-968p-4wvh-cqc8"}, "properties": {"repobilityId": "82dd5ca7d538a8c4", "scanner": "scanner-primary", "fingerprint": "51eec1ff197a43f2", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-968p-4wvh-cqc8"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-dd74546df761950e", "level": "warning", "message": {"text": "Vulnerable dependency @sveltejs/kit 2.48.5: GHSA-2crg-3p73-43xp"}, "properties": {"repobilityId": "89f6ebb2160e3c82", "scanner": "scanner-primary", "fingerprint": "dd74546df761950e", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-2crg-3p73-43xp", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "harper-desktop/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ca43efd3fae7680f", "level": "warning", "message": {"text": "Vulnerable dependency @sveltejs/kit 2.48.5: GHSA-3f6h-2hrp-w5wx"}, "properties": {"repobilityId": "4dbbff9089500959", "scanner": "scanner-primary", "fingerprint": "ca43efd3fae7680f", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-3f6h-2hrp-w5wx", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "harper-desktop/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6d68ef5a7b7493cb", "level": "warning", "message": {"text": "Vulnerable dependency @sveltejs/kit 2.48.5: GHSA-hgv7-v322-mmgr"}, "properties": {"repobilityId": "0e2556fc9fef42d5", "scanner": "scanner-primary", "fingerprint": "6d68ef5a7b7493cb", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-hgv7-v322-mmgr", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "harper-desktop/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b565383f1178892c", "level": "warning", "message": {"text": "Vulnerable dependency @sveltejs/kit 2.48.5: GHSA-j62c-4x62-9r35"}, "properties": {"repobilityId": "be80c45fee9ef1bb", "scanner": "scanner-primary", "fingerprint": "b565383f1178892c", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-j62c-4x62-9r35", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "harper-desktop/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7647d70179c0ee2d", "level": "warning", "message": {"text": "Vulnerable dependency @vitest/browser 4.0.16: GHSA-g8mr-85jm-7xhm"}, "properties": {"repobilityId": "34937a220d8d4f1c", "scanner": "scanner-primary", "fingerprint": "7647d70179c0ee2d", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-g8mr-85jm-7xhm", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/harper.js/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b818cfb0c24b5289", "level": "warning", "message": {"text": "Vulnerable dependency @vitest/browser 4.0.16: GHSA-p63j-vcc4-9vmv"}, "properties": {"repobilityId": "d83f22e18acde9b3", "scanner": "scanner-primary", "fingerprint": "b818cfb0c24b5289", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-p63j-vcc4-9vmv", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/harper.js/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b2090be9565c6dfc", "level": "warning", "message": {"text": "Vulnerable dependency drizzle-orm 0.44.6: GHSA-gpj5-g38j-94v9"}, "properties": {"repobilityId": "2a549aeea9e8d9b9", "scanner": "scanner-primary", "fingerprint": "b2090be9565c6dfc", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-gpj5-g38j-94v9"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/web/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-de1b96f6ccc2018f", "level": "warning", "message": {"text": "Vulnerable dependency esbuild 0.18.20: GHSA-67mh-4wv8-2f99"}, "properties": {"repobilityId": "370c12585895d5be", "scanner": "scanner-primary", "fingerprint": "de1b96f6ccc2018f", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-67mh-4wv8-2f99"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f2a785452881004e", "level": "warning", "message": {"text": "Vulnerable dependency esbuild 0.21.5: GHSA-67mh-4wv8-2f99"}, "properties": {"repobilityId": "be00f073db852f14", "scanner": "scanner-primary", "fingerprint": "f2a785452881004e", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-67mh-4wv8-2f99"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bae0a3f4ea305b1b", "level": "warning", "message": {"text": "Vulnerable dependency esbuild 0.23.1: GHSA-67mh-4wv8-2f99"}, "properties": {"repobilityId": "e49db9734256000b", "scanner": "scanner-primary", "fingerprint": "bae0a3f4ea305b1b", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-67mh-4wv8-2f99"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-08a0e0c71a8193d1", "level": "warning", "message": {"text": "Vulnerable dependency lodash-es 4.17.21: GHSA-f23m-r3pf-42rh"}, "properties": {"repobilityId": "7b3f6fdf7d11ec7d", "scanner": "scanner-primary", "fingerprint": "08a0e0c71a8193d1", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-f23m-r3pf-42rh"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/chrome-plugin/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5a3d1f291f10cd0d", "level": "warning", "message": {"text": "Vulnerable dependency lodash-es 4.17.21: GHSA-r5fr-rjxr-66jc"}, "properties": {"repobilityId": "ac56e476e2fa190f", "scanner": "scanner-primary", "fingerprint": "5a3d1f291f10cd0d", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-r5fr-rjxr-66jc"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/chrome-plugin/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-49a99a6600677eb0", "level": "warning", "message": {"text": "Vulnerable dependency lodash-es 4.17.21: GHSA-xxjr-mmjv-4gpg"}, "properties": {"repobilityId": "6d5792830e11263b", "scanner": "scanner-primary", "fingerprint": "49a99a6600677eb0", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-xxjr-mmjv-4gpg"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/chrome-plugin/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-71d13decb3f1f1ca", "level": "error", "message": {"text": "Vulnerable dependency minimatch 10.0.1: GHSA-23c5-xmqv-rm74"}, "properties": {"repobilityId": "f1bfbd7f7c76e3b3", "scanner": "scanner-primary", "fingerprint": "71d13decb3f1f1ca", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-23c5-xmqv-rm74"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0d887101f1cafa22", "level": "error", "message": {"text": "Vulnerable dependency minimatch 10.0.1: GHSA-3ppc-4f35-3m26"}, "properties": {"repobilityId": "cd8834bf1d67a63b", "scanner": "scanner-primary", "fingerprint": "0d887101f1cafa22", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-3ppc-4f35-3m26"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-44e8ed790dfb948d", "level": "error", "message": {"text": "Vulnerable dependency minimatch 10.0.1: GHSA-7r86-cg39-jmmj"}, "properties": {"repobilityId": "142b96824e01609b", "scanner": "scanner-primary", "fingerprint": "44e8ed790dfb948d", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-7r86-cg39-jmmj"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f681485b948b6354", "level": "error", "message": {"text": "Vulnerable dependency minimatch 10.0.3: GHSA-23c5-xmqv-rm74"}, "properties": {"repobilityId": "69586a999a7fec8e", "scanner": "scanner-primary", "fingerprint": "f681485b948b6354", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-23c5-xmqv-rm74"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/obsidian-plugin/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-80f13cd2235c6ed4", "level": "error", "message": {"text": "Vulnerable dependency minimatch 10.0.3: GHSA-3ppc-4f35-3m26"}, "properties": {"repobilityId": "b2cc499250c5a3b3", "scanner": "scanner-primary", "fingerprint": "80f13cd2235c6ed4", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-3ppc-4f35-3m26"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/obsidian-plugin/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9d37ca5305ef54b8", "level": "error", "message": {"text": "Vulnerable dependency minimatch 10.0.3: GHSA-7r86-cg39-jmmj"}, "properties": {"repobilityId": "2419d4ab8a3433f3", "scanner": "scanner-primary", "fingerprint": "9d37ca5305ef54b8", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-7r86-cg39-jmmj"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/obsidian-plugin/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-035e7c548040df38", "level": "error", "message": {"text": "Vulnerable dependency minimatch 3.0.8: GHSA-23c5-xmqv-rm74"}, "properties": {"repobilityId": "5088e306f1e87f2d", "scanner": "scanner-primary", "fingerprint": "035e7c548040df38", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-23c5-xmqv-rm74"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f624ac9457a6c5d9", "level": "error", "message": {"text": "Vulnerable dependency minimatch 3.0.8: GHSA-3ppc-4f35-3m26"}, "properties": {"repobilityId": "ca4d91db3c14518e", "scanner": "scanner-primary", "fingerprint": "f624ac9457a6c5d9", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-3ppc-4f35-3m26"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-413287385f084105", "level": "error", "message": {"text": "Vulnerable dependency minimatch 3.0.8: GHSA-7r86-cg39-jmmj"}, "properties": {"repobilityId": "b488260753351f09", "scanner": "scanner-primary", "fingerprint": "413287385f084105", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-7r86-cg39-jmmj"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3e0ab6ef811f0b4d", "level": "error", "message": {"text": "Vulnerable dependency minimatch 3.1.2: GHSA-23c5-xmqv-rm74"}, "properties": {"repobilityId": "9f7f5897e94c3644", "scanner": "scanner-primary", "fingerprint": "3e0ab6ef811f0b4d", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-23c5-xmqv-rm74"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1db0ed7f82e2cc7b", "level": "error", "message": {"text": "Vulnerable dependency minimatch 3.1.2: GHSA-3ppc-4f35-3m26"}, "properties": {"repobilityId": "1f348c9c38426ebf", "scanner": "scanner-primary", "fingerprint": "1db0ed7f82e2cc7b", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-3ppc-4f35-3m26"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5500b45af7440f9f", "level": "error", "message": {"text": "Vulnerable dependency minimatch 3.1.2: GHSA-7r86-cg39-jmmj"}, "properties": {"repobilityId": "20c31d31e282c8df", "scanner": "scanner-primary", "fingerprint": "5500b45af7440f9f", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-7r86-cg39-jmmj"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d596ada94fc9f8b1", "level": "error", "message": {"text": "Vulnerable dependency minimatch 5.1.6: GHSA-23c5-xmqv-rm74"}, "properties": {"repobilityId": "79c754df4fc4817a", "scanner": "scanner-primary", "fingerprint": "d596ada94fc9f8b1", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-23c5-xmqv-rm74"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9124e66e5f52f8cd", "level": "error", "message": {"text": "Vulnerable dependency minimatch 5.1.6: GHSA-3ppc-4f35-3m26"}, "properties": {"repobilityId": "769b5efe286120d2", "scanner": "scanner-primary", "fingerprint": "9124e66e5f52f8cd", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-3ppc-4f35-3m26"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9b3d8e1ae44f10f6", "level": "error", "message": {"text": "Vulnerable dependency minimatch 5.1.6: GHSA-7r86-cg39-jmmj"}, "properties": {"repobilityId": "c1d2f27da8cb3fa9", "scanner": "scanner-primary", "fingerprint": "9b3d8e1ae44f10f6", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-7r86-cg39-jmmj"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-73a288b8d92b124f", "level": "error", "message": {"text": "Vulnerable dependency minimatch 9.0.3: GHSA-23c5-xmqv-rm74"}, "properties": {"repobilityId": "22f2f3902bce82f5", "scanner": "scanner-primary", "fingerprint": "73a288b8d92b124f", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-23c5-xmqv-rm74"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f71bd5c93720b781", "level": "error", "message": {"text": "Vulnerable dependency minimatch 9.0.3: GHSA-3ppc-4f35-3m26"}, "properties": {"repobilityId": "efc06e04c1e82404", "scanner": "scanner-primary", "fingerprint": "f71bd5c93720b781", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-3ppc-4f35-3m26"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9f43e077467c5a43", "level": "error", "message": {"text": "Vulnerable dependency minimatch 9.0.3: GHSA-7r86-cg39-jmmj"}, "properties": {"repobilityId": "d3b810a57a2dc7b8", "scanner": "scanner-primary", "fingerprint": "9f43e077467c5a43", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-7r86-cg39-jmmj"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8e951b0e56d9d24d", "level": "error", "message": {"text": "Vulnerable dependency minimatch 9.0.5: GHSA-23c5-xmqv-rm74"}, "properties": {"repobilityId": "3879836d3d26f667", "scanner": "scanner-primary", "fingerprint": "8e951b0e56d9d24d", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-23c5-xmqv-rm74"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9c9c43733733335d", "level": "error", "message": {"text": "Vulnerable dependency minimatch 9.0.5: GHSA-3ppc-4f35-3m26"}, "properties": {"repobilityId": "3dc5c8f5e4159f29", "scanner": "scanner-primary", "fingerprint": "9c9c43733733335d", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-3ppc-4f35-3m26"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-503705cb1d1abb6a", "level": "error", "message": {"text": "Vulnerable dependency minimatch 9.0.5: GHSA-7r86-cg39-jmmj"}, "properties": {"repobilityId": "76439b7ceb6791cb", "scanner": "scanner-primary", "fingerprint": "503705cb1d1abb6a", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-7r86-cg39-jmmj"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9b93b01792761f90", "level": "warning", "message": {"text": "Vulnerable dependency svelte 5.0.0: GHSA-crpf-4hrx-3jrp"}, "properties": {"repobilityId": "d58956f2eff76b8c", "scanner": "scanner-primary", "fingerprint": "9b93b01792761f90", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-crpf-4hrx-3jrp", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "harper-desktop/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-183c94558d7cde45", "level": "warning", "message": {"text": "Vulnerable dependency svelte 5.0.0: GHSA-f7gr-6p89-r883"}, "properties": {"repobilityId": "7c7087d651dfab54", "scanner": "scanner-primary", "fingerprint": "183c94558d7cde45", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-f7gr-6p89-r883", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "harper-desktop/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a94dc7752bf1aac6", "level": "warning", "message": {"text": "Vulnerable dependency svelte 5.0.0: GHSA-m56q-vw4c-c2cp"}, "properties": {"repobilityId": "c4c365c55b2ffaf5", "scanner": "scanner-primary", "fingerprint": "a94dc7752bf1aac6", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-m56q-vw4c-c2cp", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "harper-desktop/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2983a635204a7b23", "level": "warning", "message": {"text": "Vulnerable dependency svelte 5.0.0: GHSA-phwv-c562-gvmh"}, "properties": {"repobilityId": "0192ec8017a08457", "scanner": "scanner-primary", "fingerprint": "2983a635204a7b23", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-phwv-c562-gvmh", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "harper-desktop/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7fddb1e043ad2b44", "level": "warning", "message": {"text": "Vulnerable dependency svelte 5.0.0: GHSA-pr6f-5x2q-rwfp"}, "properties": {"repobilityId": "24b631c44d1d986f", "scanner": "scanner-primary", "fingerprint": "7fddb1e043ad2b44", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-pr6f-5x2q-rwfp", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "harper-desktop/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ef0c8298d1a7bce8", "level": "warning", "message": {"text": "Vulnerable dependency svelte 5.0.0: GHSA-rcqx-6q8c-2c42"}, "properties": {"repobilityId": "43ea2277ecad1f98", "scanner": "scanner-primary", "fingerprint": "ef0c8298d1a7bce8", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-rcqx-6q8c-2c42", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "harper-desktop/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d5705e9b058894c9", "level": "warning", "message": {"text": "Vulnerable dependency vite 6.0.3: GHSA-356w-63v5-8wf4"}, "properties": {"repobilityId": "56768d81cf397145", "scanner": "scanner-primary", "fingerprint": "d5705e9b058894c9", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-356w-63v5-8wf4", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "harper-desktop/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3deda3cd0b18c097", "level": "warning", "message": {"text": "Vulnerable dependency vite 6.0.3: GHSA-4r4m-qw57-chr8"}, "properties": {"repobilityId": "04622d0b18d66964", "scanner": "scanner-primary", "fingerprint": "3deda3cd0b18c097", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-4r4m-qw57-chr8", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "harper-desktop/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a2f2b9a3bba4eb94", "level": "warning", "message": {"text": "Vulnerable dependency vite 6.0.3: GHSA-4w7w-66w2-5vf9"}, "properties": {"repobilityId": "550284960c823177", "scanner": "scanner-primary", "fingerprint": "a2f2b9a3bba4eb94", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-4w7w-66w2-5vf9", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "harper-desktop/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-77af4072b0b8ae44", "level": "warning", "message": {"text": "Vulnerable dependency vite 6.0.3: GHSA-859w-5945-r5v3"}, "properties": {"repobilityId": "9ca405bcff604e37", "scanner": "scanner-primary", "fingerprint": "77af4072b0b8ae44", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-859w-5945-r5v3", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "harper-desktop/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-205eeb624af409cd", "level": "warning", "message": {"text": "Vulnerable dependency vite 6.0.3: GHSA-93m4-6634-74q7"}, "properties": {"repobilityId": "df8619d92a88b6c8", "scanner": "scanner-primary", "fingerprint": "205eeb624af409cd", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-93m4-6634-74q7", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "harper-desktop/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-800b1df197d1d485", "level": "error", "message": {"text": "Vulnerable dependency vite 6.0.3: GHSA-fx2h-pf6j-xcff"}, "properties": {"repobilityId": "00c9373acc9a4a66", "scanner": "scanner-primary", "fingerprint": "800b1df197d1d485", "layer": "dependencies", "severity": "high", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-fx2h-pf6j-xcff", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "harper-desktop/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4698cb911178c35d", "level": "note", "message": {"text": "Vulnerable dependency vite 6.0.3: GHSA-g4jq-h2w9-997c"}, "properties": {"repobilityId": "b5dcd76618011d20", "scanner": "scanner-primary", "fingerprint": "4698cb911178c35d", "layer": "dependencies", "severity": "low", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-g4jq-h2w9-997c", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "harper-desktop/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-960349129d8d9632", "level": "note", "message": {"text": "Vulnerable dependency vite 6.0.3: GHSA-jqfw-vq24-v9c3"}, "properties": {"repobilityId": "7f6c89fcc02c54ae", "scanner": "scanner-primary", "fingerprint": "960349129d8d9632", "layer": "dependencies", "severity": "low", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-jqfw-vq24-v9c3", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "harper-desktop/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2dd4b59048ece9b8", "level": "error", "message": {"text": "Vulnerable dependency vite 6.0.3: GHSA-p9ff-h696-f583"}, "properties": {"repobilityId": "8fb9a777fb4c30c4", "scanner": "scanner-primary", "fingerprint": "2dd4b59048ece9b8", "layer": "dependencies", "severity": "high", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-p9ff-h696-f583", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "harper-desktop/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f681f212cde7f3b8", "level": "warning", "message": {"text": "Vulnerable dependency vite 6.0.3: GHSA-v6wh-96g9-6wx3"}, "properties": {"repobilityId": "a94740714853a629", "scanner": "scanner-primary", "fingerprint": "f681f212cde7f3b8", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-v6wh-96g9-6wx3", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "harper-desktop/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-36390ade96e987c6", "level": "warning", "message": {"text": "Vulnerable dependency vite 6.0.3: GHSA-vg6x-rcgg-rjx6"}, "properties": {"repobilityId": "26c5582e0f9dcb80", "scanner": "scanner-primary", "fingerprint": "36390ade96e987c6", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-vg6x-rcgg-rjx6", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "harper-desktop/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1d1a22ae3e26c126", "level": "warning", "message": {"text": "Vulnerable dependency vite 6.0.3: GHSA-x574-m823-4x7w"}, "properties": {"repobilityId": "75020d7eb9a96d61", "scanner": "scanner-primary", "fingerprint": "1d1a22ae3e26c126", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-x574-m823-4x7w", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "harper-desktop/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2a58d0d0849b5195", "level": "warning", "message": {"text": "Vulnerable dependency vite 6.0.3: GHSA-xcj6-pq6g-qj4x"}, "properties": {"repobilityId": "9c00b79ce0b21a06", "scanner": "scanner-primary", "fingerprint": "2a58d0d0849b5195", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-xcj6-pq6g-qj4x", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "harper-desktop/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-53ce4c71398fbd4a", "level": "warning", "message": {"text": "Vulnerable dependency vite 5.4.10: GHSA-356w-63v5-8wf4"}, "properties": {"repobilityId": "df7322063ea18c49", "scanner": "scanner-primary", "fingerprint": "53ce4c71398fbd4a", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-356w-63v5-8wf4", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/chrome-plugin/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-05091a532d68d311", "level": "warning", "message": {"text": "Vulnerable dependency vite 5.4.10: GHSA-4r4m-qw57-chr8"}, "properties": {"repobilityId": "49141106f2e0914e", "scanner": "scanner-primary", "fingerprint": "05091a532d68d311", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-4r4m-qw57-chr8", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/chrome-plugin/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c9898f55fcb9cd97", "level": "warning", "message": {"text": "Vulnerable dependency vite 5.4.10: GHSA-4w7w-66w2-5vf9"}, "properties": {"repobilityId": "0f159b0ccc2b9a85", "scanner": "scanner-primary", "fingerprint": "c9898f55fcb9cd97", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-4w7w-66w2-5vf9", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/chrome-plugin/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a3e42f932c9a87cb", "level": "warning", "message": {"text": "Vulnerable dependency vite 5.4.10: GHSA-859w-5945-r5v3"}, "properties": {"repobilityId": "f261fd172f77206a", "scanner": "scanner-primary", "fingerprint": "a3e42f932c9a87cb", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-859w-5945-r5v3", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/chrome-plugin/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ea4321fb04539e35", "level": "warning", "message": {"text": "Vulnerable dependency vite 5.4.10: GHSA-93m4-6634-74q7"}, "properties": {"repobilityId": "b871b331bd3189ce", "scanner": "scanner-primary", "fingerprint": "ea4321fb04539e35", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-93m4-6634-74q7", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/chrome-plugin/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-922f3d02c78c45e1", "level": "error", "message": {"text": "Vulnerable dependency vite 5.4.10: GHSA-fx2h-pf6j-xcff"}, "properties": {"repobilityId": "849cf8a5dbebca74", "scanner": "scanner-primary", "fingerprint": "922f3d02c78c45e1", "layer": "dependencies", "severity": "high", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-fx2h-pf6j-xcff", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/chrome-plugin/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-48f771d23c9cf567", "level": "note", "message": {"text": "Vulnerable dependency vite 5.4.10: GHSA-g4jq-h2w9-997c"}, "properties": {"repobilityId": "0813d417dedac0c5", "scanner": "scanner-primary", "fingerprint": "48f771d23c9cf567", "layer": "dependencies", "severity": "low", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-g4jq-h2w9-997c", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/chrome-plugin/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1f541e479755832a", "level": "note", "message": {"text": "Vulnerable dependency vite 5.4.10: GHSA-jqfw-vq24-v9c3"}, "properties": {"repobilityId": "3133f16d2a71ed6d", "scanner": "scanner-primary", "fingerprint": "1f541e479755832a", "layer": "dependencies", "severity": "low", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-jqfw-vq24-v9c3", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/chrome-plugin/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ec9c1a95996cbbd4", "level": "warning", "message": {"text": "Vulnerable dependency vite 5.4.10: GHSA-v6wh-96g9-6wx3"}, "properties": {"repobilityId": "de8f5191c532e27d", "scanner": "scanner-primary", "fingerprint": "ec9c1a95996cbbd4", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-v6wh-96g9-6wx3", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/chrome-plugin/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f835997b262ae834", "level": "warning", "message": {"text": "Vulnerable dependency vite 5.4.10: GHSA-vg6x-rcgg-rjx6"}, "properties": {"repobilityId": "02c27c8588ed45ef", "scanner": "scanner-primary", "fingerprint": "f835997b262ae834", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-vg6x-rcgg-rjx6", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/chrome-plugin/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-361ba0b4c5347127", "level": "warning", "message": {"text": "Vulnerable dependency vite 5.4.10: GHSA-x574-m823-4x7w"}, "properties": {"repobilityId": "62d0ff955e23f4fc", "scanner": "scanner-primary", "fingerprint": "361ba0b4c5347127", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-x574-m823-4x7w", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/chrome-plugin/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e863ac2241a6d362", "level": "warning", "message": {"text": "Vulnerable dependency vite 5.4.10: GHSA-xcj6-pq6g-qj4x"}, "properties": {"repobilityId": "8958acc36a12c5ea", "scanner": "scanner-primary", "fingerprint": "e863ac2241a6d362", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-xcj6-pq6g-qj4x", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/chrome-plugin/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5432f6b231c8a27c", "level": "warning", "message": {"text": "Vulnerable dependency svelte 5.41.0: GHSA-crpf-4hrx-3jrp"}, "properties": {"repobilityId": "9a4a453201d33148", "scanner": "scanner-primary", "fingerprint": "5432f6b231c8a27c", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-crpf-4hrx-3jrp", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/components/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-28439efde3dc4246", "level": "warning", "message": {"text": "Vulnerable dependency svelte 5.41.0: GHSA-f7gr-6p89-r883"}, "properties": {"repobilityId": "2c28622b7cf07631", "scanner": "scanner-primary", "fingerprint": "28439efde3dc4246", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-f7gr-6p89-r883", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/components/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-06b36164f2c2be2d", "level": "warning", "message": {"text": "Vulnerable dependency svelte 5.41.0: GHSA-h7h7-mm68-gmrc"}, "properties": {"repobilityId": "32b7a76effa232f5", "scanner": "scanner-primary", "fingerprint": "06b36164f2c2be2d", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-h7h7-mm68-gmrc", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/components/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-00badf488cdafa5f", "level": "warning", "message": {"text": "Vulnerable dependency svelte 5.41.0: GHSA-m56q-vw4c-c2cp"}, "properties": {"repobilityId": "533cf564fbd6c114", "scanner": "scanner-primary", "fingerprint": "00badf488cdafa5f", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-m56q-vw4c-c2cp", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/components/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a7d7c6c73e6f262f", "level": "warning", "message": {"text": "Vulnerable dependency svelte 5.41.0: GHSA-phwv-c562-gvmh"}, "properties": {"repobilityId": "b379963f12d224b8", "scanner": "scanner-primary", "fingerprint": "a7d7c6c73e6f262f", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-phwv-c562-gvmh", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/components/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-193d7d802956cf3a", "level": "warning", "message": {"text": "Vulnerable dependency svelte 5.41.0: GHSA-pr6f-5x2q-rwfp"}, "properties": {"repobilityId": "e7be3196c83f338d", "scanner": "scanner-primary", "fingerprint": "193d7d802956cf3a", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-pr6f-5x2q-rwfp", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/components/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e1eba50e01b9f478", "level": "warning", "message": {"text": "Vulnerable dependency svelte 5.41.0: GHSA-rcqx-6q8c-2c42"}, "properties": {"repobilityId": "8d485f4735ab3017", "scanner": "scanner-primary", "fingerprint": "e1eba50e01b9f478", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-rcqx-6q8c-2c42", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/components/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c8ef85d46ab997d6", "level": "warning", "message": {"text": "Vulnerable dependency vite 7.1.10: GHSA-4w7w-66w2-5vf9"}, "properties": {"repobilityId": "1714045bcc33e238", "scanner": "scanner-primary", "fingerprint": "c8ef85d46ab997d6", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-4w7w-66w2-5vf9", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/components/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1fbbab4c903542fe", "level": "warning", "message": {"text": "Vulnerable dependency vite 7.1.10: GHSA-93m4-6634-74q7"}, "properties": {"repobilityId": "9b3e175aaef71ec1", "scanner": "scanner-primary", "fingerprint": "1fbbab4c903542fe", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-93m4-6634-74q7", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/components/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7cda7e3e9c9e4ef3", "level": "error", "message": {"text": "Vulnerable dependency vite 7.1.10: GHSA-fx2h-pf6j-xcff"}, "properties": {"repobilityId": "bec3bafce368bc24", "scanner": "scanner-primary", "fingerprint": "7cda7e3e9c9e4ef3", "layer": "dependencies", "severity": "high", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-fx2h-pf6j-xcff", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/components/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9a7b187706d83313", "level": "error", "message": {"text": "Vulnerable dependency vite 7.1.10: GHSA-p9ff-h696-f583"}, "properties": {"repobilityId": "d45673f77f45f336", "scanner": "scanner-primary", "fingerprint": "9a7b187706d83313", "layer": "dependencies", "severity": "high", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-p9ff-h696-f583", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/components/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-71289d45d087f312", "level": "warning", "message": {"text": "Vulnerable dependency vite 7.1.10: GHSA-v2wj-q39q-566r"}, "properties": {"repobilityId": "cadb123a745f50ac", "scanner": "scanner-primary", "fingerprint": "71289d45d087f312", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-v2wj-q39q-566r", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/components/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a848c12e7509a721", "level": "warning", "message": {"text": "Vulnerable dependency vite 7.1.10: GHSA-v6wh-96g9-6wx3"}, "properties": {"repobilityId": "27b458b4d3223436", "scanner": "scanner-primary", "fingerprint": "a848c12e7509a721", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-v6wh-96g9-6wx3", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/components/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f3d9a68decee1bee", "level": "warning", "message": {"text": "Vulnerable dependency quill 2.0.3: GHSA-v3m3-f69x-jf25"}, "properties": {"repobilityId": "e5ee531fac8ca248", "scanner": "scanner-primary", "fingerprint": "f3d9a68decee1bee", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-v3m3-f69x-jf25", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/harper-editor/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2762c1fd931ec4b1", "level": "warning", "message": {"text": "Vulnerable dependency vite 6.1.0: GHSA-356w-63v5-8wf4"}, "properties": {"repobilityId": "a5bbb7850e382770", "scanner": "scanner-primary", "fingerprint": "2762c1fd931ec4b1", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-356w-63v5-8wf4", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/harper.js/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-64c6a3504a3931c9", "level": "warning", "message": {"text": "Vulnerable dependency vite 6.1.0: GHSA-4r4m-qw57-chr8"}, "properties": {"repobilityId": "df654dd8915206fa", "scanner": "scanner-primary", "fingerprint": "64c6a3504a3931c9", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-4r4m-qw57-chr8", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/harper.js/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cfd9c4dda8da1737", "level": "warning", "message": {"text": "Vulnerable dependency vite 6.1.0: GHSA-4w7w-66w2-5vf9"}, "properties": {"repobilityId": "e3d19074ac4e855e", "scanner": "scanner-primary", "fingerprint": "cfd9c4dda8da1737", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-4w7w-66w2-5vf9", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/harper.js/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-60ad12755bb52ef1", "level": "warning", "message": {"text": "Vulnerable dependency vite 6.1.0: GHSA-859w-5945-r5v3"}, "properties": {"repobilityId": "2487c44a3d551d26", "scanner": "scanner-primary", "fingerprint": "60ad12755bb52ef1", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-859w-5945-r5v3", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/harper.js/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d4affbb61f87d513", "level": "warning", "message": {"text": "Vulnerable dependency vite 6.1.0: GHSA-93m4-6634-74q7"}, "properties": {"repobilityId": "5fe0e6ca2acebaa5", "scanner": "scanner-primary", "fingerprint": "d4affbb61f87d513", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-93m4-6634-74q7", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/harper.js/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0bae5b54119ae067", "level": "error", "message": {"text": "Vulnerable dependency vite 6.1.0: GHSA-fx2h-pf6j-xcff"}, "properties": {"repobilityId": "4e08ccdd2f1c4b8d", "scanner": "scanner-primary", "fingerprint": "0bae5b54119ae067", "layer": "dependencies", "severity": "high", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-fx2h-pf6j-xcff", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/harper.js/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b2e38b924f162007", "level": "note", "message": {"text": "Vulnerable dependency vite 6.1.0: GHSA-g4jq-h2w9-997c"}, "properties": {"repobilityId": "80b11b353493a06b", "scanner": "scanner-primary", "fingerprint": "b2e38b924f162007", "layer": "dependencies", "severity": "low", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-g4jq-h2w9-997c", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/harper.js/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-baf6beeda7cc25cb", "level": "note", "message": {"text": "Vulnerable dependency vite 6.1.0: GHSA-jqfw-vq24-v9c3"}, "properties": {"repobilityId": "e3a7194a2c14a7d3", "scanner": "scanner-primary", "fingerprint": "baf6beeda7cc25cb", "layer": "dependencies", "severity": "low", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-jqfw-vq24-v9c3", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/harper.js/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e26da22a7fc8777e", "level": "error", "message": {"text": "Vulnerable dependency vite 6.1.0: GHSA-p9ff-h696-f583"}, "properties": {"repobilityId": "a6adbba1771cfaa5", "scanner": "scanner-primary", "fingerprint": "e26da22a7fc8777e", "layer": "dependencies", "severity": "high", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-p9ff-h696-f583", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/harper.js/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4dddc5f9b08c5483", "level": "warning", "message": {"text": "Vulnerable dependency vite 6.1.0: GHSA-v6wh-96g9-6wx3"}, "properties": {"repobilityId": "795ce1fe4e361031", "scanner": "scanner-primary", "fingerprint": "4dddc5f9b08c5483", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-v6wh-96g9-6wx3", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/harper.js/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-74bda95750eca852", "level": "warning", "message": {"text": "Vulnerable dependency vite 6.1.0: GHSA-x574-m823-4x7w"}, "properties": {"repobilityId": "89b222c1836255b8", "scanner": "scanner-primary", "fingerprint": "74bda95750eca852", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-x574-m823-4x7w", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/harper.js/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1a6b0cbffa80753b", "level": "warning", "message": {"text": "Vulnerable dependency vite 6.1.0: GHSA-xcj6-pq6g-qj4x"}, "properties": {"repobilityId": "a93295a12db0230e", "scanner": "scanner-primary", "fingerprint": "1a6b0cbffa80753b", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-xcj6-pq6g-qj4x", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/harper.js/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-574f2c00956186c7", "level": "warning", "message": {"text": "Vulnerable dependency vitest 4.0.16: GHSA-5xrq-8626-4rwp"}, "properties": {"repobilityId": "eeef05223d811bb0", "scanner": "scanner-primary", "fingerprint": "574f2c00956186c7", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-5xrq-8626-4rwp", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/harper.js/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f65438052df9f8cc", "level": "warning", "message": {"text": "Vulnerable dependency vite 6.3.5: GHSA-4w7w-66w2-5vf9"}, "properties": {"repobilityId": "2ab463e8450d8b48", "scanner": "scanner-primary", "fingerprint": "f65438052df9f8cc", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-4w7w-66w2-5vf9", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/obsidian-plugin/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2b038b949935fdf1", "level": "warning", "message": {"text": "Vulnerable dependency vite 6.3.5: GHSA-93m4-6634-74q7"}, "properties": {"repobilityId": "e7c1485156dd47b7", "scanner": "scanner-primary", "fingerprint": "2b038b949935fdf1", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-93m4-6634-74q7", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/obsidian-plugin/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-79ea9b26af7aef66", "level": "error", "message": {"text": "Vulnerable dependency vite 6.3.5: GHSA-fx2h-pf6j-xcff"}, "properties": {"repobilityId": "329b6b3287b01415", "scanner": "scanner-primary", "fingerprint": "79ea9b26af7aef66", "layer": "dependencies", "severity": "high", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-fx2h-pf6j-xcff", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/obsidian-plugin/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4765a0b06a075196", "level": "note", "message": {"text": "Vulnerable dependency vite 6.3.5: GHSA-g4jq-h2w9-997c"}, "properties": {"repobilityId": "2c068265c3935c4a", "scanner": "scanner-primary", "fingerprint": "4765a0b06a075196", "layer": "dependencies", "severity": "low", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-g4jq-h2w9-997c", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/obsidian-plugin/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c6b9131697ba07ad", "level": "note", "message": {"text": "Vulnerable dependency vite 6.3.5: GHSA-jqfw-vq24-v9c3"}, "properties": {"repobilityId": "33e5fe48fada6ea6", "scanner": "scanner-primary", "fingerprint": "c6b9131697ba07ad", "layer": "dependencies", "severity": "low", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-jqfw-vq24-v9c3", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/obsidian-plugin/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-62c30f39347c03cf", "level": "error", "message": {"text": "Vulnerable dependency vite 6.3.5: GHSA-p9ff-h696-f583"}, "properties": {"repobilityId": "eec867d958264465", "scanner": "scanner-primary", "fingerprint": "62c30f39347c03cf", "layer": "dependencies", "severity": "high", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-p9ff-h696-f583", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/obsidian-plugin/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-72a254e8116d7ff9", "level": "warning", "message": {"text": "Vulnerable dependency vite 6.3.5: GHSA-v6wh-96g9-6wx3"}, "properties": {"repobilityId": "076b1a0ff43b915b", "scanner": "scanner-primary", "fingerprint": "72a254e8116d7ff9", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-v6wh-96g9-6wx3", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/obsidian-plugin/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6a303133e5be96df", "level": "warning", "message": {"text": "Vulnerable dependency svelte 5.15.0: GHSA-crpf-4hrx-3jrp"}, "properties": {"repobilityId": "af7f0cb13c4fe697", "scanner": "scanner-primary", "fingerprint": "6a303133e5be96df", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-crpf-4hrx-3jrp", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/web/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7538f13c49e6c87f", "level": "warning", "message": {"text": "Vulnerable dependency svelte 5.15.0: GHSA-f7gr-6p89-r883"}, "properties": {"repobilityId": "221ff3d9d7ad097b", "scanner": "scanner-primary", "fingerprint": "7538f13c49e6c87f", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-f7gr-6p89-r883", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/web/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-468499255da0441b", "level": "warning", "message": {"text": "Vulnerable dependency svelte 5.15.0: GHSA-m56q-vw4c-c2cp"}, "properties": {"repobilityId": "afa8d68e01c9cd60", "scanner": "scanner-primary", "fingerprint": "468499255da0441b", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-m56q-vw4c-c2cp", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/web/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-94c1a5f585bdc10b", "level": "warning", "message": {"text": "Vulnerable dependency svelte 5.15.0: GHSA-phwv-c562-gvmh"}, "properties": {"repobilityId": "f358d265042db008", "scanner": "scanner-primary", "fingerprint": "94c1a5f585bdc10b", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-phwv-c562-gvmh", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/web/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bd5c7614f11ac5d7", "level": "warning", "message": {"text": "Vulnerable dependency svelte 5.15.0: GHSA-pr6f-5x2q-rwfp"}, "properties": {"repobilityId": "c69086bc06ba6c79", "scanner": "scanner-primary", "fingerprint": "bd5c7614f11ac5d7", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-pr6f-5x2q-rwfp", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/web/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-816ed9beec52f4d8", "level": "warning", "message": {"text": "Vulnerable dependency svelte 5.15.0: GHSA-rcqx-6q8c-2c42"}, "properties": {"repobilityId": "e38f15f95b3355a0", "scanner": "scanner-primary", "fingerprint": "816ed9beec52f4d8", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-rcqx-6q8c-2c42", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/web/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c4ac8e6d271c9885", "level": "warning", "message": {"text": "Vulnerable dependency atk 0.18.2: RUSTSEC-2024-0413"}, "properties": {"repobilityId": "e8b78fb4e93005a6", "scanner": "scanner-primary", "fingerprint": "c4ac8e6d271c9885", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "RUSTSEC-2024-0413", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Cargo.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-842c917ae827e02e", "level": "warning", "message": {"text": "Vulnerable dependency atk-sys 0.18.2: RUSTSEC-2024-0416"}, "properties": {"repobilityId": "ac1b3966bac55e1d", "scanner": "scanner-primary", "fingerprint": "842c917ae827e02e", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "RUSTSEC-2024-0416", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Cargo.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1134105a662ae9d6", "level": "warning", "message": {"text": "Vulnerable dependency bincode 2.0.1: RUSTSEC-2025-0141"}, "properties": {"repobilityId": "fa498b34417b942b", "scanner": "scanner-primary", "fingerprint": "1134105a662ae9d6", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "RUSTSEC-2025-0141", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Cargo.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1395070335461b7b", "level": "warning", "message": {"text": "Vulnerable dependency crossbeam-epoch 0.9.18: RUSTSEC-2026-0204"}, "properties": {"repobilityId": "6ea139e316193f24", "scanner": "scanner-primary", "fingerprint": "1395070335461b7b", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "RUSTSEC-2026-0204", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Cargo.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b9694ff8993cfc5f", "level": "warning", "message": {"text": "Dependency cached is two or more major versions behind"}, "properties": {"repobilityId": "05ae6236252af620", "scanner": "scanner-primary", "fingerprint": "b9694ff8993cfc5f", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "harper-core/Cargo.toml"}, "region": {"startLine": 1}}}]}]}]}