{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-9471fa0b9eb8e1c9", "name": "math random used \u2014 internal/agent/retry.go:6", "shortDescription": {"text": "math random used \u2014 internal/agent/retry.go:6"}, "fullDescription": {"text": "Do not use `math/rand`. Use `crypto/rand` instead.\n\nRule: go.lang.security.audit.crypto.math_random.math-random-used\nSeverity: WARNING\nOWASP: A02:2021 - Cryptographic Failures, A04:2025 - Cryptographic Failures\nCWE: CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-72d5485e17af88ce", "name": "use of unsafe block \u2014 internal/e2edaemon/process_windows.go:37", "shortDescription": {"text": "use of unsafe block \u2014 internal/e2edaemon/process_windows.go:37"}, "fullDescription": {"text": "Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you're doing.\n\nRule: go.lang.security.audit.unsafe.use-of-unsafe-block\nSeverity: WARNING\nOWASP: \u2014\nCWE: CWE-242: Use of Inherently Dangerous Function\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-b00277ee1c03493f", "name": "use of unsafe block \u2014 internal/shellenv/shell_command_windows.go:165", "shortDescription": {"text": "use of unsafe block \u2014 internal/shellenv/shell_command_windows.go:165"}, "fullDescription": {"text": "Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you're doing.\n\nRule: go.lang.security.audit.unsafe.use-of-unsafe-block\nSeverity: WARNING\nOWASP: \u2014\nCWE: CWE-242: Use of Inherently Dangerous Function\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-2f0952e5222e2de3", "name": "use of unsafe block \u2014 internal/update/process_path_windows.go:27", "shortDescription": {"text": "use of unsafe block \u2014 internal/update/process_path_windows.go:27"}, "fullDescription": {"text": "Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you're doing.\n\nRule: go.lang.security.audit.unsafe.use-of-unsafe-block\nSeverity: WARNING\nOWASP: \u2014\nCWE: CWE-242: Use of Inherently Dangerous Function\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-05c0c25786dac66e", "name": "CVE-2026-50146: astro 5.18.1 \u2014 docs/package-lock.json", "shortDescription": {"text": "CVE-2026-50146: astro 5.18.1 \u2014 docs/package-lock.json"}, "fullDescription": {"text": "Astro: Reflected XSS via unescaped slot name\n\nAstro is a web framework. Prior to 6.3.3, when a component uses a client:* directive, Astro inserts named slot content into a data-astro-template attribute without HTML escaping the slot name allowing an attacker to break out of the attribute context and inject arbitrary HTML, resulting in reflected XSS during SSR. This vulnerability is fixed in 6.3.3.\n\nPackage: astro\nInstalled: 5.18.1\nFixed in: 6.3.3\nSeverity: HIGH\nFix: Upgrade astro to 6.3.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7bfb3e5c1bd60b35", "name": "CVE-2026-54299: astro 5.18.1 \u2014 docs/package-lock.json", "shortDescription": {"text": "CVE-2026-54299: astro 5.18.1 \u2014 docs/package-lock.json"}, "fullDescription": {"text": "Astro: Host header SSRF in prerendered error page fetch\n\nAstro is a web framework. Prior to 6.4.6, Astro SSR apps with prerendered error pages (/404 or /500 using export const prerender = true) fetch those pages over HTTP at runtime when an error occurs. The URL for this fetch is derived from request.url, which in turn gets its origin from the incoming Host header. When the Host header is not validated against allowedDomains, an attacker can point the fetch at an arbitrary host and read the response. This vulnerability is fixed in 6.4.6.\n\nPackage: astro\nInstalled: 5.18.1\nFixed in: 6.4.6\nSeverity: HIGH\nFix: Upgrade astro to 6.4.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4e730f2dc969ab8b", "name": "CVE-2026-41067: astro 5.18.1 \u2014 docs/package-lock.json", "shortDescription": {"text": "CVE-2026-41067: astro 5.18.1 \u2014 docs/package-lock.json"}, "fullDescription": {"text": "Astro: XSS in define:vars via incomplete </script> tag sanitization\n\nAstro is a web framework. Prior to 6.1.6, the defineScriptVars function in Astro's server-side rendering pipeline uses a case-sensitive regex /<\\/script>/g to sanitize values injected into inline <script> tags via the define:vars directive. HTML parsers close <script> elements case-insensitively and also accept whitespace or / before the closing >, allowing an attacker to bypass the sanitization with payloads like </Script>, </script >, or </script/> and inject arbitrary HTML/JavaScript. This vu\n\nPackage: astro\nInstalled: 5.18.1\nFixed in: 6.1.6\nSeverity: MEDIUM\nFix: Upgrade astro to 6.1.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-49c7a5e1aba3c547", "name": "CVE-2026-54298: astro 5.18.1 \u2014 docs/package-lock.json", "shortDescription": {"text": "CVE-2026-54298: astro 5.18.1 \u2014 docs/package-lock.json"}, "fullDescription": {"text": "Astro: XSS via Unescaped Attribute Names in Spread Props\n\nAstro is a web framework. Prior to 6.4.6, the spreadAttributes function in Astro's server-side rendering pipeline iterates over object keys and passes them directly to addAttribute, which interpolates the key into the HTML output without escaping. When a developer uses the spread syntax {...props} on an HTML element and the object keys come from an untrusted source (API, CMS, URL parameters), an attacker can inject arbitrary HTML attributes including event handlers like onmousemove, onclick, or \n\nPackage: astro\nInstalled: 5.18.1\nFixed in: 6.4.6\nSeverity: MEDIUM\nFix: Upgrade astro to 6.4.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-49bbcace3cd55e2b", "name": "CVE-2026-59729: astro 5.18.1 \u2014 docs/package-lock.json", "shortDescription": {"text": "CVE-2026-59729: astro 5.18.1 \u2014 docs/package-lock.json"}, "fullDescription": {"text": "Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)\n\n## Summary\n\nThe fix for CVE-2026-54298 (GHSA-jrpj-wcv7-9fh9) added an `INVALID_ATTR_NAME_CHAR` guard to `addAttribute()` so that spread-prop attribute names containing `\"' >/=` or whitespace are dropped. A second attribute-rendering path, `renderHTMLElement()` in `packages/astro/src/runtime/server/render/dom.ts`, has its own inline attribute loop that does not go through `addAttribute()` and was not updated. It interpolates the attribute name unescaped and only escapes the value, so untrusted pr\n\nPackage: astro\nInstalled: 5.18.1\nFixed in: 7.0.6\nSeverity: MEDIUM\nFix: Upgrade astro to 7.0.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d81c5b9c8bd90dbe", "name": "GHSA-4g3v-8h47-v7g6: astro 5.18.1 \u2014 docs/package-lock.json", "shortDescription": {"text": "GHSA-4g3v-8h47-v7g6: astro 5.18.1 \u2014 docs/package-lock.json"}, "fullDescription": {"text": "Astro: Reflected XSS via unescaped View Transition animation properties\n\n## Summary\n\nAstro's server-side View Transition CSS generator interpolates animation properties into an inline `<style>` element without escaping them for the CSS and HTML contexts.\n\nAn attacker-controlled value passed to an animation property such as `duration` can contain a `</style>` sequence, terminate the generated style element, and inject arbitrary HTML or JavaScript.\n\nThis is similar to GHSA-8hv8-536x-4wqp, but exploits a different injection point: unescaped View Transition animation val\n\nPackage: astro\nInstalled: 5.18.1\nFixed in: 7.1.0\nSeverity: MEDIUM\nFix: Upgrade astro to 7.1.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5a88e36debdccf79", "name": "CVE-2026-45028: astro 5.18.1 \u2014 docs/package-lock.json", "shortDescription": {"text": "CVE-2026-45028: astro 5.18.1 \u2014 docs/package-lock.json"}, "fullDescription": {"text": "Astro: Server island encrypted parameters vulnerable to cross-component replay\n\nAstro is a web framework. Astro versions prior to 6.1.10 used AES-GCM encryption to protect the confidentiality and integrity of server island props and slots parameters, but did not bind the ciphertext to its intended component or parameter type. An attacker could replay one component's encrypted props (p) value as another component's slots (s) value, or vice versa. Since slots contain raw unescaped HTML while props may contain user-controlled values, this could lead to XSS in applications. Thi\n\nPackage: astro\nInstalled: 5.18.1\nFixed in: 6.1.10\nSeverity: LOW\nFix: Upgrade astro to 6.1.10"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b34b23951b499b4d", "name": "CVE-2026-59727: astro 5.18.1 \u2014 docs/package-lock.json", "shortDescription": {"text": "CVE-2026-59727: astro 5.18.1 \u2014 docs/package-lock.json"}, "fullDescription": {"text": "Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands\n\n### Summary\n\nWhen a `transition:persist`, `transition:scope`, or `transition:persist-props` directive is applied to a client-hydrated (`client:*`) component, Astro copied the directive value onto the rendered `<astro-island>` element **without HTML-escaping it**. If a developer reflects attacker-controlled input into one of these directives, an attacker can break out of the attribute and inject arbitrary HTML/JavaScript into the server-rendered output, resulting in reflected cross-site scripting\n\nPackage: astro\nInstalled: 5.18.1\nFixed in: 7.0.4\nSeverity: LOW\nFix: Upgrade astro to 7.0.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5125da4d47470d6c", "name": "CVE-2026-42570: devalue 5.7.1 \u2014 docs/package-lock.json", "shortDescription": {"text": "CVE-2026-42570: devalue 5.7.1 \u2014 docs/package-lock.json"}, "fullDescription": {"text": "devalue: devalue: Excessive memory consumption via deserialization of sparse arrays\n\nSvelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From version 5.6.3 to before version 5.8.1, devalue.parse could, due to quirks in some JavaScript engines, be convinced to allocate much more memory than was needed when deserializing sparse arrays, leading to excessive memory consumption. This issue has been patched in version 5.8.1.\n\nPackage: devalue\nInstalled: 5.7.1\nFixed in: 5.8.1\nSeverity: HIGH\nFix: Upgrade devalue to 5.8.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e50bec00707eccf2", "name": "CVE-2026-49458: dompurify 3.4.0 \u2014 docs/package-lock.json", "shortDescription": {"text": "CVE-2026-49458: dompurify 3.4.0 \u2014 docs/package-lock.json"}, "fullDescription": {"text": "dompurify: DOMPurify: Cross-site scripting due to improper sanitization of DOM nodes\n\nDOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(node, { IN_PLACE: true }) accepted same-origin foreign-realm DOM nodes while follow-on checks used parent-realm constructors, causing instanceof checks for forms, named node maps, document fragments, and elements to fail and skip clobber, template-content, and shadow-DOM sanitization branches so executable markup could survive. This issue is fixed in version 3.4.6.\n\nPackage: dompurify\nInstalled: 3.4.0\nFixed in: 3.4.6\nSeverity: MEDIUM\nFix: Upgrade dompurify to 3.4.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d528619cdd1cb596", "name": "CVE-2026-49459: dompurify 3.4.0 \u2014 docs/package-lock.json", "shortDescription": {"text": "CVE-2026-49459: dompurify 3.4.0 \u2014 docs/package-lock.json"}, "fullDescription": {"text": "dompurify: DOMPurify: Cross-site scripting bypass allows arbitrary script execution\n\nDOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(root, { IN_PLACE: true }) could preserve event-handler attributes on an attacker-controlled <form> root when a descendant name clobbered properties checked by _isClobbered, because _forceRemove no-opped on the parent-less root and _sanitizeAttributes returned early. This issue is fixed in version 3.4.6.\n\nPackage: dompurify\nInstalled: 3.4.0\nFixed in: 3.4.6\nSeverity: MEDIUM\nFix: Upgrade dompurify to 3.4.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b2a998809cb57bb4", "name": "CVE-2026-49978: dompurify 3.4.0 \u2014 docs/package-lock.json", "shortDescription": {"text": "CVE-2026-49978: dompurify 3.4.0 \u2014 docs/package-lock.json"}, "fullDescription": {"text": "dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution\n\nDOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.7, DOMPurify IN_PLACE sanitization could skip shadow contents attached to an element inside <template>.content, allowing attacker-controlled markup such as event handlers, JavaScript URLs, or scripts to survive and execute when an application cloned and inserted the sanitized template. This issue is fixed in version 3.4.7.\n\nPackage: dompurify\nInstalled: 3.4.0\nFixed in: 3.4.7\nSeverity: MEDIUM\nFix: Upgrade dompurify to 3.4.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c1e9282df4860fdd", "name": "GHSA-76mc-f452-cxcm: dompurify 3.4.0 \u2014 docs/package-lock.json", "shortDescription": {"text": "GHSA-76mc-f452-cxcm: dompurify 3.4.0 \u2014 docs/package-lock.json"}, "fullDescription": {"text": "DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR`\n\n# Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR`\n\n**CWE**: CWE-501 (Trust Boundary Violation \u2014 hook-scoped mutation leaks to global default sets) via CWE-693 (Protection Mechanism Failure \u2014 the default allow-list is silently widened for all subsequent sanitize calls)\n\n## Summary\n\nThe `data.allowedTags` and `data.allowedAttributes` fields passed to `uponSanitizeElement` and `uponSanitizeAttribute` hooks are **dir\n\nPackage: dompurify\nInstalled: 3.4.0\nFixed in: 3.4.7\nSeverity: MEDIUM\nFix: Upgrade dompurify to 3.4.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-078677121b12dc28", "name": "GHSA-cmwh-pvxp-8882: dompurify 3.4.0 \u2014 docs/package-lock.json", "shortDescription": {"text": "GHSA-cmwh-pvxp-8882: dompurify 3.4.0 \u2014 docs/package-lock.json"}, "fullDescription": {"text": "DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)\n\n## Summary\n\nDOMPurify 3.4.7 shipped a security fix (\"permanent hook pollution\") that makes a registered `uponSanitizeAttribute` hook's mutation of `data.allowedAttributes` **non-persistent** \u2014 so allowing an attribute for one element does not leak into later `sanitize()` calls. The fix clones `ALLOWED_ATTR` inside `_parseConfig`.\n\nThat guard is **silently bypassed whenever the application uses the persistent-config API `DOMPurify.setConfig()`.** `setConfig()` sets the module flag `SET_CONFIG = t\n\nPackage: dompurify\nInstalled: 3.4.0\nFixed in: 3.4.11\nSeverity: MEDIUM\nFix: Upgrade dompurify to 3.4.11"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d8c77aa65164a71", "name": "GHSA-c2j3-45gr-mqc4: dompurify 3.4.0 \u2014 docs/package-lock.json", "shortDescription": {"text": "GHSA-c2j3-45gr-mqc4: dompurify 3.4.0 \u2014 docs/package-lock.json"}, "fullDescription": {"text": "DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.\n\n## Summary\n\nThere is a possible hook-policy inconsistency in DOMPurify 3.4.11 involving `CUSTOM_ELEMENT_HANDLING`.\n\nWhen a custom element is allowed via `CUSTOM_ELEMENT_HANDLING.tagNameCheck`, it appears that the element does not go through `afterSanitizeElements` in the same way as a normal element. As a result, an application that relies on `afterSanitizeElements` as a security policy layer to strip sensitive attributes from all elements may see those attributes removed from normal elements bu\n\nPackage: dompurify\nInstalled: 3.4.0\nFixed in: 3.4.12\nSeverity: LOW\nFix: Upgrade dompurify to 3.4.12"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2a7639d17100c885", "name": "GHSA-gvmj-g25r-r7wr: dompurify 3.4.0 \u2014 docs/package-lock.json", "shortDescription": {"text": "GHSA-gvmj-g25r-r7wr: dompurify 3.4.0 \u2014 docs/package-lock.json"}, "fullDescription": {"text": "DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside <template> content when using DOM output modes\n\n## Summary\n\nWhen DOMPurify is configured with both `SAFE_FOR_TEMPLATES: true` and `RETURN_DOM: true` (or `IN_PLACE: true`), an attacker can inject template expressions, such as `${evil}`, `{{evil}}`, or `<%evil%>`, that survive the sanitization pass inside `<template>` element content. This bypasses the explicit purpose of `SAFE_FOR_TEMPLATES`, which is to prevent template engine evaluation of user-supplied content.\n\n> **Note:** The string output path is **not** affected. Only the DOM return pat\n\nPackage: dompurify\nInstalled: 3.4.0\nFixed in: 3.4.8\nSeverity: LOW\nFix: Upgrade dompurify to 3.4.8"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2e30791d46187408", "name": "GHSA-vxr8-fq34-vvx9: dompurify 3.4.0 \u2014 docs/package-lock.json", "shortDescription": {"text": "GHSA-vxr8-fq34-vvx9: dompurify 3.4.0 \u2014 docs/package-lock.json"}, "fullDescription": {"text": "DOMPurify: Trusted Types policy survives `clearConfig()` and can poison later `RETURN_TRUSTED_TYPE` output\n\n## Impact\n\nA DOMPurify instance that is reused across trust boundaries can stay bound to a previously supplied `TRUSTED_TYPES_POLICY` even after `clearConfig()` is called. A later caller that requests `RETURN_TRUSTED_TYPE` receives a `TrustedHTML` object created by the old policy, not by a clean default configuration.\n\nIf the old policy is unsafe or controlled by a less-trusted integration, this turns a later \"default\" sanitize call into script execution at a Trusted Types sink. `TRUSTED_TYPES_P\n\nPackage: dompurify\nInstalled: 3.4.0\nFixed in: 3.4.9\nSeverity: LOW\nFix: Upgrade dompurify to 3.4.9"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4a3ca9a187eb6132", "name": "GHSA-x4vx-rjvf-j5p4: dompurify 3.4.0 \u2014 docs/package-lock.json", "shortDescription": {"text": "GHSA-x4vx-rjvf-j5p4: dompurify 3.4.0 \u2014 docs/package-lock.json"}, "fullDescription": {"text": "DOMPurify: `IN_PLACE` mode trusts attacker-controlled `nodeName` on live non-form nodes, allowing script retention and XSS via attacker-supplied DOM objects\n\n## Summary\n\nWhen `DOMPurify.sanitize(root, { IN_PLACE: true })` is called on an attacker-supplied live DOM node, `DOMPurify` still trusts `currentNode.nodeName` for non-`form` nodes in the main `_sanitizeElements` pipeline. A real `<script>` child node whose observable `nodeName` is attacker-controlled can therefore be misclassified as an allowed element and retained. When the sanitized tree is inserted into a live document, the script executes.\n\nThis affects current `3.4.6`. The recent `IN_PLAC\n\nPackage: dompurify\nInstalled: 3.4.0\nFixed in: \u2014\nSeverity: LOW\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f38ba65e2988efe9", "name": "GHSA-g7r4-m6w7-qqqr: esbuild 0.27.7 \u2014 docs/package-lock.json", "shortDescription": {"text": "GHSA-g7r4-m6w7-qqqr: esbuild 0.27.7 \u2014 docs/package-lock.json"}, "fullDescription": {"text": "esbuild allows arbitrary file read when running the development server on Windows\n\n### Summary\n\nThe development server contains a path traversal vulnerability on Windows when serving files from `servedir`.\n\nDue to the use of `path.Clean()` (which only normalizes forward-slash `/` separators) instead of a Windows-aware path normalization function, it is possible to craft requests using backslashes (`\\`) that bypass the intended directory containment logic. An attacker can escape the configured `servedir` root and access arbitrary files on the filesystem.\nThis issue affects Wind\n\nPackage: esbuild\nInstalled: 0.27.7\nFixed in: 0.28.1\nSeverity: LOW\nFix: Upgrade esbuild to 0.28.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-51bb941c82b607dd", "name": "CVE-2026-59869: js-yaml 4.1.1 \u2014 docs/package-lock.json", "shortDescription": {"text": "CVE-2026-59869: js-yaml 4.1.1 \u2014 docs/package-lock.json"}, "fullDescription": {"text": "js-yaml: js-yaml: Denial of Service via crafted YAML documents\n\njs-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in versions 3.15.0 and 4.3.0.\n\nPackage: js-yaml\nInstalled: 4.1.1\nFixed in: 3.15.0, 4.3.0\nSeverity: HIGH\nFix: Upgrade js-yaml to 3.15.0, 4.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a503bb72aab73e90", "name": "CVE-2026-53550: js-yaml 4.1.1 \u2014 docs/package-lock.json", "shortDescription": {"text": "CVE-2026-53550: js-yaml 4.1.1 \u2014 docs/package-lock.json"}, "fullDescription": {"text": "js-yaml: js-yaml: Denial of Service via crafted YAML merge keys\n\njs-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event loop for seconds with a relatively small payload (tens of KB), resulting in denial of service. The issue is in merge handling inside lib/loader.js. This vulnerabil\n\nPackage: js-yaml\nInstalled: 4.1.1\nFixed in: 4.2.0, 3.15.0\nSeverity: MEDIUM\nFix: Upgrade js-yaml to 4.2.0, 3.15.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bfff82bf549f60bb", "name": "CVE-2026-41148: mermaid 11.14.0 \u2014 docs/package-lock.json", "shortDescription": {"text": "CVE-2026-41148: mermaid 11.14.0 \u2014 docs/package-lock.json"}, "fullDescription": {"text": "mermaid: Mermaid: CSS injection vulnerability allows page defacement and information disclosure\n\nMermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Versions 10.9.5 and prior, in addition to 11.0.0-alpha.1 through 11.12.0 are vulnerable to CSS injection through improper sanitization. The state diagram (and any other diagram type that routes user-controlled style strings through the createCssStyles parser) captures classDef values using an unrestricted regex that matches everything up to a newline. That value then flows unsanitized through \n\nPackage: mermaid\nInstalled: 11.14.0\nFixed in: 11.15.0, 10.9.6\nSeverity: MEDIUM\nFix: Upgrade mermaid to 11.15.0, 10.9.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-20b666cb61d0aa9d", "name": "CVE-2026-41149: mermaid 11.14.0 \u2014 docs/package-lock.json", "shortDescription": {"text": "CVE-2026-41149: mermaid 11.14.0 \u2014 docs/package-lock.json"}, "fullDescription": {"text": "mermaid: Mermaid: HTML injection via classDef directive in state diagrams\n\nMermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Versions 10.9.5 and earlier, as well as 11.0.0-alpha.1 through 11.14.0, are vulnerable to HTML injection under the default configuration. Specifically, the classDef directive in Mermaid state diagrams permits DOM injection that escapes the SVG context. However, <script> tags are stripped, which prevents cross-site scripting (XSS). This issue has been fixed in versions 10.9.6 and 11.15.0. If de\n\nPackage: mermaid\nInstalled: 11.14.0\nFixed in: 11.15.0, 10.9.6\nSeverity: MEDIUM\nFix: Upgrade mermaid to 11.15.0, 10.9.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bbb0f5a8193012be", "name": "CVE-2026-41150: mermaid 11.14.0 \u2014 docs/package-lock.json", "shortDescription": {"text": "CVE-2026-41150: mermaid 11.14.0 \u2014 docs/package-lock.json"}, "fullDescription": {"text": "mermaid: Mermaid: Denial of Service via specially crafted gantt charts\n\nMermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.6 and 11.15.0, there is a denial-of-service attack when rendering gantt charts, if they use the excludes attribute to exclude all dates. mermaid.parse is unaffected, unless you then call the ganttDb.getTasks() (which is called when rendering a diagram). This vulnerability is fixed in 10.9.6 and 11.15.0.\n\nPackage: mermaid\nInstalled: 11.14.0\nFixed in: 11.15.0, 10.9.6\nSeverity: MEDIUM\nFix: Upgrade mermaid to 11.15.0, 10.9.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ec38e29736207f63", "name": "CVE-2026-41159: mermaid 11.14.0 \u2014 docs/package-lock.json", "shortDescription": {"text": "CVE-2026-41159: mermaid 11.14.0 \u2014 docs/package-lock.json"}, "fullDescription": {"text": "mermaid: Mermaid: Information disclosure and page defacement via CSS injection\n\nMermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.6 and 11.15.0,  Mermaid's default configuration allows injecting CSS that applies outside of the Mermaid diagram via the fontFamily, themeCSS, and altFontFamily configuration options. The injected CSS exploits stylis's & (scope reference) handling. :not(&) escapes the #mermaid-xxx automatic scoping, applying styles to all page elements. Global at-rules (@font-face, @keyframes, @c\n\nPackage: mermaid\nInstalled: 11.14.0\nFixed in: 11.15.0, 10.9.6\nSeverity: MEDIUM\nFix: Upgrade mermaid to 11.15.0, 10.9.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-526f57bfab4e2360", "name": "CVE-2026-41305: postcss 8.5.9 \u2014 docs/package-lock.json", "shortDescription": {"text": "CVE-2026-41305: postcss 8.5.9 \u2014 docs/package-lock.json"}, "fullDescription": {"text": "postcss: PostCSS: Cross-Site Scripting (XSS) via improper escaping of style closing tags\n\nPostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape `</style>` sequences when stringifying CSS ASTs. When user-submitted CSS is parsed and re-stringified for embedding in HTML `<style>` tags, `</style>` in CSS values breaks out of the style context, enabling XSS. Version 8.5.10 fixes the issue.\n\nPackage: postcss\nInstalled: 8.5.9\nFixed in: 8.5.10\nSeverity: MEDIUM\nFix: Upgrade postcss to 8.5.10"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8d78f4a40b9fa3f9", "name": "GHSA-f88m-g3jw-g9cj: sharp 0.33.5 \u2014 docs/package-lock.json", "shortDescription": {"text": "GHSA-f88m-g3jw-g9cj: sharp 0.33.5 \u2014 docs/package-lock.json"}, "fullDescription": {"text": "sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591\n\n### Impact\n\nA number of vulnerabilities, two rated as \"High\" severity using CVSSv4, have been discovered and fixed in the upstream libvips dependency.\n\nThose processing untrusted input with versions of sharp prior to 0.35.0 are affected.\n\n### Patches\n\n#### Using prebuilt binaries provided by sharp?\n\nMost people rely on the prebuilt binaries provided by sharp.\n\nPlease upgrade sharp to the latest version, currently 0.35.3, which provides libvips 8.18.3.\n\n#### Using a globally-installed libvips?\n\nP\n\nPackage: sharp\nInstalled: 0.33.5\nFixed in: 0.35.0\nSeverity: HIGH\nFix: Upgrade sharp to 0.35.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f6a2bbde51594faa", "name": "GHSA-f88m-g3jw-g9cj: sharp 0.34.5 \u2014 docs/package-lock.json", "shortDescription": {"text": "GHSA-f88m-g3jw-g9cj: sharp 0.34.5 \u2014 docs/package-lock.json"}, "fullDescription": {"text": "sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591\n\n### Impact\n\nA number of vulnerabilities, two rated as \"High\" severity using CVSSv4, have been discovered and fixed in the upstream libvips dependency.\n\nThose processing untrusted input with versions of sharp prior to 0.35.0 are affected.\n\n### Patches\n\n#### Using prebuilt binaries provided by sharp?\n\nMost people rely on the prebuilt binaries provided by sharp.\n\nPlease upgrade sharp to the latest version, currently 0.35.3, which provides libvips 8.18.3.\n\n#### Using a globally-installed libvips?\n\nP\n\nPackage: sharp\nInstalled: 0.34.5\nFixed in: 0.35.0\nSeverity: HIGH\nFix: Upgrade sharp to 0.35.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-36de0c2ed510015b", "name": "GHSA-2p49-hgcm-8545: svgo 4.0.1 \u2014 docs/package-lock.json", "shortDescription": {"text": "GHSA-2p49-hgcm-8545: svgo 4.0.1 \u2014 docs/package-lock.json"}, "fullDescription": {"text": "SVGO removeScripts plugin leaves some executable scripts intact\n\n### Summary\n\nSVGO's removeScripts plugin (disabled by default) removes scripts from the SVG, however executable scripts were left intact in some cases. If a consumer relied on this plugin for sanitization and served them to users, these SVGs could open up doors to XSS.\n\n### Details\n\nSVGO has a plugin for removing scripts from an SVG, which removes:\n\n- `<script>` elements\n- JavaScript URIs (v4 and v3 only)\n- `on\u2026` event handlers (v4 and v3 only)\n\nWhile SVGO is not a sanitization library, SVGO con\n\nPackage: svgo\nInstalled: 4.0.1\nFixed in: 2.8.3, 3.3.4, 4.0.2\nSeverity: HIGH\nFix: Upgrade svgo to 2.8.3, 3.3.4, 4.0.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-67b202e9c0e4566f", "name": "CVE-2026-41907: uuid 11.1.0 \u2014 docs/package-lock.json", "shortDescription": {"text": "CVE-2026-41907: uuid 11.1.0 \u2014 docs/package-lock.json"}, "fullDescription": {"text": "uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality\n\nuuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0.\n\nPackage: uuid\nInstalled: 11.1.0\nFixed in: 11.1.1, 12.0.1, 13.0.1\nSeverity: MEDIUM\nFix: Upgrade uuid to 11.1.1, 12.0.1, 13.0.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f16f7d8a2c5dfcc8", "name": "CVE-2026-53571: vite 6.4.2 \u2014 docs/package-lock.json", "shortDescription": {"text": "CVE-2026-53571: vite 6.4.2 \u2014 docs/package-lock.json"}, "fullDescription": {"text": "vite: `server.fs.deny` bypass on Windows alternate paths\n\nVite is a frontend tooling framework for JavaScript. Prior to 8.0.16, 7.3.5, and 6.4.3, the contents of files that are specified by server.fs.deny can be returned to the browser on Windows. Vite\u2019s dev server denies direct access to sensitive files through server.fs.deny, including entries such as .env, .env.*, and *.{crt,pem}. However, on Windows, the deny logic does not correctly normalize NTFS ADS path forms before access checks are applied. Because of this, requests such as /.env::$DATA?raw a\n\nPackage: vite\nInstalled: 6.4.2\nFixed in: 8.0.16, 7.3.5, 6.4.3\nSeverity: HIGH\nFix: Upgrade vite to 8.0.16, 7.3.5, 6.4.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4b20e5da02605d23", "name": "CVE-2026-53632: vite 6.4.2 \u2014 docs/package-lock.json", "shortDescription": {"text": "CVE-2026-53632: vite 6.4.2 \u2014 docs/package-lock.json"}, "fullDescription": {"text": "launch-editor: launch-editor: Credential compromise via NTLMv2 password hash leak through UNC path access\n\nlaunch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.1, the launch-editor NPM package accesses arbitrary paths including Windows UNC paths. When a UNC path is opened, Windows automatically attempts NTLM authentication to the remote host, causing the user\u2019s NTLMv2 password hash to be leaked to an attacker-controlled SMB server. This can result in credential compromise through offline hash cracking. This vulnerability is fixed in 2.14.1.\n\nPackage: vite\nInstalled: 6.4.2\nFixed in: 8.0.16, 7.3.5, 6.4.3\nSeverity: MEDIUM\nFix: Upgrade vite to 8.0.16, 7.3.5, 6.4.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6c85fb0962ff2697", "name": "CVE-2026-39824: golang.org/x/sys v0.42.0 \u2014 go.mod", "shortDescription": {"text": "CVE-2026-39824: golang.org/x/sys v0.42.0 \u2014 go.mod"}, "fullDescription": {"text": "Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows\n\nNewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated string rather than an error.\n\nPackage: golang.org/x/sys\nInstalled: v0.42.0\nFixed in: 0.44.0\nSeverity: UNKNOWN\nFix: Upgrade golang.org/x/sys to 0.44.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0bbf9cc87ff5f77c", "name": "CVE-2026-56852: golang.org/x/text v0.3.8 \u2014 go.mod", "shortDescription": {"text": "CVE-2026-56852: golang.org/x/text v0.3.8 \u2014 go.mod"}, "fullDescription": {"text": "A norm.Iter can enter an infinite loop when handling input containing  ...\n\nA norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.\n\nPackage: golang.org/x/text\nInstalled: v0.3.8\nFixed in: 0.39.0\nSeverity: UNKNOWN\nFix: Upgrade golang.org/x/text to 0.39.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2679282aa1c484b5", "name": "Agent authority lacks a verifier contract: AGENTS.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: AGENTS.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-391723a33532511b", "name": "Agent authority lacks a verifier contract: docs/src/content/docs/guides/agents.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: docs/src/content/docs/guides/agents.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b92c4e9abaf68b10", "name": "Agent authority lacks a verifier contract: skills/no-mistakes/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/no-mistakes/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e2313e687d4ce67a", "name": "SkillSpector EA2 (excessive-agency) in skills/no-mistakes/SKILL.md", "shortDescription": {"text": "SkillSpector EA2 (excessive-agency) in skills/no-mistakes/SKILL.md"}, "fullDescription": {"text": "without checking\n\nSkill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.\n\nSkill: no-mistakes\nRule: EA2  Category: excessive-agency\nSeverity: MEDIUM  Confidence: 0.75\n\nRemediation: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.75}}, {"id": "scanner-e637c415447867e4", "name": "Run SkillSpector's LLM-backed analysis in your own pipeline", "shortDescription": {"text": "Run SkillSpector's LLM-backed analysis in your own pipeline"}, "fullDescription": {"text": "Repobility ran SkillSpector's static rules server-side. The deeper LLM-backed analyzers \u2014 tool-poisoning (TP*), semantic security discovery (SSD*), developer-intent mismatch (SDI*) \u2014 are meant to run on YOUR machine with YOUR model; repobility never sends your code to an LLM. Recipe:\n\n# 1. Install SkillSpector in your own isolated env\npipx install \"skillspector @ git+https://github.com/NVIDIA/SkillSpector.git\"\n\n# 2. Point it at YOUR LLM pipeline (pick one) - your code stays on your machine\nexport SKILLSPECTOR_PROVIDER=anthropic && export ANTHROPIC_API_KEY=sk-ant-...\n# export SKILLSPECTOR_PROVIDER=openai   && export OPENAI_API_KEY=sk-...\n# export SKILLSPECTOR_PROVIDER=openai OPENAI_API_KEY=ollama OPENAI_BASE_URL=http://localhost:11434/v1 SKILLSPECTOR_MODEL=llama3.1:8b\n# export SKILLSPECTOR_PROVIDER=nv_build && export NVIDIA_INFERENCE_KEY=nvapi-...\n\n# 3. Run the LLM-backed scan per skill (omit --no-llm to enable the LLM analyzers)\nskillspector scan skills/no-mistakes --format sarif --out"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0763d85002569570", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/configure-pages@v5 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-14ce8614dd03f409", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1838a141491ce38c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5aa41261c1c36fcd", "name": "Very large file: internal/daemon/service_test.go (1637 lines)", "shortDescription": {"text": "Very large file: internal/daemon/service_test.go (1637 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8be725f31b4ce452", "name": "Very large file: internal/pipeline/steps/pr_test.go (1914 lines)", "shortDescription": {"text": "Very large file: internal/pipeline/steps/pr_test.go (1914 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-413e7ee144eb95ea", "name": "Very large file: internal/e2e/journey_test.go (2916 lines)", "shortDescription": {"text": "Very large file: internal/e2e/journey_test.go (2916 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 225 placeholder/mock markers across 60 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-33dbddce9606a8a7", "name": "Vulnerable dependency astro 5.18.1: GHSA-2pvr-wf23-7pc7", "shortDescription": {"text": "Vulnerable dependency astro 5.18.1: GHSA-2pvr-wf23-7pc7"}, "fullDescription": {"text": "OSV.dev reports `astro` at version `5.18.1` (resolved in `docs/package-lock.json`) is affected by GHSA-2pvr-wf23-7pc7 (aka CVE-2026-54299).\n\nAstro: Host header SSRF in prerendered error page fetch\n\nAliases: CVE-2026-54299\nAdvisory: https://osv.dev/vulnerability/GHSA-2pvr-wf23-7pc7\nFix: upgrade `astro` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-16b8dc469c1b1808", "name": "Vulnerable dependency astro 5.18.1: GHSA-4g3v-8h47-v7g6", "shortDescription": {"text": "Vulnerable dependency astro 5.18.1: GHSA-4g3v-8h47-v7g6"}, "fullDescription": {"text": "OSV.dev reports `astro` at version `5.18.1` (resolved in `docs/package-lock.json`) is affected by GHSA-4g3v-8h47-v7g6.\n\nAstro: Reflected XSS via unescaped View Transition animation properties\n\nAdvisory: https://osv.dev/vulnerability/GHSA-4g3v-8h47-v7g6\nFix: upgrade `astro` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e852a14f1f64850e", "name": "Vulnerable dependency astro 5.18.1: GHSA-7pw4-f3q4-r2p2", "shortDescription": {"text": "Vulnerable dependency astro 5.18.1: GHSA-7pw4-f3q4-r2p2"}, "fullDescription": {"text": "OSV.dev reports `astro` at version `5.18.1` (resolved in `docs/package-lock.json`) is affected by GHSA-7pw4-f3q4-r2p2 (aka CVE-2026-59727).\n\nAstro: Cross-site scripting via unescaped transition:* directive values on hydrated islands\n\nAliases: CVE-2026-59727\nAdvisory: https://osv.dev/vulnerability/GHSA-7pw4-f3q4-r2p2\nFix: upgrade `astro` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a193d92c198a08b0", "name": "Vulnerable dependency astro 5.18.1: GHSA-8hv8-536x-4wqp", "shortDescription": {"text": "Vulnerable dependency astro 5.18.1: GHSA-8hv8-536x-4wqp"}, "fullDescription": {"text": "OSV.dev reports `astro` at version `5.18.1` (resolved in `docs/package-lock.json`) is affected by GHSA-8hv8-536x-4wqp (aka CVE-2026-50146).\n\nAstro: Reflected XSS via unescaped slot name\n\nAliases: CVE-2026-50146\nAdvisory: https://osv.dev/vulnerability/GHSA-8hv8-536x-4wqp\nFix: upgrade `astro` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2245ef5834422102", "name": "Vulnerable dependency astro 5.18.1: GHSA-f48w-9m4c-m7f5", "shortDescription": {"text": "Vulnerable dependency astro 5.18.1: GHSA-f48w-9m4c-m7f5"}, "fullDescription": {"text": "OSV.dev reports `astro` at version `5.18.1` (resolved in `docs/package-lock.json`) is affected by GHSA-f48w-9m4c-m7f5 (aka CVE-2026-59729).\n\nAstro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)\n\nAliases: CVE-2026-59729\nAdvisory: https://osv.dev/vulnerability/GHSA-f48w-9m4c-m7f5\nFix: upgrade `astro` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fc269fd95ea0d3a5", "name": "Vulnerable dependency astro 5.18.1: GHSA-j687-52p2-xcff", "shortDescription": {"text": "Vulnerable dependency astro 5.18.1: GHSA-j687-52p2-xcff"}, "fullDescription": {"text": "OSV.dev reports `astro` at version `5.18.1` (resolved in `docs/package-lock.json`) is affected by GHSA-j687-52p2-xcff (aka CVE-2026-41067).\n\nAstro: XSS in define:vars via incomplete </script> tag sanitization\n\nAliases: CVE-2026-41067\nAdvisory: https://osv.dev/vulnerability/GHSA-j687-52p2-xcff\nFix: upgrade `astro` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5401574d8556a41d", "name": "Vulnerable dependency astro 5.18.1: GHSA-jrpj-wcv7-9fh9", "shortDescription": {"text": "Vulnerable dependency astro 5.18.1: GHSA-jrpj-wcv7-9fh9"}, "fullDescription": {"text": "OSV.dev reports `astro` at version `5.18.1` (resolved in `docs/package-lock.json`) is affected by GHSA-jrpj-wcv7-9fh9 (aka CVE-2026-54298).\n\nAstro: XSS via Unescaped Attribute Names in Spread Props\n\nAliases: CVE-2026-54298\nAdvisory: https://osv.dev/vulnerability/GHSA-jrpj-wcv7-9fh9\nFix: upgrade `astro` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-665d876b2426b07d", "name": "Vulnerable dependency astro 5.18.1: GHSA-xr5h-phrj-8vxv", "shortDescription": {"text": "Vulnerable dependency astro 5.18.1: GHSA-xr5h-phrj-8vxv"}, "fullDescription": {"text": "OSV.dev reports `astro` at version `5.18.1` (resolved in `docs/package-lock.json`) is affected by GHSA-xr5h-phrj-8vxv (aka CVE-2026-45028).\n\nAstro: Server island encrypted parameters vulnerable to cross-component replay\n\nAliases: CVE-2026-45028\nAdvisory: https://osv.dev/vulnerability/GHSA-xr5h-phrj-8vxv\nFix: upgrade `astro` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3ce2e59efd114906", "name": "Vulnerable dependency sharp 0.34.5: GHSA-f88m-g3jw-g9cj", "shortDescription": {"text": "Vulnerable dependency sharp 0.34.5: GHSA-f88m-g3jw-g9cj"}, "fullDescription": {"text": "OSV.dev reports `sharp` at version `0.34.5` (resolved in `docs/package-lock.json`) is affected by GHSA-f88m-g3jw-g9cj.\nNote: `sharp` is an optional dependency \u2014 installs may legitimately omit it.\n\nsharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591\n\nAdvisory: https://osv.dev/vulnerability/GHSA-f88m-g3jw-g9cj\nFix: upgrade `sharp` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-ee72dab292d6251b", "name": "Vulnerable dependency mermaid 11.14.0: GHSA-6m6c-36f7-fhxh", "shortDescription": {"text": "Vulnerable dependency mermaid 11.14.0: GHSA-6m6c-36f7-fhxh"}, "fullDescription": {"text": "OSV.dev reports `mermaid` at version `11.14.0` (resolved in `docs/package-lock.json`) is affected by GHSA-6m6c-36f7-fhxh (aka CVE-2026-41150).\n\nMermaid Gantt Charts are vulnerable to an Infinite Loop DoS\n\nAliases: CVE-2026-41150\nAdvisory: https://osv.dev/vulnerability/GHSA-6m6c-36f7-fhxh\nFix: upgrade `mermaid` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cf7634f2dd14d04c", "name": "Vulnerable dependency mermaid 11.14.0: GHSA-87f9-hvmw-gh4p", "shortDescription": {"text": "Vulnerable dependency mermaid 11.14.0: GHSA-87f9-hvmw-gh4p"}, "fullDescription": {"text": "OSV.dev reports `mermaid` at version `11.14.0` (resolved in `docs/package-lock.json`) is affected by GHSA-87f9-hvmw-gh4p (aka CVE-2026-41159).\n\nMermaid: Improper sanitization of configuration leads to CSS injection\n\nAliases: CVE-2026-41159\nAdvisory: https://osv.dev/vulnerability/GHSA-87f9-hvmw-gh4p\nFix: upgrade `mermaid` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0914052326e4dacd", "name": "Vulnerable dependency mermaid 11.14.0: GHSA-ghcm-xqfw-q4vr", "shortDescription": {"text": "Vulnerable dependency mermaid 11.14.0: GHSA-ghcm-xqfw-q4vr"}, "fullDescription": {"text": "OSV.dev reports `mermaid` at version `11.14.0` (resolved in `docs/package-lock.json`) is affected by GHSA-ghcm-xqfw-q4vr (aka CVE-2026-41149).\n\nMermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injection\n\nAliases: CVE-2026-41149\nAdvisory: https://osv.dev/vulnerability/GHSA-ghcm-xqfw-q4vr\nFix: upgrade `mermaid` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7ac14bbc183da66c", "name": "Vulnerable dependency mermaid 11.14.0: GHSA-xcj9-5m2h-648r", "shortDescription": {"text": "Vulnerable dependency mermaid 11.14.0: GHSA-xcj9-5m2h-648r"}, "fullDescription": {"text": "OSV.dev reports `mermaid` at version `11.14.0` (resolved in `docs/package-lock.json`) is affected by GHSA-xcj9-5m2h-648r (aka CVE-2026-41148).\n\nMermaid: Improper sanitization of `classDefs` in diagrams leads to CSS injection\n\nAliases: CVE-2026-41148\nAdvisory: https://osv.dev/vulnerability/GHSA-xcj9-5m2h-648r\nFix: upgrade `mermaid` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8f65193e7551d466", "name": "Vulnerable dependency sharp 0.33.5: GHSA-f88m-g3jw-g9cj", "shortDescription": {"text": "Vulnerable dependency sharp 0.33.5: GHSA-f88m-g3jw-g9cj"}, "fullDescription": {"text": "OSV.dev reports `sharp` at version `0.33.5` (resolved in `docs/package-lock.json`) is affected by GHSA-f88m-g3jw-g9cj.\n\nsharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591\n\nAdvisory: https://osv.dev/vulnerability/GHSA-f88m-g3jw-g9cj\nFix: upgrade `sharp` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1267cf8c43a6708c", "name": "Vulnerable dependency esbuild 0.27.7: GHSA-g7r4-m6w7-qqqr", "shortDescription": {"text": "Vulnerable dependency esbuild 0.27.7: GHSA-g7r4-m6w7-qqqr"}, "fullDescription": {"text": "OSV.dev reports `esbuild` at version `0.27.7` (resolved in `docs/package-lock.json`) is affected by GHSA-g7r4-m6w7-qqqr.\nNote: `esbuild` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nesbuild allows arbitrary file read when running the development server on Windows\n\nAdvisory: https://osv.dev/vulnerability/GHSA-g7r4-m6w7-qqqr\nFix: upgrade `esbuild` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-7b0fbf928ba63a72", "name": "Vulnerable dependency devalue 5.7.1: GHSA-77vg-94rm-hx3p", "shortDescription": {"text": "Vulnerable dependency devalue 5.7.1: GHSA-77vg-94rm-hx3p"}, "fullDescription": {"text": "OSV.dev reports `devalue` at version `5.7.1` (resolved in `docs/package-lock.json`) is affected by GHSA-77vg-94rm-hx3p (aka CVE-2026-42570).\nNote: `devalue` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nSvelte devalue: DoS via sparse array deserialization\n\nAliases: CVE-2026-42570\nAdvisory: https://osv.dev/vulnerability/GHSA-77vg-94rm-hx3p\nFix: upgrade `devalue` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-a6524951736babfc", "name": "Vulnerable dependency dompurify 3.4.0: GHSA-76mc-f452-cxcm", "shortDescription": {"text": "Vulnerable dependency dompurify 3.4.0: GHSA-76mc-f452-cxcm"}, "fullDescription": {"text": "OSV.dev reports `dompurify` at version `3.4.0` (resolved in `docs/package-lock.json`) is affected by GHSA-76mc-f452-cxcm (aka CVE-2026-65902).\nNote: `dompurify` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nDOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR`\n\nAliases: CVE-2026-65902\nAdvisory: https://osv.dev/vulnerability/GHSA-76mc-f452-cxcm\nFix: upgrade `dompurify` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-d75d49de3661f953", "name": "Vulnerable dependency dompurify 3.4.0: GHSA-c2j3-45gr-mqc4", "shortDescription": {"text": "Vulnerable dependency dompurify 3.4.0: GHSA-c2j3-45gr-mqc4"}, "fullDescription": {"text": "OSV.dev reports `dompurify` at version `3.4.0` (resolved in `docs/package-lock.json`) is affected by GHSA-c2j3-45gr-mqc4.\nNote: `dompurify` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nDOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-c2j3-45gr-mqc4\nFix: upgrade `dompurify` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-27a9482c0f1541d1", "name": "Vulnerable dependency dompurify 3.4.0: GHSA-cmwh-pvxp-8882", "shortDescription": {"text": "Vulnerable dependency dompurify 3.4.0: GHSA-cmwh-pvxp-8882"}, "fullDescription": {"text": "OSV.dev reports `dompurify` at version `3.4.0` (resolved in `docs/package-lock.json`) is affected by GHSA-cmwh-pvxp-8882 (aka CVE-2026-65898).\nNote: `dompurify` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nDOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)\n\nAliases: CVE-2026-65898\nAdvisory: https://osv.dev/vulnerability/GHSA-cmwh-pvxp-8882\nFix: upgrade `dompurify` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-da4b52a380305a9e", "name": "Vulnerable dependency dompurify 3.4.0: GHSA-gvmj-g25r-r7wr", "shortDescription": {"text": "Vulnerable dependency dompurify 3.4.0: GHSA-gvmj-g25r-r7wr"}, "fullDescription": {"text": "OSV.dev reports `dompurify` at version `3.4.0` (resolved in `docs/package-lock.json`) is affected by GHSA-gvmj-g25r-r7wr (aka CVE-2026-65900).\nNote: `dompurify` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nDOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside <template> content when using DOM output modes\n\nAliases: CVE-2026-65900\nAdvisory: https://osv.dev/vulnerability/GHSA-gvmj-g25r-r7wr\nFix: upgrade `dompurify` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-ed69216980d117e9", "name": "Vulnerable dependency dompurify 3.4.0: GHSA-hpcv-96wg-7vj8", "shortDescription": {"text": "Vulnerable dependency dompurify 3.4.0: GHSA-hpcv-96wg-7vj8"}, "fullDescription": {"text": "OSV.dev reports `dompurify` at version `3.4.0` (resolved in `docs/package-lock.json`) is affected by GHSA-hpcv-96wg-7vj8 (aka CVE-2026-49458).\nNote: `dompurify` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nDOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks\n\nAliases: CVE-2026-49458\nAdvisory: https://osv.dev/vulnerability/GHSA-hpcv-96wg-7vj8\nFix: upgrade `dompurify` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-e65573a17b276078", "name": "Vulnerable dependency dompurify 3.4.0: GHSA-r47g-fvhr-h676", "shortDescription": {"text": "Vulnerable dependency dompurify 3.4.0: GHSA-r47g-fvhr-h676"}, "fullDescription": {"text": "OSV.dev reports `dompurify` at version `3.4.0` (resolved in `docs/package-lock.json`) is affected by GHSA-r47g-fvhr-h676 (aka CVE-2026-49459).\nNote: `dompurify` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nDOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM\n\nAliases: CVE-2026-49459\nAdvisory: https://osv.dev/vulnerability/GHSA-r47g-fvhr-h676\nFix: upgrade `dompurify` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-c891a9d7b29d2f9e", "name": "Vulnerable dependency dompurify 3.4.0: GHSA-rp9w-3fw7-7cwq", "shortDescription": {"text": "Vulnerable dependency dompurify 3.4.0: GHSA-rp9w-3fw7-7cwq"}, "fullDescription": {"text": "OSV.dev reports `dompurify` at version `3.4.0` (resolved in `docs/package-lock.json`) is affected by GHSA-rp9w-3fw7-7cwq (aka CVE-2026-49978).\nNote: `dompurify` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nDOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content\n\nAliases: CVE-2026-49978\nAdvisory: https://osv.dev/vulnerability/GHSA-rp9w-3fw7-7cwq\nFix: upgrade `dompurify` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-a98542c8fe2d942e", "name": "Vulnerable dependency dompurify 3.4.0: GHSA-vxr8-fq34-vvx9", "shortDescription": {"text": "Vulnerable dependency dompurify 3.4.0: GHSA-vxr8-fq34-vvx9"}, "fullDescription": {"text": "OSV.dev reports `dompurify` at version `3.4.0` (resolved in `docs/package-lock.json`) is affected by GHSA-vxr8-fq34-vvx9 (aka CVE-2026-65899).\nNote: `dompurify` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nDOMPurify: Trusted Types policy survives `clearConfig()` and can poison later `RETURN_TRUSTED_TYPE` output\n\nAliases: CVE-2026-65899\nAdvisory: https://osv.dev/vulnerability/GHSA-vxr8-fq34-vvx9\nFix: upgrade `dompurify` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-85513c6ef743f6c9", "name": "Vulnerable dependency dompurify 3.4.0: GHSA-x4vx-rjvf-j5p4", "shortDescription": {"text": "Vulnerable dependency dompurify 3.4.0: GHSA-x4vx-rjvf-j5p4"}, "fullDescription": {"text": "OSV.dev reports `dompurify` at version `3.4.0` (resolved in `docs/package-lock.json`) is affected by GHSA-x4vx-rjvf-j5p4 (aka CVE-2026-65901).\nNote: `dompurify` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nDOMPurify: `IN_PLACE` mode trusts attacker-controlled `nodeName` on live non-form nodes, allowing script retention and XSS via attacker-supplied DOM objects\n\nAliases: CVE-2026-65901\nAdvisory: https://osv.dev/vulnerability/GHSA-x4vx-rjvf-j5p4\nFix: upgrade `dompurify` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-7a1c7ea0c5f161f1", "name": "Vulnerable dependency js-yaml 4.1.1: GHSA-52cp-r559-cp3m", "shortDescription": {"text": "Vulnerable dependency js-yaml 4.1.1: GHSA-52cp-r559-cp3m"}, "fullDescription": {"text": "OSV.dev reports `js-yaml` at version `4.1.1` (resolved in `docs/package-lock.json`) is affected by GHSA-52cp-r559-cp3m (aka CVE-2026-59869).\nNote: `js-yaml` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\njs-yaml: YAML merge-key chains can force quadratic CPU consumption\n\nAliases: CVE-2026-59869\nAdvisory: https://osv.dev/vulnerability/GHSA-52cp-r559-cp3m\nFix: upgrade `js-yaml` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-0af295999bb8b8cb", "name": "Vulnerable dependency js-yaml 4.1.1: GHSA-h67p-54hq-rp68", "shortDescription": {"text": "Vulnerable dependency js-yaml 4.1.1: GHSA-h67p-54hq-rp68"}, "fullDescription": {"text": "OSV.dev reports `js-yaml` at version `4.1.1` (resolved in `docs/package-lock.json`) is affected by GHSA-h67p-54hq-rp68 (aka CVE-2026-53550).\nNote: `js-yaml` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nJS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases\n\nAliases: CVE-2026-53550\nAdvisory: https://osv.dev/vulnerability/GHSA-h67p-54hq-rp68\nFix: upgrade `js-yaml` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-60c3f448a9ccc679", "name": "Dependency astro is two or more major versions behind", "shortDescription": {"text": "Dependency astro is two or more major versions behind"}, "fullDescription": {"text": "`astro` is pinned at `5.18.1` in `docs/package.json` while the latest release on the npm registry is `7.1.3` \u2014 2 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `astro` to `7.1.3`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}]}}, "automationDetails": {"id": "repobility/30778"}, "properties": {"repository": "kunchenguid/no-mistakes", "repoUrl": "https://github.com/kunchenguid/no-mistakes", "branch": "main"}, "results": [{"ruleId": "scanner-9471fa0b9eb8e1c9", "level": "warning", "message": {"text": "math random used \u2014 internal/agent/retry.go:6"}, "properties": {"repobilityId": "84e2ff2a3b6211fc", "scanner": "scanner-primary", "fingerprint": "9471fa0b9eb8e1c9", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["semgrep", "security", "go"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "internal/agent/retry.go"}, "region": {"startLine": 6}}}]}, {"ruleId": "scanner-72d5485e17af88ce", "level": "warning", "message": {"text": "use of unsafe block \u2014 internal/e2edaemon/process_windows.go:37"}, "properties": {"repobilityId": "c3d7e602bb72ccbb", "scanner": "scanner-primary", "fingerprint": "72d5485e17af88ce", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "go"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "internal/e2edaemon/process_windows.go"}, "region": {"startLine": 37}}}]}, {"ruleId": "scanner-b00277ee1c03493f", "level": "warning", "message": {"text": "use of unsafe block \u2014 internal/shellenv/shell_command_windows.go:165"}, "properties": {"repobilityId": "a85b4c792f9ddfef", "scanner": "scanner-primary", "fingerprint": "b00277ee1c03493f", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "go"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "internal/shellenv/shell_command_windows.go"}, "region": {"startLine": 165}}}]}, {"ruleId": "scanner-2f0952e5222e2de3", "level": "warning", "message": {"text": "use of unsafe block \u2014 internal/update/process_path_windows.go:27"}, "properties": {"repobilityId": "db68454e849956c1", "scanner": "scanner-primary", "fingerprint": "2f0952e5222e2de3", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "go"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "internal/update/process_path_windows.go"}, "region": {"startLine": 27}}}]}, {"ruleId": "scanner-05c0c25786dac66e", "level": "error", "message": {"text": "CVE-2026-50146: astro 5.18.1 \u2014 docs/package-lock.json"}, "properties": {"repobilityId": "bb4fc1c4ef3e4eeb", "scanner": "scanner-primary", "fingerprint": "05c0c25786dac66e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-50146"]}}, {"ruleId": "scanner-7bfb3e5c1bd60b35", "level": "error", "message": {"text": "CVE-2026-54299: astro 5.18.1 \u2014 docs/package-lock.json"}, "properties": {"repobilityId": "dc432b362590a2ba", "scanner": "scanner-primary", "fingerprint": "7bfb3e5c1bd60b35", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54299"]}}, {"ruleId": "scanner-4e730f2dc969ab8b", "level": "warning", "message": {"text": "CVE-2026-41067: astro 5.18.1 \u2014 docs/package-lock.json"}, "properties": {"repobilityId": "a61eff19fe899b18", "scanner": "scanner-primary", "fingerprint": "4e730f2dc969ab8b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41067"]}}, {"ruleId": "scanner-49c7a5e1aba3c547", "level": "warning", "message": {"text": "CVE-2026-54298: astro 5.18.1 \u2014 docs/package-lock.json"}, "properties": {"repobilityId": "a2f83a4a770378eb", "scanner": "scanner-primary", "fingerprint": "49c7a5e1aba3c547", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54298"]}}, {"ruleId": "scanner-49bbcace3cd55e2b", "level": "warning", "message": {"text": "CVE-2026-59729: astro 5.18.1 \u2014 docs/package-lock.json"}, "properties": {"repobilityId": "f403dcdb7dd4d07b", "scanner": "scanner-primary", "fingerprint": "49bbcace3cd55e2b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59729"]}}, {"ruleId": "scanner-d81c5b9c8bd90dbe", "level": "warning", "message": {"text": "GHSA-4g3v-8h47-v7g6: astro 5.18.1 \u2014 docs/package-lock.json"}, "properties": {"repobilityId": "fa3f70d72d3612b9", "scanner": "scanner-primary", "fingerprint": "d81c5b9c8bd90dbe", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-4g3v-8h47-v7g6"]}}, {"ruleId": "scanner-5a88e36debdccf79", "level": "note", "message": {"text": "CVE-2026-45028: astro 5.18.1 \u2014 docs/package-lock.json"}, "properties": {"repobilityId": "7a76ca7844b3fe4b", "scanner": "scanner-primary", "fingerprint": "5a88e36debdccf79", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45028"]}}, {"ruleId": "scanner-b34b23951b499b4d", "level": "note", "message": {"text": "CVE-2026-59727: astro 5.18.1 \u2014 docs/package-lock.json"}, "properties": {"repobilityId": "70fa9fdb3d96ae70", "scanner": "scanner-primary", "fingerprint": "b34b23951b499b4d", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59727"]}}, {"ruleId": "scanner-5125da4d47470d6c", "level": "error", "message": {"text": "CVE-2026-42570: devalue 5.7.1 \u2014 docs/package-lock.json"}, "properties": {"repobilityId": "f30c27d4d4c948db", "scanner": "scanner-primary", "fingerprint": "5125da4d47470d6c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42570"]}}, {"ruleId": "scanner-e50bec00707eccf2", "level": "warning", "message": {"text": "CVE-2026-49458: dompurify 3.4.0 \u2014 docs/package-lock.json"}, "properties": {"repobilityId": "f5fdd5f53b68ad28", "scanner": "scanner-primary", "fingerprint": "e50bec00707eccf2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-49458"]}}, {"ruleId": "scanner-d528619cdd1cb596", "level": "warning", "message": {"text": "CVE-2026-49459: dompurify 3.4.0 \u2014 docs/package-lock.json"}, "properties": {"repobilityId": "5b9e2609b4bc54c5", "scanner": "scanner-primary", "fingerprint": "d528619cdd1cb596", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-49459"]}}, {"ruleId": "scanner-b2a998809cb57bb4", "level": "warning", "message": {"text": "CVE-2026-49978: dompurify 3.4.0 \u2014 docs/package-lock.json"}, "properties": {"repobilityId": "98ce4037d0a8f0dc", "scanner": "scanner-primary", "fingerprint": "b2a998809cb57bb4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-49978"]}}, {"ruleId": "scanner-c1e9282df4860fdd", "level": "warning", "message": {"text": "GHSA-76mc-f452-cxcm: dompurify 3.4.0 \u2014 docs/package-lock.json"}, "properties": {"repobilityId": "dfcd0ebecaeea141", "scanner": "scanner-primary", "fingerprint": "c1e9282df4860fdd", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-76mc-f452-cxcm"]}}, {"ruleId": "scanner-078677121b12dc28", "level": "warning", "message": {"text": "GHSA-cmwh-pvxp-8882: dompurify 3.4.0 \u2014 docs/package-lock.json"}, "properties": {"repobilityId": "be99762d5efc9443", "scanner": "scanner-primary", "fingerprint": "078677121b12dc28", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-cmwh-pvxp-8882"]}}, {"ruleId": "scanner-2d8c77aa65164a71", "level": "note", "message": {"text": "GHSA-c2j3-45gr-mqc4: dompurify 3.4.0 \u2014 docs/package-lock.json"}, "properties": {"repobilityId": "89ea2dec4f4d366e", "scanner": "scanner-primary", "fingerprint": "2d8c77aa65164a71", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-c2j3-45gr-mqc4"]}}, {"ruleId": "scanner-2a7639d17100c885", "level": "note", "message": {"text": "GHSA-gvmj-g25r-r7wr: dompurify 3.4.0 \u2014 docs/package-lock.json"}, "properties": {"repobilityId": "557426b0d225b416", "scanner": "scanner-primary", "fingerprint": "2a7639d17100c885", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-gvmj-g25r-r7wr"]}}, {"ruleId": "scanner-2e30791d46187408", "level": "note", "message": {"text": "GHSA-vxr8-fq34-vvx9: dompurify 3.4.0 \u2014 docs/package-lock.json"}, "properties": {"repobilityId": "7d300416d32d30fd", "scanner": "scanner-primary", "fingerprint": "2e30791d46187408", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-vxr8-fq34-vvx9"]}}, {"ruleId": "scanner-4a3ca9a187eb6132", "level": "note", "message": {"text": "GHSA-x4vx-rjvf-j5p4: dompurify 3.4.0 \u2014 docs/package-lock.json"}, "properties": {"repobilityId": "0883aa7165070d7c", "scanner": "scanner-primary", "fingerprint": "4a3ca9a187eb6132", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-x4vx-rjvf-j5p4"]}}, {"ruleId": "scanner-f38ba65e2988efe9", "level": "note", "message": {"text": "GHSA-g7r4-m6w7-qqqr: esbuild 0.27.7 \u2014 docs/package-lock.json"}, "properties": {"repobilityId": "84d961f1035d45a0", "scanner": "scanner-primary", "fingerprint": "f38ba65e2988efe9", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-g7r4-m6w7-qqqr"]}}, {"ruleId": "scanner-51bb941c82b607dd", "level": "error", "message": {"text": "CVE-2026-59869: js-yaml 4.1.1 \u2014 docs/package-lock.json"}, "properties": {"repobilityId": "f21fa0e5f5440cb0", "scanner": "scanner-primary", "fingerprint": "51bb941c82b607dd", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59869"]}}, {"ruleId": "scanner-a503bb72aab73e90", "level": "warning", "message": {"text": "CVE-2026-53550: js-yaml 4.1.1 \u2014 docs/package-lock.json"}, "properties": {"repobilityId": "edb514e63fba8659", "scanner": "scanner-primary", "fingerprint": "a503bb72aab73e90", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-53550"]}}, {"ruleId": "scanner-bfff82bf549f60bb", "level": "warning", "message": {"text": "CVE-2026-41148: mermaid 11.14.0 \u2014 docs/package-lock.json"}, "properties": {"repobilityId": "236adbebcedf0634", "scanner": "scanner-primary", "fingerprint": "bfff82bf549f60bb", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41148"]}}, {"ruleId": "scanner-20b666cb61d0aa9d", "level": "warning", "message": {"text": "CVE-2026-41149: mermaid 11.14.0 \u2014 docs/package-lock.json"}, "properties": {"repobilityId": "8a3292b1b4960cdc", "scanner": "scanner-primary", "fingerprint": "20b666cb61d0aa9d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41149"]}}, {"ruleId": "scanner-bbb0f5a8193012be", "level": "warning", "message": {"text": "CVE-2026-41150: mermaid 11.14.0 \u2014 docs/package-lock.json"}, "properties": {"repobilityId": "87a05b5b689fe17a", "scanner": "scanner-primary", "fingerprint": "bbb0f5a8193012be", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41150"]}}, {"ruleId": "scanner-ec38e29736207f63", "level": "warning", "message": {"text": "CVE-2026-41159: mermaid 11.14.0 \u2014 docs/package-lock.json"}, "properties": {"repobilityId": "68da8d28cdb87f2a", "scanner": "scanner-primary", "fingerprint": "ec38e29736207f63", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41159"]}}, {"ruleId": "scanner-526f57bfab4e2360", "level": "warning", "message": {"text": "CVE-2026-41305: postcss 8.5.9 \u2014 docs/package-lock.json"}, "properties": {"repobilityId": "9bf45263362ca02c", "scanner": "scanner-primary", "fingerprint": "526f57bfab4e2360", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41305"]}}, {"ruleId": "scanner-8d78f4a40b9fa3f9", "level": "error", "message": {"text": "GHSA-f88m-g3jw-g9cj: sharp 0.33.5 \u2014 docs/package-lock.json"}, "properties": {"repobilityId": "dab0ba26bd195392", "scanner": "scanner-primary", "fingerprint": "8d78f4a40b9fa3f9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-f88m-g3jw-g9cj"]}}, {"ruleId": "scanner-f6a2bbde51594faa", "level": "error", "message": {"text": "GHSA-f88m-g3jw-g9cj: sharp 0.34.5 \u2014 docs/package-lock.json"}, "properties": {"repobilityId": "dab0ba26bd195392", "scanner": "scanner-primary", "fingerprint": "f6a2bbde51594faa", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-f88m-g3jw-g9cj"]}}, {"ruleId": "scanner-36de0c2ed510015b", "level": "error", "message": {"text": "GHSA-2p49-hgcm-8545: svgo 4.0.1 \u2014 docs/package-lock.json"}, "properties": {"repobilityId": "7f608f615ab5115f", "scanner": "scanner-primary", "fingerprint": "36de0c2ed510015b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-2p49-hgcm-8545"]}}, {"ruleId": "scanner-67b202e9c0e4566f", "level": "warning", "message": {"text": "CVE-2026-41907: uuid 11.1.0 \u2014 docs/package-lock.json"}, "properties": {"repobilityId": "eac5a34c18b9579a", "scanner": "scanner-primary", "fingerprint": "67b202e9c0e4566f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41907"]}}, {"ruleId": "scanner-f16f7d8a2c5dfcc8", "level": "error", "message": {"text": "CVE-2026-53571: vite 6.4.2 \u2014 docs/package-lock.json"}, "properties": {"repobilityId": "1ccae7155b16807f", "scanner": "scanner-primary", "fingerprint": "f16f7d8a2c5dfcc8", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-53571"]}}, {"ruleId": "scanner-4b20e5da02605d23", "level": "warning", "message": {"text": "CVE-2026-53632: vite 6.4.2 \u2014 docs/package-lock.json"}, "properties": {"repobilityId": "77c23345ad2195d3", "scanner": "scanner-primary", "fingerprint": "4b20e5da02605d23", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-53632"]}}, {"ruleId": "scanner-6c85fb0962ff2697", "level": "none", "message": {"text": "CVE-2026-39824: golang.org/x/sys v0.42.0 \u2014 go.mod"}, "properties": {"repobilityId": "5b2209217656c7eb", "scanner": "scanner-primary", "fingerprint": "6c85fb0962ff2697", "layer": "security", "severity": "info", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-39824"]}}, {"ruleId": "scanner-0bbf9cc87ff5f77c", "level": "none", "message": {"text": "CVE-2026-56852: golang.org/x/text v0.3.8 \u2014 go.mod"}, "properties": {"repobilityId": "b7935bed016c2ddc", "scanner": "scanner-primary", "fingerprint": "0bbf9cc87ff5f77c", "layer": "security", "severity": "info", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-56852"]}}, {"ruleId": "scanner-2679282aa1c484b5", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: AGENTS.md"}, "properties": {"repobilityId": "27d579812e6be614", "scanner": "scanner-primary", "fingerprint": "2679282aa1c484b5", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "agents_md"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "AGENTS.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-391723a33532511b", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: docs/src/content/docs/guides/agents.md"}, "properties": {"repobilityId": "6ced6ffe52d11471", "scanner": "scanner-primary", "fingerprint": "391723a33532511b", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "agents_md"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/src/content/docs/guides/agents.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b92c4e9abaf68b10", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/no-mistakes/SKILL.md"}, "properties": {"repobilityId": "3ef18e4297ef5fb1", "scanner": "scanner-primary", "fingerprint": "b92c4e9abaf68b10", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/no-mistakes/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e2313e687d4ce67a", "level": "warning", "message": {"text": "SkillSpector EA2 (excessive-agency) in skills/no-mistakes/SKILL.md"}, "properties": {"repobilityId": "44f555b42dd171ae", "scanner": "scanner-primary", "fingerprint": "e2313e687d4ce67a", "layer": "security", "severity": "medium", "confidence": 0.75, "tags": ["skillspector", "mcp-skill", "excessive-agency", "EA2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/no-mistakes/SKILL.md"}, "region": {"startLine": 243}}}]}, {"ruleId": "scanner-e637c415447867e4", "level": "none", "message": {"text": "Run SkillSpector's LLM-backed analysis in your own pipeline"}, "properties": {"repobilityId": "1936f198ff5212bf", "scanner": "scanner-primary", "fingerprint": "e637c415447867e4", "layer": "security", "severity": "info", "confidence": 1.0, "tags": ["skillspector", "mcp-skill", "llm-advisory", "ai-coder"]}}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-0763d85002569570", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b7fbe10e69a41ea0", "scanner": "scanner-primary", "fingerprint": "0763d85002569570", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docs.yml"}, "region": {"startLine": 30}}}]}, {"ruleId": "scanner-14ce8614dd03f409", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "81c5c697653f94e8", "scanner": "scanner-primary", "fingerprint": "14ce8614dd03f409", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docs.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1838a141491ce38c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "b8fd4f5048f96576", "scanner": "scanner-primary", "fingerprint": "1838a141491ce38c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5aa41261c1c36fcd", "level": "note", "message": {"text": "Very large file: internal/daemon/service_test.go (1637 lines)"}, "properties": {"repobilityId": "d7f07d04ebf6d1b4", "scanner": "scanner-primary", "fingerprint": "5aa41261c1c36fcd", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-8be725f31b4ce452", "level": "note", "message": {"text": "Very large file: internal/pipeline/steps/pr_test.go (1914 lines)"}, "properties": {"repobilityId": "446396503d37885a", "scanner": "scanner-primary", "fingerprint": "8be725f31b4ce452", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-413e7ee144eb95ea", "level": "note", "message": {"text": "Very large file: internal/e2e/journey_test.go (2916 lines)"}, "properties": {"repobilityId": "52ff13e6fa70e865", "scanner": "scanner-primary", "fingerprint": "413e7ee144eb95ea", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "398d448a297756e1", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "31b1b3e7301c2cb1", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-33dbddce9606a8a7", "level": "error", "message": {"text": "Vulnerable dependency astro 5.18.1: GHSA-2pvr-wf23-7pc7"}, "properties": {"repobilityId": "34ac6fefd5348ad9", "scanner": "scanner-primary", "fingerprint": "33dbddce9606a8a7", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-2pvr-wf23-7pc7"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-16b8dc469c1b1808", "level": "warning", "message": {"text": "Vulnerable dependency astro 5.18.1: GHSA-4g3v-8h47-v7g6"}, "properties": {"repobilityId": "24c2f5fa4ece0b27", "scanner": "scanner-primary", "fingerprint": "16b8dc469c1b1808", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-4g3v-8h47-v7g6"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e852a14f1f64850e", "level": "note", "message": {"text": "Vulnerable dependency astro 5.18.1: GHSA-7pw4-f3q4-r2p2"}, "properties": {"repobilityId": "68f4be92e014928c", "scanner": "scanner-primary", "fingerprint": "e852a14f1f64850e", "layer": "dependencies", "severity": "low", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-7pw4-f3q4-r2p2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a193d92c198a08b0", "level": "error", "message": {"text": "Vulnerable dependency astro 5.18.1: GHSA-8hv8-536x-4wqp"}, "properties": {"repobilityId": "b1fefe2049d72e6e", "scanner": "scanner-primary", "fingerprint": "a193d92c198a08b0", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-8hv8-536x-4wqp"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2245ef5834422102", "level": "warning", "message": {"text": "Vulnerable dependency astro 5.18.1: GHSA-f48w-9m4c-m7f5"}, "properties": {"repobilityId": "822407e9d5db7ab0", "scanner": "scanner-primary", "fingerprint": "2245ef5834422102", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-f48w-9m4c-m7f5"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fc269fd95ea0d3a5", "level": "warning", "message": {"text": "Vulnerable dependency astro 5.18.1: GHSA-j687-52p2-xcff"}, "properties": {"repobilityId": "8bb1503868c6e3ce", "scanner": "scanner-primary", "fingerprint": "fc269fd95ea0d3a5", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-j687-52p2-xcff"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5401574d8556a41d", "level": "warning", "message": {"text": "Vulnerable dependency astro 5.18.1: GHSA-jrpj-wcv7-9fh9"}, "properties": {"repobilityId": "146c1e16cf83cc4c", "scanner": "scanner-primary", "fingerprint": "5401574d8556a41d", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-jrpj-wcv7-9fh9"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-665d876b2426b07d", "level": "warning", "message": {"text": "Vulnerable dependency astro 5.18.1: GHSA-xr5h-phrj-8vxv"}, "properties": {"repobilityId": "026730fc2085f1ad", "scanner": "scanner-primary", "fingerprint": "665d876b2426b07d", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-xr5h-phrj-8vxv"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ce2e59efd114906", "level": "error", "message": {"text": "Vulnerable dependency sharp 0.34.5: GHSA-f88m-g3jw-g9cj"}, "properties": {"repobilityId": "c3222d5482f512fc", "scanner": "scanner-primary", "fingerprint": "3ce2e59efd114906", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-f88m-g3jw-g9cj"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ee72dab292d6251b", "level": "warning", "message": {"text": "Vulnerable dependency mermaid 11.14.0: GHSA-6m6c-36f7-fhxh"}, "properties": {"repobilityId": "c2432a300de057ef", "scanner": "scanner-primary", "fingerprint": "ee72dab292d6251b", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-6m6c-36f7-fhxh"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cf7634f2dd14d04c", "level": "warning", "message": {"text": "Vulnerable dependency mermaid 11.14.0: GHSA-87f9-hvmw-gh4p"}, "properties": {"repobilityId": "e1b3aa347542de5e", "scanner": "scanner-primary", "fingerprint": "cf7634f2dd14d04c", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-87f9-hvmw-gh4p"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0914052326e4dacd", "level": "warning", "message": {"text": "Vulnerable dependency mermaid 11.14.0: GHSA-ghcm-xqfw-q4vr"}, "properties": {"repobilityId": "225d6303f90867e6", "scanner": "scanner-primary", "fingerprint": "0914052326e4dacd", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-ghcm-xqfw-q4vr"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7ac14bbc183da66c", "level": "warning", "message": {"text": "Vulnerable dependency mermaid 11.14.0: GHSA-xcj9-5m2h-648r"}, "properties": {"repobilityId": "9e863977192fcd66", "scanner": "scanner-primary", "fingerprint": "7ac14bbc183da66c", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-xcj9-5m2h-648r"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8f65193e7551d466", "level": "error", "message": {"text": "Vulnerable dependency sharp 0.33.5: GHSA-f88m-g3jw-g9cj"}, "properties": {"repobilityId": "6c3bf580e2715ee7", "scanner": "scanner-primary", "fingerprint": "8f65193e7551d466", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-f88m-g3jw-g9cj"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1267cf8c43a6708c", "level": "note", "message": {"text": "Vulnerable dependency esbuild 0.27.7: GHSA-g7r4-m6w7-qqqr"}, "properties": {"repobilityId": "dbc426c2dd693105", "scanner": "scanner-primary", "fingerprint": "1267cf8c43a6708c", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-g7r4-m6w7-qqqr", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7b0fbf928ba63a72", "level": "error", "message": {"text": "Vulnerable dependency devalue 5.7.1: GHSA-77vg-94rm-hx3p"}, "properties": {"repobilityId": "edec8e1bfd134b8f", "scanner": "scanner-primary", "fingerprint": "7b0fbf928ba63a72", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-77vg-94rm-hx3p", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a6524951736babfc", "level": "warning", "message": {"text": "Vulnerable dependency dompurify 3.4.0: GHSA-76mc-f452-cxcm"}, "properties": {"repobilityId": "875f3c35d0cef567", "scanner": "scanner-primary", "fingerprint": "a6524951736babfc", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-76mc-f452-cxcm", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d75d49de3661f953", "level": "note", "message": {"text": "Vulnerable dependency dompurify 3.4.0: GHSA-c2j3-45gr-mqc4"}, "properties": {"repobilityId": "15299ad5f146d9b2", "scanner": "scanner-primary", "fingerprint": "d75d49de3661f953", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-c2j3-45gr-mqc4", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-27a9482c0f1541d1", "level": "warning", "message": {"text": "Vulnerable dependency dompurify 3.4.0: GHSA-cmwh-pvxp-8882"}, "properties": {"repobilityId": "ec23a71e7510eb6a", "scanner": "scanner-primary", "fingerprint": "27a9482c0f1541d1", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-cmwh-pvxp-8882", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-da4b52a380305a9e", "level": "note", "message": {"text": "Vulnerable dependency dompurify 3.4.0: GHSA-gvmj-g25r-r7wr"}, "properties": {"repobilityId": "e3ce61c931d66aab", "scanner": "scanner-primary", "fingerprint": "da4b52a380305a9e", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-gvmj-g25r-r7wr", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ed69216980d117e9", "level": "warning", "message": {"text": "Vulnerable dependency dompurify 3.4.0: GHSA-hpcv-96wg-7vj8"}, "properties": {"repobilityId": "af54c2c1573bbdc1", "scanner": "scanner-primary", "fingerprint": "ed69216980d117e9", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-hpcv-96wg-7vj8", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e65573a17b276078", "level": "warning", "message": {"text": "Vulnerable dependency dompurify 3.4.0: GHSA-r47g-fvhr-h676"}, "properties": {"repobilityId": "41375b226e6d1e6d", "scanner": "scanner-primary", "fingerprint": "e65573a17b276078", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-r47g-fvhr-h676", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c891a9d7b29d2f9e", "level": "warning", "message": {"text": "Vulnerable dependency dompurify 3.4.0: GHSA-rp9w-3fw7-7cwq"}, "properties": {"repobilityId": "c1d0c0010147e1f9", "scanner": "scanner-primary", "fingerprint": "c891a9d7b29d2f9e", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-rp9w-3fw7-7cwq", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a98542c8fe2d942e", "level": "note", "message": {"text": "Vulnerable dependency dompurify 3.4.0: GHSA-vxr8-fq34-vvx9"}, "properties": {"repobilityId": "6a57c89793b078d1", "scanner": "scanner-primary", "fingerprint": "a98542c8fe2d942e", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-vxr8-fq34-vvx9", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-85513c6ef743f6c9", "level": "note", "message": {"text": "Vulnerable dependency dompurify 3.4.0: GHSA-x4vx-rjvf-j5p4"}, "properties": {"repobilityId": "c1d913cf1c1ad6e6", "scanner": "scanner-primary", "fingerprint": "85513c6ef743f6c9", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-x4vx-rjvf-j5p4", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7a1c7ea0c5f161f1", "level": "error", "message": {"text": "Vulnerable dependency js-yaml 4.1.1: GHSA-52cp-r559-cp3m"}, "properties": {"repobilityId": "bb9354b1169e66e2", "scanner": "scanner-primary", "fingerprint": "7a1c7ea0c5f161f1", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-52cp-r559-cp3m", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0af295999bb8b8cb", "level": "warning", "message": {"text": "Vulnerable dependency js-yaml 4.1.1: GHSA-h67p-54hq-rp68"}, "properties": {"repobilityId": "2e7af66f705e9148", "scanner": "scanner-primary", "fingerprint": "0af295999bb8b8cb", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-h67p-54hq-rp68", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-60c3f448a9ccc679", "level": "warning", "message": {"text": "Dependency astro is two or more major versions behind"}, "properties": {"repobilityId": "88d034a3d52dbbb3", "scanner": "scanner-primary", "fingerprint": "60c3f448a9ccc679", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/package.json"}, "region": {"startLine": 1}}}]}]}]}