Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo

mikechao/metmuseum-mcp

https://github.com/mikechao/metmuseum-mcp · scanned 2026-09-12 19:55 UTC (1 month, 2 weeks ago)

174 raw signals (0 security + 174 graph)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 1 month, 2 weeks ago · v1 · 174 actionable findings from 1 signal source. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON
Combined
60.1
/100
Security checks
60
0 findings
System graph
60
80.0% cov · 174 findings
Critical
0
click to filter
Agents
10
0 votes
Crowd
0
reported
Severity distribution — click a segment to filter
Active filters: layer: dependencies × excluding tests × Reset all
Severity: Critical 0 High 43 Medium 117 Low 13 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 0 System graph 174 Crowd 0 Layer: Security 66 Quality 7 Hardware 2 Cicd 2 Dependencies 97
Scan summary Repository scanned at 60.1/100 with 80.0% coverage. It contains 216 nodes across 1 cross-layer flows, written primarily in mixed languages. Engine surfaced 174 findings — concentrated in dependencies (97), security (66), quality (7). Risk profile is high: 0 critical, 43 high, 117 medium. Recommended next step: open the dependencies layer findings first — that's where the highest-impact wins live.

Showing 97 of 174 actionable findings. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

high System graph dependencies dependencies conf 0.90 Vulnerable dependency brace-expansion 1.1.12: GHSA-3jxr-9vmj-r5cp
OSV.dev reports `brace-expansion` at version `1.1.12` (resolved in `pnpm-lock.yaml`) is affected by GHSA-3jxr-9vmj-r5cp (aka CVE-2026-13149). Note: `brace-expansion` is a transitive dependency — pulled in by another package, not declared directly in a manifest. brace-expansion: DoS via exponential…
pnpm-lock.yaml ScaOsvGhsa 3jxr 9vmj r5cp
high System graph dependencies dependencies conf 0.90 Vulnerable dependency brace-expansion 1.1.12: GHSA-mh99-v99m-4gvg
OSV.dev reports `brace-expansion` at version `1.1.12` (resolved in `pnpm-lock.yaml`) is affected by GHSA-mh99-v99m-4gvg (aka CVE-2026-14257). Note: `brace-expansion` is a transitive dependency — pulled in by another package, not declared directly in a manifest. brace-expansion: DoS via unbounded e…
pnpm-lock.yaml ScaOsvGhsa mh99 v99m 4gvg
high System graph dependencies dependencies conf 0.90 Vulnerable dependency brace-expansion 1.1.12: GHSA-rgw5-rvv9-x895
OSV.dev reports `brace-expansion` at version `1.1.12` (resolved in `pnpm-lock.yaml`) is affected by GHSA-rgw5-rvv9-x895 (aka CVE-2026-69152). Note: `brace-expansion` is a transitive dependency — pulled in by another package, not declared directly in a manifest. brace-expansion: DoS via unbounded i…
pnpm-lock.yaml ScaOsvGhsa rgw5 rvv9 x895
high System graph dependencies dependencies conf 0.90 Vulnerable dependency brace-expansion 2.0.2: GHSA-3jxr-9vmj-r5cp
OSV.dev reports `brace-expansion` at version `2.0.2` (resolved in `pnpm-lock.yaml`) is affected by GHSA-3jxr-9vmj-r5cp (aka CVE-2026-13149). Note: `brace-expansion` is a transitive dependency — pulled in by another package, not declared directly in a manifest. brace-expansion: DoS via exponential-…
pnpm-lock.yaml ScaOsvGhsa 3jxr 9vmj r5cp
high System graph dependencies dependencies conf 0.90 Vulnerable dependency brace-expansion 2.0.2: GHSA-mh99-v99m-4gvg
OSV.dev reports `brace-expansion` at version `2.0.2` (resolved in `pnpm-lock.yaml`) is affected by GHSA-mh99-v99m-4gvg (aka CVE-2026-14257). Note: `brace-expansion` is a transitive dependency — pulled in by another package, not declared directly in a manifest. brace-expansion: DoS via unbounded ex…
pnpm-lock.yaml ScaOsvGhsa mh99 v99m 4gvg
high System graph dependencies dependencies conf 0.90 Vulnerable dependency brace-expansion 2.0.2: GHSA-rgw5-rvv9-x895
OSV.dev reports `brace-expansion` at version `2.0.2` (resolved in `pnpm-lock.yaml`) is affected by GHSA-rgw5-rvv9-x895 (aka CVE-2026-69152). Note: `brace-expansion` is a transitive dependency — pulled in by another package, not declared directly in a manifest. brace-expansion: DoS via unbounded in…
pnpm-lock.yaml ScaOsvGhsa rgw5 rvv9 x895
high System graph dependencies dependencies conf 0.90 Vulnerable dependency browserslist 4.28.1: GHSA-73wf-gq98-2v4g
OSV.dev reports `browserslist` at version `4.28.1` (resolved in `pnpm-lock.yaml`) is affected by GHSA-73wf-gq98-2v4g (aka CVE-2026-73088). Note: `browserslist` is a transitive dependency — pulled in by another package, not declared directly in a manifest. Browserslist: Uncaught crash / prototype w…
pnpm-lock.yaml ScaOsvGhsa 73wf gq98 2v4g
high System graph dependencies dependencies conf 0.90 Vulnerable dependency browserslist 4.28.1: GHSA-c83g-rgw3-j3cx
OSV.dev reports `browserslist` at version `4.28.1` (resolved in `pnpm-lock.yaml`) is affected by GHSA-c83g-rgw3-j3cx (aka CVE-2026-73089). Note: `browserslist` is a transitive dependency — pulled in by another package, not declared directly in a manifest. Browserslist: Unbounded memory growth (no …
pnpm-lock.yaml ScaOsvGhsa c83g rgw3 j3cx
high System graph dependencies dependencies conf 0.90 Vulnerable dependency express-rate-limit 8.2.1: GHSA-46wh-pxpv-q5gq
OSV.dev reports `express-rate-limit` at version `8.2.1` (resolved in `pnpm-lock.yaml`) is affected by GHSA-46wh-pxpv-q5gq (aka CVE-2026-30827). Note: `express-rate-limit` is a transitive dependency — pulled in by another package, not declared directly in a manifest. express-rate-limit: IPv4-mapped…
pnpm-lock.yaml ScaOsvGhsa 46wh pxpv q5gq
high System graph dependencies dependencies conf 0.90 Vulnerable dependency fast-uri 3.1.0: GHSA-4c8g-83qw-93j6
OSV.dev reports `fast-uri` at version `3.1.0` (resolved in `pnpm-lock.yaml`) is affected by GHSA-4c8g-83qw-93j6 (aka CVE-2026-13676). Note: `fast-uri` is a transitive dependency — pulled in by another package, not declared directly in a manifest. fast-uri vulnerable to host confusion via failed ID…
pnpm-lock.yaml ScaOsvGhsa 4c8g 83qw 93j6
high System graph dependencies dependencies conf 0.90 Vulnerable dependency flatted 3.3.3: GHSA-25h7-pfq9-p65f
OSV.dev reports `flatted` at version `3.3.3` (resolved in `pnpm-lock.yaml`) is affected by GHSA-25h7-pfq9-p65f (aka CVE-2026-32141). Note: `flatted` is a transitive dependency — pulled in by another package, not declared directly in a manifest. flatted vulnerable to unbounded recursion DoS in pars…
pnpm-lock.yaml ScaOsvGhsa 25h7 pfq9 p65f
high System graph dependencies dependencies conf 0.90 Vulnerable dependency js-yaml 4.1.1: GHSA-2883-xcg3-v3hh
OSV.dev reports `js-yaml` at version `4.1.1` (resolved in `pnpm-lock.yaml`) is affected by GHSA-2883-xcg3-v3hh (aka CVE-2026-84375). Note: `js-yaml` is a transitive dependency — pulled in by another package, not declared directly in a manifest. js-yaml: maxTotalMergeKeys does not limit CPU use for…
pnpm-lock.yaml ScaOsvGhsa 2883 xcg3 v3hh
high System graph dependencies dependencies conf 0.90 Vulnerable dependency js-yaml 4.1.1: GHSA-52cp-r559-cp3m
OSV.dev reports `js-yaml` at version `4.1.1` (resolved in `pnpm-lock.yaml`) is affected by GHSA-52cp-r559-cp3m (aka CVE-2026-59869). Note: `js-yaml` is a transitive dependency — pulled in by another package, not declared directly in a manifest. js-yaml: YAML merge-key chains can force quadratic CP…
pnpm-lock.yaml ScaOsvGhsa 52cp r559 cp3m
high System graph dependencies dependencies conf 0.90 Vulnerable dependency js-yaml 4.1.1: GHSA-5p4m-2wfm-xmqj
OSV.dev reports `js-yaml` at version `4.1.1` (resolved in `pnpm-lock.yaml`) is affected by GHSA-5p4m-2wfm-xmqj. Note: `js-yaml` is a transitive dependency — pulled in by another package, not declared directly in a manifest. JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CV…
pnpm-lock.yaml ScaOsvGhsa 5p4m 2wfm xmqj
high System graph dependencies dependencies conf 0.90 Vulnerable dependency minimatch 3.1.2: GHSA-23c5-xmqv-rm74
OSV.dev reports `minimatch` at version `3.1.2` (resolved in `pnpm-lock.yaml`) is affected by GHSA-23c5-xmqv-rm74 (aka CVE-2026-27904). Note: `minimatch` is a transitive dependency — pulled in by another package, not declared directly in a manifest. minimatch ReDoS: nested *() extglobs generate cat…
pnpm-lock.yaml ScaOsvGhsa 23c5 xmqv rm74
high System graph dependencies dependencies conf 0.90 Vulnerable dependency minimatch 3.1.2: GHSA-3ppc-4f35-3m26
OSV.dev reports `minimatch` at version `3.1.2` (resolved in `pnpm-lock.yaml`) is affected by GHSA-3ppc-4f35-3m26 (aka CVE-2026-26996). Note: `minimatch` is a transitive dependency — pulled in by another package, not declared directly in a manifest. minimatch has a ReDoS via repeated wildcards with…
pnpm-lock.yaml ScaOsvGhsa 3ppc 4f35 3m26
high System graph dependencies dependencies conf 0.90 Vulnerable dependency minimatch 3.1.2: GHSA-7r86-cg39-jmmj
OSV.dev reports `minimatch` at version `3.1.2` (resolved in `pnpm-lock.yaml`) is affected by GHSA-7r86-cg39-jmmj (aka CVE-2026-27903). Note: `minimatch` is a transitive dependency — pulled in by another package, not declared directly in a manifest. minimatch has ReDoS: matchOne() combinatorial bac…
pnpm-lock.yaml ScaOsvGhsa 7r86 cg39 jmmj
high System graph dependencies dependencies conf 0.90 Vulnerable dependency minimatch 9.0.5: GHSA-23c5-xmqv-rm74
OSV.dev reports `minimatch` at version `9.0.5` (resolved in `pnpm-lock.yaml`) is affected by GHSA-23c5-xmqv-rm74 (aka CVE-2026-27904). Note: `minimatch` is a transitive dependency — pulled in by another package, not declared directly in a manifest. minimatch ReDoS: nested *() extglobs generate cat…
pnpm-lock.yaml ScaOsvGhsa 23c5 xmqv rm74
high System graph dependencies dependencies conf 0.90 Vulnerable dependency minimatch 9.0.5: GHSA-3ppc-4f35-3m26
OSV.dev reports `minimatch` at version `9.0.5` (resolved in `pnpm-lock.yaml`) is affected by GHSA-3ppc-4f35-3m26 (aka CVE-2026-26996). Note: `minimatch` is a transitive dependency — pulled in by another package, not declared directly in a manifest. minimatch has a ReDoS via repeated wildcards with…
pnpm-lock.yaml ScaOsvGhsa 3ppc 4f35 3m26
high System graph dependencies dependencies conf 0.90 Vulnerable dependency minimatch 9.0.5: GHSA-7r86-cg39-jmmj
OSV.dev reports `minimatch` at version `9.0.5` (resolved in `pnpm-lock.yaml`) is affected by GHSA-7r86-cg39-jmmj (aka CVE-2026-27903). Note: `minimatch` is a transitive dependency — pulled in by another package, not declared directly in a manifest. minimatch has ReDoS: matchOne() combinatorial bac…
pnpm-lock.yaml ScaOsvGhsa 7r86 cg39 jmmj
high System graph dependencies dependencies conf 0.90 Vulnerable dependency nanoid 3.3.11: GHSA-28wg-ghj8-5hjv
OSV.dev reports `nanoid` at version `3.3.11` (resolved in `pnpm-lock.yaml`) is affected by GHSA-28wg-ghj8-5hjv (aka CVE-2026-67214). Note: `nanoid` is a transitive dependency — pulled in by another package, not declared directly in a manifest. nanoid: non-secure generators can loop indefinitely wi…
pnpm-lock.yaml ScaOsvGhsa 28wg ghj8 5hjv
high System graph dependencies dependencies conf 0.90 Vulnerable dependency nanoid 3.3.11: GHSA-2v37-7h3g-55p8
OSV.dev reports `nanoid` at version `3.3.11` (resolved in `pnpm-lock.yaml`) is affected by GHSA-2v37-7h3g-55p8 (aka CVE-2026-67213). Note: `nanoid` is a transitive dependency — pulled in by another package, not declared directly in a manifest. nanoid: custom generators can loop indefinitely when s…
pnpm-lock.yaml ScaOsvGhsa 2v37 7h3g 55p8
high System graph dependencies dependencies conf 0.90 Vulnerable dependency picomatch 2.3.1: GHSA-c2c7-rcm5-vvqj
OSV.dev reports `picomatch` at version `2.3.1` (resolved in `pnpm-lock.yaml`) is affected by GHSA-c2c7-rcm5-vvqj (aka CVE-2026-33671). Note: `picomatch` is a transitive dependency — pulled in by another package, not declared directly in a manifest. Picomatch has a ReDoS vulnerability via extglob q…
pnpm-lock.yaml ScaOsvGhsa c2c7 rcm5 vvqj
high System graph dependencies dependencies conf 0.90 Vulnerable dependency picomatch 4.0.3: GHSA-c2c7-rcm5-vvqj
OSV.dev reports `picomatch` at version `4.0.3` (resolved in `pnpm-lock.yaml`) is affected by GHSA-c2c7-rcm5-vvqj (aka CVE-2026-33671). Note: `picomatch` is a transitive dependency — pulled in by another package, not declared directly in a manifest. Picomatch has a ReDoS vulnerability via extglob q…
pnpm-lock.yaml ScaOsvGhsa c2c7 rcm5 vvqj
high System graph dependencies dependencies conf 0.90 Vulnerable dependency postcss 8.5.6: GHSA-6g55-p6wh-862q
OSV.dev reports `postcss` at version `8.5.6` (resolved in `pnpm-lock.yaml`) is affected by GHSA-6g55-p6wh-862q (aka CVE-2026-45623). Note: `postcss` is a transitive dependency — pulled in by another package, not declared directly in a manifest. PostCSS: Arbitrary file read and information disclosu…
pnpm-lock.yaml ScaOsvGhsa 6g55 p6wh 862q
high System graph dependencies dependencies conf 0.90 Vulnerable dependency postcss 8.5.6: GHSA-r28c-9q8g-f849
OSV.dev reports `postcss` at version `8.5.6` (resolved in `pnpm-lock.yaml`) is affected by GHSA-r28c-9q8g-f849 (aka CVE-2026-73646). Note: `postcss` is a transitive dependency — pulled in by another package, not declared directly in a manifest. PostCSS: Path Traversal in Previous Source Map Auto-L…
pnpm-lock.yaml ScaOsvGhsa r28c 9q8g f849
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency @hono/node-server 1.19.9: GHSA-92pp-h63x-v22m
OSV.dev reports `@hono/node-server` at version `1.19.9` (resolved in `pnpm-lock.yaml`) is affected by GHSA-92pp-h63x-v22m. Note: `@hono/node-server` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/…
pnpm-lock.yaml ScaOsvGhsa 92pp h63x v22m
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency @hono/node-server 1.19.9: GHSA-frvp-7c67-39w9
OSV.dev reports `@hono/node-server` at version `1.19.9` (resolved in `pnpm-lock.yaml`) is affected by GHSA-frvp-7c67-39w9. Note: `@hono/node-server` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/…
pnpm-lock.yaml ScaOsvGhsa frvp 7c67 39w9
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency @hono/node-server 1.19.9: GHSA-wc8c-qw6v-h7f6
OSV.dev reports `@hono/node-server` at version `1.19.9` (resolved in `pnpm-lock.yaml`) is affected by GHSA-wc8c-qw6v-h7f6. Note: `@hono/node-server` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/…
pnpm-lock.yaml ScaOsvGhsa wc8c qw6v h7f6
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency @humanfs/node 0.16.7: GHSA-p498-v437-472g
OSV.dev reports `@humanfs/node` at version `0.16.7` (resolved in `pnpm-lock.yaml`) is affected by GHSA-p498-v437-472g. Note: `@humanfs/node` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerab…
pnpm-lock.yaml ScaOsvGhsa p498 v437 472g
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency ajv 6.12.6: GHSA-2g4f-4pwh-qvx6
OSV.dev reports `ajv` at version `6.12.6` (resolved in `pnpm-lock.yaml`) is affected by GHSA-2g4f-4pwh-qvx6 (aka CVE-2025-69873). Note: `ajv` is a transitive dependency — pulled in by another package, not declared directly in a manifest. ajv has ReDoS when using `$data` option Aliases: CVE-2025-6…
pnpm-lock.yaml ScaOsvGhsa 2g4f 4pwh qvx6
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency ajv 8.17.1: GHSA-2g4f-4pwh-qvx6
OSV.dev reports `ajv` at version `8.17.1` (resolved in `pnpm-lock.yaml`) is affected by GHSA-2g4f-4pwh-qvx6 (aka CVE-2025-69873). Note: `ajv` is a transitive dependency — pulled in by another package, not declared directly in a manifest. ajv has ReDoS when using `$data` option Aliases: CVE-2025-6…
pnpm-lock.yaml ScaOsvGhsa 2g4f 4pwh qvx6
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency baseline-browser-mapping 2.9.19: GHSA-w5vr-8v7q-w6rv
OSV.dev reports `baseline-browser-mapping` at version `2.9.19` (resolved in `pnpm-lock.yaml`) is affected by GHSA-w5vr-8v7q-w6rv. Note: `baseline-browser-mapping` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: ht…
pnpm-lock.yaml ScaOsvGhsa w5vr 8v7q w6rv
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency body-parser 2.2.2: GHSA-v422-hmwv-36x6
OSV.dev reports `body-parser` at version `2.2.2` (resolved in `pnpm-lock.yaml`) is affected by GHSA-v422-hmwv-36x6. Note: `body-parser` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability…
pnpm-lock.yaml ScaOsvGhsa v422 hmwv 36x6
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency brace-expansion 1.1.12: GHSA-f886-m6hf-6m8v
OSV.dev reports `brace-expansion` at version `1.1.12` (resolved in `pnpm-lock.yaml`) is affected by GHSA-f886-m6hf-6m8v (aka CVE-2026-33750). Note: `brace-expansion` is a transitive dependency — pulled in by another package, not declared directly in a manifest. brace-expansion: Zero-step sequence …
pnpm-lock.yaml ScaOsvGhsa f886 m6hf 6m8v
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency brace-expansion 2.0.2: GHSA-f886-m6hf-6m8v
OSV.dev reports `brace-expansion` at version `2.0.2` (resolved in `pnpm-lock.yaml`) is affected by GHSA-f886-m6hf-6m8v (aka CVE-2026-33750). Note: `brace-expansion` is a transitive dependency — pulled in by another package, not declared directly in a manifest. brace-expansion: Zero-step sequence c…
pnpm-lock.yaml ScaOsvGhsa f886 m6hf 6m8v
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency esbuild 0.24.2: GHSA-67mh-4wv8-2f99
OSV.dev reports `esbuild` at version `0.24.2` (resolved in `pnpm-lock.yaml`) is affected by GHSA-67mh-4wv8-2f99. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-67mh-4wv8-2f99 Fix: upgrade `esbuild` past the affected range per the advisory.
package.json ScaOsvGhsa 67mh 4wv8 2f99
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency fast-uri 3.1.0: GHSA-7p8r-x3mc-p8w7
OSV.dev reports `fast-uri` at version `3.1.0` (resolved in `pnpm-lock.yaml`) is affected by GHSA-7p8r-x3mc-p8w7. Note: `fast-uri` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-…
pnpm-lock.yaml ScaOsvGhsa 7p8r x3mc p8w7
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency fast-uri 3.1.0: GHSA-f65p-4m7j-42xc
OSV.dev reports `fast-uri` at version `3.1.0` (resolved in `pnpm-lock.yaml`) is affected by GHSA-f65p-4m7j-42xc. Note: `fast-uri` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-…
pnpm-lock.yaml ScaOsvGhsa f65p 4m7j 42xc
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency fast-uri 3.1.0: GHSA-jqff-g426-hqxp
OSV.dev reports `fast-uri` at version `3.1.0` (resolved in `pnpm-lock.yaml`) is affected by GHSA-jqff-g426-hqxp. Note: `fast-uri` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-…
pnpm-lock.yaml ScaOsvGhsa jqff g426 hqxp
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency fast-uri 3.1.0: GHSA-q3j6-qgpj-74h6
OSV.dev reports `fast-uri` at version `3.1.0` (resolved in `pnpm-lock.yaml`) is affected by GHSA-q3j6-qgpj-74h6. Note: `fast-uri` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-…
pnpm-lock.yaml ScaOsvGhsa q3j6 qgpj 74h6
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency fast-uri 3.1.0: GHSA-v2hh-gcrm-f6hx
OSV.dev reports `fast-uri` at version `3.1.0` (resolved in `pnpm-lock.yaml`) is affected by GHSA-v2hh-gcrm-f6hx. Note: `fast-uri` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-…
pnpm-lock.yaml ScaOsvGhsa v2hh gcrm f6hx
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency fast-uri 3.1.0: GHSA-v39h-62p7-jpjc
OSV.dev reports `fast-uri` at version `3.1.0` (resolved in `pnpm-lock.yaml`) is affected by GHSA-v39h-62p7-jpjc. Note: `fast-uri` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-…
pnpm-lock.yaml ScaOsvGhsa v39h 62p7 jpjc
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency flatted 3.3.3: GHSA-rf6f-7fwh-wjgh
OSV.dev reports `flatted` at version `3.3.3` (resolved in `pnpm-lock.yaml`) is affected by GHSA-rf6f-7fwh-wjgh. Note: `flatted` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-rf…
pnpm-lock.yaml ScaOsvGhsa rf6f 7fwh wjgh
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency hono 4.11.8: GHSA-26pp-8wgv-hjvm
OSV.dev reports `hono` at version `4.11.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-26pp-8wgv-hjvm (aka CVE-2026-56762). Note: `hono` is a transitive dependency — pulled in by another package, not declared directly in a manifest. Hono missing validation of cookie name on write path in se…
pnpm-lock.yaml ScaOsvGhsa 26pp 8wgv hjvm
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency hono 4.11.8: GHSA-2gcr-mfcq-wcc3
OSV.dev reports `hono` at version `4.11.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-2gcr-mfcq-wcc3 (aka CVE-2026-47676). Note: `hono` is a transitive dependency — pulled in by another package, not declared directly in a manifest. Hono: app.mount() strips mount prefix using undecoded path…
pnpm-lock.yaml ScaOsvGhsa 2gcr mfcq wcc3
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency hono 4.11.8: GHSA-3hrh-pfw6-9m5x
OSV.dev reports `hono` at version `4.11.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-3hrh-pfw6-9m5x (aka CVE-2026-47675). Note: `hono` is a transitive dependency — pulled in by another package, not declared directly in a manifest. Hono: Cookie helper does not sanitize sameSite and priorit…
pnpm-lock.yaml ScaOsvGhsa 3hrh pfw6 9m5x
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency hono 4.11.8: GHSA-458j-xx4x-4375
OSV.dev reports `hono` at version `4.11.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-458j-xx4x-4375 (aka CVE-2026-56761). Note: `hono` is a transitive dependency — pulled in by another package, not declared directly in a manifest. hono Improperly Handles JSX Attribute Names Allows HTML In…
pnpm-lock.yaml ScaOsvGhsa 458j xx4x 4375
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency hono 4.11.8: GHSA-5pq2-9x2x-5p6w
OSV.dev reports `hono` at version `4.11.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-5pq2-9x2x-5p6w (aka CVE-2026-29086). Note: `hono` is a transitive dependency — pulled in by another package, not declared directly in a manifest. Hono Vulnerable to Cookie Attribute Injection via Unsaniti…
pnpm-lock.yaml ScaOsvGhsa 5pq2 9x2x 5p6w
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency hono 4.11.8: GHSA-69xw-7hcm-h432
OSV.dev reports `hono` at version `4.11.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-69xw-7hcm-h432. Note: `hono` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-69xw-7h…
pnpm-lock.yaml ScaOsvGhsa 69xw 7hcm h432
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency hono 4.11.8: GHSA-79qm-7rj5-m7r9
OSV.dev reports `hono` at version `4.11.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-79qm-7rj5-m7r9. Note: `hono` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-79qm-7r…
pnpm-lock.yaml ScaOsvGhsa 79qm 7rj5 m7r9
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency hono 4.11.8: GHSA-88fw-hqm2-52qc
OSV.dev reports `hono` at version `4.11.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-88fw-hqm2-52qc. Note: `hono` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-88fw-hq…
pnpm-lock.yaml ScaOsvGhsa 88fw hqm2 52qc
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency hono 4.11.8: GHSA-8j4g-w8fx-2239
OSV.dev reports `hono` at version `4.11.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-8j4g-w8fx-2239. Note: `hono` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-8j4g-w8…
pnpm-lock.yaml ScaOsvGhsa 8j4g w8fx 2239
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency hono 4.11.8: GHSA-9vqf-7f2p-gf9v
OSV.dev reports `hono` at version `4.11.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-9vqf-7f2p-gf9v. Note: `hono` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-9vqf-7f…
pnpm-lock.yaml ScaOsvGhsa 9vqf 7f2p gf9v
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency hono 4.11.8: GHSA-crvj-82cr-hjcx
OSV.dev reports `hono` at version `4.11.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-crvj-82cr-hjcx. Note: `hono` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-crvj-82…
pnpm-lock.yaml ScaOsvGhsa crvj 82cr hjcx
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency hono 4.11.8: GHSA-f23p-vx2j-j53r
OSV.dev reports `hono` at version `4.11.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-f23p-vx2j-j53r. Note: `hono` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-f23p-vx…
pnpm-lock.yaml ScaOsvGhsa f23p vx2j j53r
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency hono 4.11.8: GHSA-f577-qrjj-4474
OSV.dev reports `hono` at version `4.11.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-f577-qrjj-4474. Note: `hono` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-f577-qr…
pnpm-lock.yaml ScaOsvGhsa f577 qrjj 4474
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency hono 4.11.8: GHSA-g6gw-c38x-mqfc
OSV.dev reports `hono` at version `4.11.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-g6gw-c38x-mqfc. Note: `hono` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-g6gw-c3…
pnpm-lock.yaml ScaOsvGhsa g6gw c38x mqfc
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency hono 4.11.8: GHSA-gq3j-xvxp-8hrf
OSV.dev reports `hono` at version `4.11.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-gq3j-xvxp-8hrf. Note: `hono` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-gq3j-xv…
pnpm-lock.yaml ScaOsvGhsa gq3j xvxp 8hrf
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency hono 4.11.8: GHSA-gqvv-2mrq-wpjv
OSV.dev reports `hono` at version `4.11.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-gqvv-2mrq-wpjv. Note: `hono` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-gqvv-2m…
pnpm-lock.yaml ScaOsvGhsa gqvv 2mrq wpjv
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency hono 4.11.8: GHSA-hm8q-7f3q-5f36
OSV.dev reports `hono` at version `4.11.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-hm8q-7f3q-5f36. Note: `hono` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-hm8q-7f…
pnpm-lock.yaml ScaOsvGhsa hm8q 7f3q 5f36
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency hono 4.11.8: GHSA-hvrm-45r6-mjfj
OSV.dev reports `hono` at version `4.11.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-hvrm-45r6-mjfj. Note: `hono` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-hvrm-45…
pnpm-lock.yaml ScaOsvGhsa hvrm 45r6 mjfj
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency hono 4.11.8: GHSA-j6c9-x7qj-28xf
OSV.dev reports `hono` at version `4.11.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-j6c9-x7qj-28xf. Note: `hono` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-j6c9-x7…
pnpm-lock.yaml ScaOsvGhsa j6c9 x7qj 28xf
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency hono 4.11.8: GHSA-p6xx-57qc-3wxr
OSV.dev reports `hono` at version `4.11.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-p6xx-57qc-3wxr. Note: `hono` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-p6xx-57…
pnpm-lock.yaml ScaOsvGhsa p6xx 57qc 3wxr
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency hono 4.11.8: GHSA-p77w-8qqv-26rm
OSV.dev reports `hono` at version `4.11.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-p77w-8qqv-26rm. Note: `hono` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-p77w-8q…
pnpm-lock.yaml ScaOsvGhsa p77w 8qqv 26rm
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency hono 4.11.8: GHSA-q5qw-h33p-qvwr
OSV.dev reports `hono` at version `4.11.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-q5qw-h33p-qvwr. Note: `hono` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-q5qw-h3…
pnpm-lock.yaml ScaOsvGhsa q5qw h33p qvwr
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency hono 4.11.8: GHSA-qp7p-654g-cw7p
OSV.dev reports `hono` at version `4.11.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-qp7p-654g-cw7p. Note: `hono` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-qp7p-65…
pnpm-lock.yaml ScaOsvGhsa qp7p 654g cw7p
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency hono 4.11.8: GHSA-r5rp-j6wh-rvv4
OSV.dev reports `hono` at version `4.11.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-r5rp-j6wh-rvv4. Note: `hono` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-r5rp-j6…
pnpm-lock.yaml ScaOsvGhsa r5rp j6wh rvv4
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency hono 4.11.8: GHSA-rv63-4mwf-qqc2
OSV.dev reports `hono` at version `4.11.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-rv63-4mwf-qqc2. Note: `hono` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-rv63-4m…
pnpm-lock.yaml ScaOsvGhsa rv63 4mwf qqc2
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency hono 4.11.8: GHSA-v8w9-8mx6-g223
OSV.dev reports `hono` at version `4.11.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-v8w9-8mx6-g223. Note: `hono` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-v8w9-8m…
pnpm-lock.yaml ScaOsvGhsa v8w9 8mx6 g223
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency hono 4.11.8: GHSA-w62v-xxxg-mg59
OSV.dev reports `hono` at version `4.11.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-w62v-xxxg-mg59. Note: `hono` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-w62v-xx…
pnpm-lock.yaml ScaOsvGhsa w62v xxxg mg59
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency hono 4.11.8: GHSA-wgpf-jwqj-8h8p
OSV.dev reports `hono` at version `4.11.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-wgpf-jwqj-8h8p. Note: `hono` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-wgpf-jw…
pnpm-lock.yaml ScaOsvGhsa wgpf jwqj 8h8p
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency hono 4.11.8: GHSA-wmmm-f939-6g9c
OSV.dev reports `hono` at version `4.11.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-wmmm-f939-6g9c. Note: `hono` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-wmmm-f9…
pnpm-lock.yaml ScaOsvGhsa wmmm f939 6g9c
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency hono 4.11.8: GHSA-wwfh-h76j-fc44
OSV.dev reports `hono` at version `4.11.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-wwfh-h76j-fc44. Note: `hono` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-wwfh-h7…
pnpm-lock.yaml ScaOsvGhsa wwfh h76j fc44
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency hono 4.11.8: GHSA-xf4j-xp2r-rqqx
OSV.dev reports `hono` at version `4.11.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-xf4j-xp2r-rqqx. Note: `hono` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-xf4j-xp…
pnpm-lock.yaml ScaOsvGhsa xf4j xp2r rqqx
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency hono 4.11.8: GHSA-xgm2-5f3f-mvvc
OSV.dev reports `hono` at version `4.11.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-xgm2-5f3f-mvvc. Note: `hono` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-xgm2-5f…
pnpm-lock.yaml ScaOsvGhsa xgm2 5f3f mvvc
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency hono 4.11.8: GHSA-xpcf-pg52-r92g
OSV.dev reports `hono` at version `4.11.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-xpcf-pg52-r92g. Note: `hono` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-xpcf-pg…
pnpm-lock.yaml ScaOsvGhsa xpcf pg52 r92g
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency hono 4.11.8: GHSA-xrhx-7g5j-rcj5
OSV.dev reports `hono` at version `4.11.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-xrhx-7g5j-rcj5. Note: `hono` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-xrhx-7g…
pnpm-lock.yaml ScaOsvGhsa xrhx 7g5j rcj5
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency ip-address 10.0.1: GHSA-mwp4-54f8-5fhr
OSV.dev reports `ip-address` at version `10.0.1` (resolved in `pnpm-lock.yaml`) is affected by GHSA-mwp4-54f8-5fhr. Note: `ip-address` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/…
pnpm-lock.yaml ScaOsvGhsa mwp4 54f8 5fhr
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency ip-address 10.0.1: GHSA-v2v4-37r5-5v8g
OSV.dev reports `ip-address` at version `10.0.1` (resolved in `pnpm-lock.yaml`) is affected by GHSA-v2v4-37r5-5v8g. Note: `ip-address` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/…
pnpm-lock.yaml ScaOsvGhsa v2v4 37r5 5v8g
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency js-yaml 4.1.1: GHSA-h67p-54hq-rp68
OSV.dev reports `js-yaml` at version `4.1.1` (resolved in `pnpm-lock.yaml`) is affected by GHSA-h67p-54hq-rp68. Note: `js-yaml` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-h6…
pnpm-lock.yaml ScaOsvGhsa h67p 54hq rp68
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency lodash 4.17.23: GHSA-f23m-r3pf-42rh
OSV.dev reports `lodash` at version `4.17.23` (resolved in `pnpm-lock.yaml`) is affected by GHSA-f23m-r3pf-42rh (aka CVE-2025-13465, CVE-2026-2950). Note: `lodash` is a transitive dependency — pulled in by another package, not declared directly in a manifest. lodash vulnerable to Prototype Polluti…
pnpm-lock.yaml ScaOsvGhsa f23m r3pf 42rh
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency lodash 4.17.23: GHSA-r5fr-rjxr-66jc
OSV.dev reports `lodash` at version `4.17.23` (resolved in `pnpm-lock.yaml`) is affected by GHSA-r5fr-rjxr-66jc. Note: `lodash` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-r5…
pnpm-lock.yaml ScaOsvGhsa r5fr rjxr 66jc
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency nanoid 3.3.11: GHSA-xwg4-73v4-xw9w
OSV.dev reports `nanoid` at version `3.3.11` (resolved in `pnpm-lock.yaml`) is affected by GHSA-xwg4-73v4-xw9w. Note: `nanoid` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-xwg…
pnpm-lock.yaml ScaOsvGhsa xwg4 73v4 xw9w
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency path-to-regexp 8.3.0: GHSA-27v5-c462-wpq7
OSV.dev reports `path-to-regexp` at version `8.3.0` (resolved in `pnpm-lock.yaml`) is affected by GHSA-27v5-c462-wpq7 (aka CVE-2026-4923). Note: `path-to-regexp` is a transitive dependency — pulled in by another package, not declared directly in a manifest. path-to-regexp vulnerable to Regular Exp…
pnpm-lock.yaml ScaOsvGhsa 27v5 c462 wpq7
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency path-to-regexp 8.3.0: GHSA-j3q9-mxjg-w52f
OSV.dev reports `path-to-regexp` at version `8.3.0` (resolved in `pnpm-lock.yaml`) is affected by GHSA-j3q9-mxjg-w52f. Note: `path-to-regexp` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnera…
pnpm-lock.yaml ScaOsvGhsa j3q9 mxjg w52f
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency picomatch 2.3.1: GHSA-3v7f-55p6-f55p
OSV.dev reports `picomatch` at version `2.3.1` (resolved in `pnpm-lock.yaml`) is affected by GHSA-3v7f-55p6-f55p (aka CVE-2026-33672). Note: `picomatch` is a transitive dependency — pulled in by another package, not declared directly in a manifest. Picomatch: Method Injection in POSIX Character Cl…
pnpm-lock.yaml ScaOsvGhsa 3v7f 55p6 f55p
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency picomatch 4.0.3: GHSA-3v7f-55p6-f55p
OSV.dev reports `picomatch` at version `4.0.3` (resolved in `pnpm-lock.yaml`) is affected by GHSA-3v7f-55p6-f55p (aka CVE-2026-33672). Note: `picomatch` is a transitive dependency — pulled in by another package, not declared directly in a manifest. Picomatch: Method Injection in POSIX Character Cl…
pnpm-lock.yaml ScaOsvGhsa 3v7f 55p6 f55p
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency postcss 8.5.6: GHSA-fxqj-rqcc-2cmp
OSV.dev reports `postcss` at version `8.5.6` (resolved in `pnpm-lock.yaml`) is affected by GHSA-fxqj-rqcc-2cmp (aka CVE-2026-69153). Note: `postcss` is a transitive dependency — pulled in by another package, not declared directly in a manifest. PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — atta…
pnpm-lock.yaml ScaOsvGhsa fxqj rqcc 2cmp
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency postcss 8.5.6: GHSA-qx2v-qp2m-jg93
OSV.dev reports `postcss` at version `8.5.6` (resolved in `pnpm-lock.yaml`) is affected by GHSA-qx2v-qp2m-jg93 (aka CVE-2026-41305). Note: `postcss` is a transitive dependency — pulled in by another package, not declared directly in a manifest. PostCSS has XSS via Unescaped </style> in its CSS Str…
pnpm-lock.yaml ScaOsvGhsa qx2v qp2m jg93
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency postcss-selector-parser 7.1.1: GHSA-w9m9-85wc-3x92
OSV.dev reports `postcss-selector-parser` at version `7.1.1` (resolved in `pnpm-lock.yaml`) is affected by GHSA-w9m9-85wc-3x92. Note: `postcss-selector-parser` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https…
pnpm-lock.yaml ScaOsvGhsa w9m9 85wc 3x92
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency qs 6.14.1: GHSA-4mjr-xmp4-gh2g
OSV.dev reports `qs` at version `6.14.1` (resolved in `pnpm-lock.yaml`) is affected by GHSA-4mjr-xmp4-gh2g (aka CVE-2026-82417). Note: `qs` is a transitive dependency — pulled in by another package, not declared directly in a manifest. qs: Denial of Service via Attacker Controlled isBuffer Aliase…
pnpm-lock.yaml ScaOsvGhsa 4mjr xmp4 gh2g
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency qs 6.14.1: GHSA-q8mj-m7cp-5q26
OSV.dev reports `qs` at version `6.14.1` (resolved in `pnpm-lock.yaml`) is affected by GHSA-q8mj-m7cp-5q26. Note: `qs` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-q8mj-m7cp-5…
pnpm-lock.yaml ScaOsvGhsa q8mj m7cp 5q26
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency qs 6.14.1: GHSA-w7fw-mjwx-w883
OSV.dev reports `qs` at version `6.14.1` (resolved in `pnpm-lock.yaml`) is affected by GHSA-w7fw-mjwx-w883. Note: `qs` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-w7fw-mjwx-w…
pnpm-lock.yaml ScaOsvGhsa w7fw mjwx w883
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency yaml 2.8.2: GHSA-48c2-rrv3-qjmp
OSV.dev reports `yaml` at version `2.8.2` (resolved in `pnpm-lock.yaml`) is affected by GHSA-48c2-rrv3-qjmp (aka CVE-2026-33532). Note: `yaml` is a transitive dependency — pulled in by another package, not declared directly in a manifest. yaml is vulnerable to Stack Overflow via deeply nested YAML…
pnpm-lock.yaml ScaOsvGhsa 48c2 rrv3 qjmp
low System graph dependencies dependencies conf 0.90 Dependency @modelcontextprotocol/ext-apps is a major version behind
`@modelcontextprotocol/ext-apps` is pinned at `1.0.1` in `package.json` while the latest release on the npm registry is `2.0.0` — 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `@modelcon…
package.json FreshnessOutdated
low System graph dependencies dependencies conf 0.90 Dependency zod is a major version behind
`zod` is pinned at `3.24.2` in `package.json` while the latest release on the npm registry is `4.6.2` — 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `zod` to `4.6.2`.
package.json FreshnessOutdated
For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/fd71a5eb-74cc-43b2-83a5-6bb8b2d12c2a/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/fd71a5eb-74cc-43b2-83a5-6bb8b2d12c2a/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.