{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-abef9ed845d20db8", "name": "CVE-2026-29087: @hono/node-server 1.19.9 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-29087: @hono/node-server 1.19.9 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "@hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware\n\n@hono/node-server allows running the Hono application on Node.js. Prior to version 1.19.10, when using @hono/node-server's static file serving together with route-based middleware protections (e.g. protecting /admin/*), inconsistent URL decoding can allow protected static resources to be accessed without authorization. In particular, paths containing encoded slashes (%2F) may be evaluated differently by routing/middleware matching versus static file path resolution, enabling a bypass where middl\n\nPackage: @hono/node-server\nInstalled: 1.19.9\nFixed in: 1.19.10\nSeverity: HIGH\nFix: Upgrade @hono/node-server to 1.19.10"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ec953b97064c7855", "name": "CVE-2026-39406: @hono/node-server 1.19.9 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-39406: @hono/node-server 1.19.9 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "@hono/node-server: Middleware bypass via repeated slashes in serveStatic\n\n@hono/node-server allows running the Hono application on Node.js. Prior to 1.19.13, a path handling inconsistency in serveStatic allows protected static files to be accessed by using repeated slashes (//) in the request path. When route-based middleware (e.g., /admin/*) is used for authorization, the router may not match paths containing repeated slashes, while serveStatic resolves them as normalized paths. This can lead to a middleware bypass. This vulnerability is fixed in 1.19.13.\n\nPackage: @hono/node-server\nInstalled: 1.19.9\nFixed in: 1.19.13\nSeverity: MEDIUM\nFix: Upgrade @hono/node-server to 1.19.13"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-973c54155ad709cc", "name": "GHSA-frvp-7c67-39w9: @hono/node-server 1.19.9 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "GHSA-frvp-7c67-39w9: @hono/node-server 1.19.9 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)\n\nThe same as the `hono` core [Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)](https://github.com/honojs/hono/security/advisories/GHSA-wwfh-h76j-fc44).\n\n### Summary\n\nOn Windows hosts, an encoded backslash (`%5C`) in the request path decodes to `\\`, which the Windows path resolver treats as a separator. `serve-static` then resolves a single URL segment such as `admin\\secret.txt` into a nested file under the root and serves it, letting an attacker read static files meant t\n\nPackage: @hono/node-server\nInstalled: 1.19.9\nFixed in: 2.0.5, 1.19.15\nSeverity: MEDIUM\nFix: Upgrade @hono/node-server to 2.0.5, 1.19.15"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7742df00435b0e26", "name": "CVE-2025-69873: ajv 8.17.1 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2025-69873: ajv 8.17.1 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "ajv: ReDoS via $data reference\n\najv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., \"^(a|a)*$\") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds\n\nPackage: ajv\nInstalled: 8.17.1\nFixed in: 8.18.0, 6.14.0\nSeverity: MEDIUM\nFix: Upgrade ajv to 8.18.0, 6.14.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c9dadc5f9682a312", "name": "CVE-2026-12590: body-parser 2.2.2 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-12590: body-parser 2.2.2 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "body-parser: body-parser: Denial of Service via invalid limit option\n\nImpact: In body-parser versions prior to 1.20.6 (1.x line) and 2.3.0 (2.x line), when the parser is configured with an invalid limit option value such as an unparseable string or NaN, bytes.parse returns null and the request body size check is silently skipped. Applications that rely on limit as their primary safeguard against oversized request bodies will accept arbitrarily large payloads, leading to excessive memory and CPU usage and denial of service. Patches: This issue is fixed in body-pars\n\nPackage: body-parser\nInstalled: 2.2.2\nFixed in: 1.20.6, 2.3.0\nSeverity: LOW\nFix: Upgrade body-parser to 1.20.6, 2.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-10aea7802c4f082c", "name": "CVE-2026-30827: express-rate-limit 8.2.1 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-30827: express-rate-limit 8.2.1 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "express-rate-limit: express-rate-limit: Denial of Service for IPv4 clients due to incorrect IPv6 subnet masking\n\nexpress-rate-limit is a basic rate-limiting middleware for Express. In versions starting from 8.0.0 and prior to versions 8.0.2, 8.1.1, 8.2.2, and 8.3.0, the default keyGenerator in express-rate-limit applies IPv6 subnet masking (/56 by default) to all addresses that net.isIPv6() returns true for. This includes IPv4-mapped IPv6 addresses (::ffff:x.x.x.x), which Node.js returns as request.ip on dual-stack servers. Because the first 80 bits of all IPv4-mapped addresses are zero, a /56 (or any /32 \n\nPackage: express-rate-limit\nInstalled: 8.2.1\nFixed in: 8.2.2, 8.1.1, 8.0.2\nSeverity: HIGH\nFix: Upgrade express-rate-limit to 8.2.2, 8.1.1, 8.0.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9e925efd8793ae9b", "name": "CVE-2026-13676: fast-uri 3.1.0 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-13676: fast-uri 3.1.0 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization\n\nfast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, silently leaving the host in its original Unicode form while normalize() and equal() still return values that differ from a WHATWG-compatible URL parser. Applications that use fast-uri to enforce host-based policy (denylists, loopback filtering, redirect validation, outbound proxy routing) befo\n\nPackage: fast-uri\nInstalled: 3.1.0\nFixed in: 4.0.1, 3.1.3, 2.4.2\nSeverity: HIGH\nFix: Upgrade fast-uri to 4.0.1, 3.1.3, 2.4.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2281acd7795cdefe", "name": "CVE-2026-16221: fast-uri 3.1.0 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-16221: fast-uri 3.1.0 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "fast-uri: Fast-uri: Security policy bypass due to URL parsing inconsistency\n\nImpact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter. Node's native WHATWG URL parser, used by fetch, undici, and Node's http and https clients, normalizes the backslash to a forward slash for special schemes such as http, https, ws, wss, ftp, and file. As a result, the two parsers extract different hosts from the same input string. Applications that use f\n\nPackage: fast-uri\nInstalled: 3.1.0\nFixed in: 2.4.3, 3.1.4, 4.1.1\nSeverity: HIGH\nFix: Upgrade fast-uri to 2.4.3, 3.1.4, 4.1.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-455e07bcd192f2d7", "name": "CVE-2026-18446: fast-uri 3.1.0 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-18446: fast-uri 3.1.0 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "fast-uri: fast-uri: Host confusion vulnerability via backslash in URI authority\n\nfast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a backslash based introducer in place of it (backslash backslash, forward slash backslash, or backslash forward slash) is parsed with no authority and folds into the path. Node's native WHATWG URL parser instead treats a backslash as interchangeable with a forward slash for special schemes, so the two parsers extract different hosts from the same input. Applicati\n\nPackage: fast-uri\nInstalled: 3.1.0\nFixed in: 2.4.4, 3.1.5, 4.1.2\nSeverity: HIGH\nFix: Upgrade fast-uri to 2.4.4, 3.1.5, 4.1.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ee58b7134906e5d0", "name": "CVE-2026-6321: fast-uri 3.1.0 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-6321: fast-uri 3.1.0 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies\n\nfast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions. Encoded path data was treated like real slashes and parent-directory references, so distinct URIs could collapse onto the same normalized path. Applications that normalize or compare attacker-controlled URLs to enforce path-based policy can be bypassed, with a path that appears confined under an allowed prefix normalizing to a different location. Version\n\nPackage: fast-uri\nInstalled: 3.1.0\nFixed in: 3.1.1, 2.4.1\nSeverity: HIGH\nFix: Upgrade fast-uri to 3.1.1, 2.4.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-fa67cc47d2cf8220", "name": "CVE-2026-6322: fast-uri 3.1.0 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-6322: fast-uri 3.1.0 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "fast-uri: fast-uri: URI authority bypass due to improper delimiter handling\n\nfast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization. A host that combined an allowed domain, an encoded at-sign, and a different domain was re-emitted with the at-sign as a raw userinfo separator, changing the URI's authority to the second domain. Applications that normalize untrusted URLs before host allowlist checks, redirect validation, or outbound request routing can be steered to a differ\n\nPackage: fast-uri\nInstalled: 3.1.0\nFixed in: 3.1.2, 2.4.1\nSeverity: HIGH\nFix: Upgrade fast-uri to 3.1.2, 2.4.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-21c61d768148e319", "name": "CVE-2026-75975: fast-uri 3.1.0 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-75975: fast-uri 3.1.0 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "fast-uri: fast-uri: Server-side request forgery via malformed IPv6 normalization\n\nfast-uri is a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not validate the complete IPv6 grammar, so invalid trailing text in an authority can be silently discarded and a malformed attacker-controlled host is turned into a different valid IPv6 destination. For example, a bracketed literal with invalid trailing characters is normalized to the unspecified address, which a Node HTTP client then connects to a local service over loopback, and other malformed literals co\n\nPackage: fast-uri\nInstalled: 3.1.0\nFixed in: 2.4.5, 3.1.6, 4.1.3\nSeverity: HIGH\nFix: Upgrade fast-uri to 2.4.5, 3.1.6, 4.1.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-82247a1b0df050d3", "name": "CVE-2026-76172: fast-uri 3.1.0 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-76172: fast-uri 3.1.0 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "fast-uri: fast-uri: URI parsing flaw enables server-side request forgery and redirects\n\nfast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never re-escapes the result, and serialization writes the scheme back out verbatim, unlike the host component which is re-escaped. As a result an input whose scheme carries percent-encoded slashes parses as a scheme with no authority, so the parsed host and error are both undefined, yet resolving or normalizing that same input emits a network-path reference whose authority is attacke\n\nPackage: fast-uri\nInstalled: 3.1.0\nFixed in: 2.4.5, 3.1.6, 4.1.3\nSeverity: HIGH\nFix: Upgrade fast-uri to 2.4.5, 3.1.6, 4.1.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d5d80066afc50fe8", "name": "CVE-2026-29045: hono 4.11.8 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-29045: hono 4.11.8 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "Hono vulnerable to arbitrary file access via serveStatic vulnerability \n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, when using serveStatic together with route-based middleware protections (e.g. app.use('/admin/*', ...)), inconsistent URL decoding allowed protected static resources to be accessed without authorization. The router used decodeURI, while serveStatic used decodeURIComponent. This mismatch allowed paths containing encoded slashes (%2F) to bypass middleware protections while still resolving\n\nPackage: hono\nInstalled: 4.11.8\nFixed in: 4.12.4\nSeverity: HIGH\nFix: Upgrade hono to 4.12.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-62d7af066689342d", "name": "CVE-2026-54290: hono 4.11.8 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-54290: hono 4.11.8 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, with credentials: true and no explicit origin (the default wildcard), the CORS Middleware reflects the request's Origin and sends Access-Control-Allow-Credentials: true. Any site can then make credentialed cross-origin requests and read the responses, exposing cookie-authenticated endpoints to arbitrary origins. This vulnerability is fixed in 4.12.25.\n\nPackage: hono\nInstalled: 4.11.8\nFixed in: 4.12.25\nSeverity: HIGH\nFix: Upgrade hono to 4.12.25"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8b05808018ec8fec", "name": "CVE-2026-29085: hono 4.11.8 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-29085: hono 4.11.8 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "Hono Vulnerable to SSE Control Field Injection via CR/LF in writeSSE()\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, when using streamSSE() in Streaming Helper, the event, id, and retry fields were not validated for carriage return (\\r) or newline (\\n) characters. Because the SSE protocol uses line breaks as field delimiters, this could allow injection of additional SSE fields within the same event frame if untrusted input was passed into these fields. This issue has been patched in version 4.12.4.\n\nPackage: hono\nInstalled: 4.11.8\nFixed in: 4.12.4\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ba4eb2807685115f", "name": "CVE-2026-29086: hono 4.11.8 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-29086: hono 4.11.8 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "Hono Vulnerable to Cookie Attribute Injection via Unsanitized domain and path in setCookie()\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, the setCookie() utility did not validate semicolons (;), carriage returns (\\r), or newline characters (\\n) in the domain and path options when constructing the Set-Cookie header. Because cookie attributes are delimited by semicolons, this could allow injection of additional cookie attributes if untrusted input was passed into these fields. This issue has been patched in version 4.12.4.\n\nPackage: hono\nInstalled: 4.11.8\nFixed in: 4.12.4\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-62cd5b52133020bb", "name": "CVE-2026-39407: hono 4.11.8 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-39407: hono 4.11.8 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "Hono: Middleware bypass via repeated slashes in serveStatic\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, a path handling inconsistency in serveStatic allows protected static files to be accessed by using repeated slashes (//) in the request path. When route-based middleware (e.g., /admin/*) is used for authorization, the router may not match paths containing repeated slashes, while serveStatic resolves them as normalized paths. This can lead to a middleware bypass. This vulnerability is fixed in \n\nPackage: hono\nInstalled: 4.11.8\nFixed in: 4.12.12\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.12"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f6da38cd3271eac1", "name": "CVE-2026-39408: hono 4.11.8 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-39408: hono 4.11.8 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "Hono: Path traversal in toSSG() allows writing files outside the output directory\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, a path traversal issue in toSSG() allows files to be written outside the configured output directory during static site generation. When using dynamic route parameters via ssgParams, specially crafted values can cause generated file paths to escape the intended output directory. This vulnerability is fixed in 4.12.12.\n\nPackage: hono\nInstalled: 4.11.8\nFixed in: 4.12.12\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.12"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-46a2a12f5b196cec", "name": "CVE-2026-39409: hono 4.11.8 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-39409: hono 4.11.8 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, ipRestriction() does not canonicalize IPv4-mapped IPv6 client addresses (e.g. ::ffff:127.0.0.1) before applying IPv4 allow or deny rules. In environments such as Node.js dual-stack, this can cause IPv4 rules to fail to match, leading to unintended authorization behavior. This vulnerability is fixed in 4.12.12.\n\nPackage: hono\nInstalled: 4.11.8\nFixed in: 4.12.12\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.12"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6ae6648d672b9893", "name": "CVE-2026-39410: hono 4.11.8 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-39410: hono 4.11.8 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "Hono: Non-breaking space prefix bypass in cookie name handling in getCookie()\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, a discrepancy between browser cookie parsing and parse() handling allows cookie prefix protections to be bypassed. Cookie names that are treated as distinct by the browser may be normalized to the same key by parse(), allowing attacker-controlled cookies to override legitimate ones. This vulnerability is fixed in 4.12.12.\n\nPackage: hono\nInstalled: 4.11.8\nFixed in: 4.12.12\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.12"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-325ae52f618539ef", "name": "CVE-2026-44455: hono 4.11.8 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-44455: hono 4.11.8 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "hono/jsx has Unvalidated JSX Tag Names that May Allow HTML Injection\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.16, Improper handling of JSX element tag names in hono/jsx allowed unvalidated tag names to be directly inserted into the generated HTML output. When untrusted input is used as a tag name via the programmatic jsx() or createElement() APIs during server-side rendering, specially crafted values may break out of the intended element context and inject unintended HTML. This vulnerability is fixed in 4\n\nPackage: hono\nInstalled: 4.11.8\nFixed in: 4.12.16\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.16"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-20a2ca7966fa835b", "name": "CVE-2026-44456: hono 4.11.8 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-44456: hono 4.11.8 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "Hono: bodyLimit() can be bypassed for chunked / unknown-length requests\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.16, bodyLimit() does not reliably enforce maxSize for requests without a usable Content-Length (e.g. Transfer-Encoding: chunked). Oversized requests can reach handlers and return 200 instead of 413. This vulnerability is fixed in 4.12.16.\n\nPackage: hono\nInstalled: 4.11.8\nFixed in: 4.12.16\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.16"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1a2956c15be9647b", "name": "CVE-2026-44457: hono 4.11.8 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-44457: hono 4.11.8 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "Hono's Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, Cache Middleware does not skip caching for responses that declare per-user variance via Vary: Authorization or Vary: Cookie. As a result, a response cached for one authenticated user may be served to subsequent requests from different users. This vulnerability is fixed in 4.12.18.\n\nPackage: hono\nInstalled: 4.11.8\nFixed in: 4.12.18\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.18"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fe4bdf959ddb3c7b", "name": "CVE-2026-44458: hono 4.11.8 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-44458: hono 4.11.8 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "Hono has CSS Declaration Injection via Style Object Values in JSX SSR\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, the JSX renderer escapes style attribute object values for HTML but not for CSS. Untrusted input in a style object value or property name can therefore inject additional CSS declarations into the rendered style attribute. The impact is limited to CSS and does not allow JavaScript execution or HTML attribute breakout. This vulnerability is fixed in 4.12.18.\n\nPackage: hono\nInstalled: 4.11.8\nFixed in: 4.12.18\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.18"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fa928043c9400ed5", "name": "CVE-2026-47673: hono 4.11.8 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-47673: hono 4.11.8 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "Hono: JWT middleware accepts any Authorization scheme, not only Bearer\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the jwt and jwk middlewares do not verify that the Authorization header value uses theBearer scheme. Any two-part header value \u2014 regardless of the scheme name in the first position \u2014 proceeds to JWT verification. A request presenting a valid JWT under a non-Bearer scheme identifier (such as Basic or Token) is authenticated identically to a correctly formed Bearer request. This vulnerability is\n\nPackage: hono\nInstalled: 4.11.8\nFixed in: 4.12.21\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.21"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-113ce1727fa442bd", "name": "CVE-2026-47674: hono 4.11.8 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-47674: hono 4.11.8 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "Hono: IP Restriction bypasses static deny rules for non-canonical IPv6 \n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the ip-restriction middleware (hono/ip-restriction) compares incoming IP addresses against configured deny and allow rules using string equality after partial normalization. Non-canonical IPv6 representations of an address already listed in a static rule \u2014 such as compressed forms, explicit-zero forms, or hex-notation IPv4-mapped addresses \u2014 do not match the normalized rule entry, causing the \n\nPackage: hono\nInstalled: 4.11.8\nFixed in: 4.12.21\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.21"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5f2e5da5389733e2", "name": "CVE-2026-47675: hono 4.11.8 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-47675: hono 4.11.8 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the serialize() function in hono/cookie validates domain and path options against characters that corrupt Set-Cookie header syntax (;, \\r, \\n), but does not apply the same validation to sameSite and priority. An application that passes user-controlled input into either option may produce a Set-Cookie response header containing attacker-chosen additional attributes. This vulnerability is fixed \n\nPackage: hono\nInstalled: 4.11.8\nFixed in: 4.12.21\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.21"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0d84958b47ffd9d9", "name": "CVE-2026-47676: hono 4.11.8 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-47676: hono 4.11.8 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, app.mount() strips the mount prefix from the incoming request path using the raw URL pathname, while route matching is performed against the percent-decoded path. This inconsistency causes the prefix to be stripped at the wrong position when the path contains percent-encoded multi-byte characters, resulting in the mounted sub-application receiving an incorrect path. This vulnerability is fixed\n\nPackage: hono\nInstalled: 4.11.8\nFixed in: 4.12.21\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.21"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-af2491a7d8e1e4af", "name": "CVE-2026-54286: hono 4.11.8 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-54286: hono 4.11.8 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on Windows hosts, an encoded backslash (%5C) in the request path decodes to \\, which the Windows path resolver treats as a separator. serve-static then resolves a single URL segment such as admin\\secret.txt into a nested file under the root and serves it, letting an attacker read static files meant to be protected behind prefix-mounted middleware. This vulnerability is fixed in 4.12.25.\n\nPackage: hono\nInstalled: 4.11.8\nFixed in: 4.12.25\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.25"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fc2e66a7c304a44b", "name": "CVE-2026-54287: hono 4.11.8 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-54287: hono 4.11.8 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "hono: AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and Lattice\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on AWS Lambda, the ALB single-header response and the VPC Lattice v2 response join multiple Set-Cookie headers into one comma-separated value. Because commas also appear inside cookie attributes (for example Expires dates), clients cannot split the value back into individual cookies and silently drop or misparse them. This vulnerability is fixed in 4.12.25.\n\nPackage: hono\nInstalled: 4.11.8\nFixed in: 4.12.25\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.25"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9119e7bd077305b6", "name": "CVE-2026-54288: hono 4.11.8 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-54288: hono 4.11.8 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "hono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length`\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, the Body Limit Middleware trusts the request's Content-Length header to decide whether a body is within the limit. On AWS Lambda (API Gateway v1/v2, ALB, VPC Lattice, and Lambda@Edge) the body is delivered fully buffered and the adapter builds the request with the client-declared Content-Length, which need not match the actual payload. A client can declare a tiny Content-Length while sending a\n\nPackage: hono\nInstalled: 4.11.8\nFixed in: 4.12.25\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.25"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-46c36f05222df792", "name": "CVE-2026-54289: hono 4.11.8 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-54289: hono 4.11.8 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on AWS Lambda@Edge, CloudFront delivers a request header that appears more than once as several separate entries. The adapter writes each value with Headers.set instead of Headers.append, so every value overwrites the previous one and only the last reaches the application. Repeated request headers such as X-Forwarded-For, Forwarded, and Via are silently truncated to a single value. Request mid\n\nPackage: hono\nInstalled: 4.11.8\nFixed in: 4.12.25\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.25"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-98f26c1538344e15", "name": "CVE-2026-56761: hono 4.11.8 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-56761: hono 4.11.8 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "hono Improperly Handles JSX Attribute Names Allows HTML Injection in hono/jsx SSR\n\nhono before 4.12.14 contains an html injection vulnerability in jsx server-side rendering that allows attackers to inject unintended html by using malformed attribute names. Attackers can craft specially crafted attribute keys containing characters like quotes or angle brackets to break html tag boundaries and inject arbitrary attributes or elements.\n\nPackage: hono\nInstalled: 4.11.8\nFixed in: 4.12.14\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.14"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7789ac439e72cef5", "name": "CVE-2026-59895: hono 4.11.8 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-59895: hono 4.11.8 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "hono: Hono: Arbitrary markup injection via improper handling of class names in server-side rendering.\n\nHono is a Web application framework that provides support for any JavaScript runtime. From 4.0.0 before 4.12.27, cx() in hono/css composes class names from plain strings but marks the result as already escaped without HTML-escaping the input, allowing untrusted className values used in a JSX class attribute during server-side rendering to break out of the attribute and inject arbitrary markup. This issue is fixed in version 4.12.27.\n\nPackage: hono\nInstalled: 4.11.8\nFixed in: 4.12.27\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.27"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-69f522b7f78ec039", "name": "CVE-2026-59896: hono 4.11.8 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-59896: hono 4.11.8 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "hono: Hono: Information disclosure due to improper context isolation in server-side rendering\n\nHono is a Web application framework that provides support for any JavaScript runtime. From 4.11.8 before 4.12.27, hono/jsx did not isolate context values per request during server-side rendering, allowing createContext, useContext, jsxRenderer, or useRequestContext data from a different in-flight request to be used after an await in an async component. This issue is fixed in version 4.12.27.\n\nPackage: hono\nInstalled: 4.11.8\nFixed in: 4.12.27\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.27"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c47daa94e51fdb09", "name": "CVE-2026-59897: hono 4.11.8 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-59897: hono 4.11.8 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "hono: Hono: Information disclosure due to incorrect header de-duplication in AWS API Gateway v1 adapter\n\nHono is a Web application framework that provides support for any JavaScript runtime. From 4.3.3 before 4.12.27, the AWS API Gateway v1 adapter can drop a distinct repeated request header value because it de-duplicates values using a substring comparison instead of an exact match, so middleware or application logic that depends on the complete X-Forwarded-For chain, rate limiting, audit logging, or proxy-chain validation can receive incomplete data. This issue is fixed in version 4.12.27.\n\nPackage: hono\nInstalled: 4.11.8\nFixed in: 4.12.27\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.27"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d13057b93e9371e2", "name": "CVE-2026-69207: hono 4.11.8 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-69207: hono 4.11.8 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "Hono: ReDoS in CORS middleware via Access-Control-Request-Headers\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.34, the built-in CORS middleware, hono/cors, is vulnerable to a regular expression denial of service (ReDoS). During a preflight OPTIONS request, the middleware parses the attacker-controlled Access-Control-Request-Headers header using a whitespace-tolerant regular expression whose backtracking makes its running time quadratic in the input length. Because the header value is bounded only by the de\n\nPackage: hono\nInstalled: 4.11.8\nFixed in: 4.12.34\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.34"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6cfdf82a664c4bf9", "name": "CVE-2026-71850: hono 4.11.8 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-71850: hono 4.11.8 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure\n\nHono is a Web application framework that provides support for any JavaScript runtime. From 3.8.0 to 4.12.33, memo() from hono/jsx retains the result of a server side render and reuses it for later renders with comparator equal props, and request scoped values read inside the component take no part in that comparison, so a response can contain HTML rendered for another user's request. Components wrapped with memo() are compared by props alone; values read implicitly during rendering, such as JSX \n\nPackage: hono\nInstalled: 4.11.8\nFixed in: 4.12.34\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.34"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4eaee57991a9aa32", "name": "CVE-2026-84363: hono 4.11.8 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-84363: hono 4.11.8 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, Hono's query helpers treat a question mark after a literal hash fragment as the start of a query string, so the application can read request parameters that browsers, new URL(), reverse proxies, filtering rules, parameter allow and deny lists, access logging, request validation, and other middleware do not observe. The Cache Middleware removes the fragment when building its cache key, allowing \n\nPackage: hono\nInstalled: 4.11.8\nFixed in: 4.13.5\nSeverity: MEDIUM\nFix: Upgrade hono to 4.13.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9bb22026616f9d04", "name": "CVE-2026-84364: hono 4.11.8 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-84364: hono 4.11.8 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, when parseBody() expands dot-separated form field names into nested objects with dot-notation parsing enabled, it does not limit the nesting depth or the total number of intermediate objects created. Empty segments are preserved, so one deeply dotted field name can encode one nesting level per byte, while a large number of shallowly dotted fields can create the same amplification across a reque\n\nPackage: hono\nInstalled: 4.11.8\nFixed in: 4.13.5\nSeverity: MEDIUM\nFix: Upgrade hono to 4.13.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c7acbded28daec00", "name": "CVE-2026-84365: hono 4.11.8 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-84365: hono 4.11.8 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory\n\nHono is a Web application framework that provides support for any JavaScript runtime. From 4.12.12 until 4.13.5, the fix released for CVE-2026-39408 does not cover every traversal sequence, and toSSG() can still write files outside the configured output directory when a route parameter contains consecutive parent-directory segments. Static site generation builds each output path from the route path and values supplied through ssgParams, then verifies that the result stays inside the output direc\n\nPackage: hono\nInstalled: 4.11.8\nFixed in: 4.13.5\nSeverity: MEDIUM\nFix: Upgrade hono to 4.13.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ec1b4f1351693521", "name": "GHSA-26pp-8wgv-hjvm: hono 4.11.8 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "GHSA-26pp-8wgv-hjvm: hono 4.11.8 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "Hono missing validation of cookie name on write path in setCookie()\n\n## Summary\n\nCookie names are not validated on the write path when using `setCookie()`, `serialize()`, or `serializeSigned()` to generate Set-Cookie headers.\n\nWhile certain cookie attributes such as domain and path are validated, the cookie name itself may contain invalid characters.\n\nThis results in inconsistent handling of cookie names between parsing (read path) and serialization (write path).\n\n## Details\n\nWhen applications use `setCookie()`, `serialize()`, or `serializeSigned()` with a user-c\n\nPackage: hono\nInstalled: 4.11.8\nFixed in: 4.12.12\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.12"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bd563e22f03c74c8", "name": "GHSA-v8w9-8mx6-g223: hono 4.11.8 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "GHSA-v8w9-8mx6-g223: hono 4.11.8 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "Hono vulnerable to Prototype Pollution possible through __proto__ key allowed in parseBody({ dot: true })\n\n## Summary\n\nWhen using `parseBody({ dot: true })` in HonoRequest, specially crafted form field names such as `__proto__.x` could create objects containing a `__proto__` property.\n\nIf the parsed result is later merged into regular JavaScript objects using unsafe merge patterns, this may lead to prototype pollution in the target object.\n\n## Details\n\nThe `parseBody({ dot: true })` feature supports dot notation to construct nested objects from form field names.\n\nIn previous versions, the `__proto__`\n\nPackage: hono\nInstalled: 4.11.8\nFixed in: 4.12.7\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-87466763881d7c1d", "name": "CVE-2026-44459: hono 4.11.8 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-44459: hono 4.11.8 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "Hono has improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, improper validation of the JWT NumericDate claims exp, nbf, and iat in hono/utils/jwt allows tokens with non-spec-compliant claim values to silently bypass time-based checks. This issue is not exploitable by an anonymous attacker; it only manifests when a malformed claim value reaches verify() \u2014 typically when the application itself issues such tokens, or when the signing key is otherwise unde\n\nPackage: hono\nInstalled: 4.11.8\nFixed in: 4.12.18\nSeverity: LOW\nFix: Upgrade hono to 4.12.18"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e708342b5ec3a1d1", "name": "CVE-2026-71849: hono 4.11.8 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-71849: hono 4.11.8 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "Hono: Proxy Helper does not remove response headers listed in the `Connection` header\n\nHono is a Web application framework that provides support for any JavaScript runtime. From 4.7.0 to 4.12.33, the Proxy Helper proxy() function in hono/proxy does not remove response headers named by the origin's Connection header. Per RFC 9110 Section 7.6.1, an intermediary must remove the header fields listed in a message's Connection header field before forwarding the message, in addition to the well known hop by hop headers, but the proxy() function only removed the well known hop by hop head\n\nPackage: hono\nInstalled: 4.11.8\nFixed in: 4.12.34\nSeverity: LOW\nFix: Upgrade hono to 4.12.34"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-60f2fd06ce7b0d86", "name": "GHSA-gq3j-xvxp-8hrf: hono 4.11.8 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "GHSA-gq3j-xvxp-8hrf: hono 4.11.8 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "Hono added timing comparison hardening in basicAuth and bearerAuth\n\n## Summary\n\nThe `basicAuth` and `bearerAuth` middlewares previously used a comparison that was not fully timing-safe.\n\nThe `timingSafeEqual` function used normal string equality (`===`) when comparing hash values. This comparison may stop early if values differ, which can theoretically cause small timing differences.\n\nThe implementation has been updated to use a safer comparison method.\n\n\n## Details\n\nThe issue was caused by the use of normal string equality (`===`) when comparing hash values ins\n\nPackage: hono\nInstalled: 4.11.8\nFixed in: 4.11.10\nSeverity: LOW\nFix: Upgrade hono to 4.11.10"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-70c05257a4691d48", "name": "CVE-2026-69192: ip-address 10.0.1 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-69192: ip-address 10.0.1 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass\n\nip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.3.1, Address4 accepts an octet written with a leading zero and decodes it as decimal, while the WHATWG URL host parser, inet_aton, and getaddrinfo all decode a leading zero as octal. The library and the network stack therefore disagree about which host a string names. new Address4('012.0.0.1') reports correctForm() of 12.0.0.1 and isPrivate() of false, but fetch('http://012.0.0.1/') connects t\n\nPackage: ip-address\nInstalled: 10.0.1\nFixed in: 10.3.1\nSeverity: HIGH\nFix: Upgrade ip-address to 10.3.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0d87a919bb3914db", "name": "CVE-2026-42338: ip-address 10.0.1 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-42338: ip-address 10.0.1 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input\n\nip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage (emitted by the Address6 constructor for invalid input) can contain unescaped attacker-controlled content in one branch. An application that (1) passes untrusted input to Address6 and (2) renders the output of these methods,\n\nPackage: ip-address\nInstalled: 10.0.1\nFixed in: 10.1.1\nSeverity: MEDIUM\nFix: Upgrade ip-address to 10.1.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3b5e96f3efb0cb7c", "name": "CVE-2026-4926: path-to-regexp 8.3.0 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-4926: path-to-regexp 8.3.0 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "path-to-regexp: path-to-regexp: Denial of Service via crafted regular expressions\n\nImpact:\n\nA bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as `{a}{b}{c}:z`. The generated regex grows exponentially with the number of groups, causing denial of service.\n\nPatches:\n\nFixed in version 8.4.0.\n\nWorkarounds:\n\nLimit the number of sequential optional groups in route patterns. Avoid passing user-controlled input as route patterns.\n\nPackage: path-to-regexp\nInstalled: 8.3.0\nFixed in: 8.4.0\nSeverity: HIGH\nFix: Upgrade path-to-regexp to 8.4.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f09f7c5fe281fdab", "name": "CVE-2026-4923: path-to-regexp 8.3.0 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-4923: path-to-regexp 8.3.0 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "path-to-regexp: path-to-regexp: Denial of Service via specially crafted paths with multiple wildcards\n\nImpact:\n\nWhen using multiple wildcards, combined with at least one parameter, a regular expression can be generated that is vulnerable to ReDoS. This backtracking vulnerability requires the second wildcard to be somewhere other than the end of the path.\n\nUnsafe examples:\n\n/*foo-*bar-:baz\n/*a-:b-*c-:d\n/x/*a-:b/*c/y\n\nSafe examples:\n\n/*foo-:bar\n/*foo-:bar-*baz\n\nPatches:\n\nUpgrade to version 8.4.0.\n\nWorkarounds:\n\nIf you are using multiple wildcard parameters, you can check the regex output with a too\n\nPackage: path-to-regexp\nInstalled: 8.3.0\nFixed in: 8.4.0\nSeverity: MEDIUM\nFix: Upgrade path-to-regexp to 8.4.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-750d28b009498609", "name": "CVE-2026-82417: qs 6.14.1 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-82417: qs 6.14.1 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "qs: qs: Denial of Service via improper validation in stringify function\n\n### Summary\n\n\n\n`qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member. `utils.isBuffer` duck-types buffers by calling `obj.constructor.isBuffer(obj)` after checking only that the property is truthy, so a value such as `{ constructor: { isBuffer: \"x\" } }` makes the call throw `TypeError: obj.constructor.isBuffer is not a function`.\n\n\n\n### Details\n\n\n\n`lib/stringify.js:127` calls `utils.isBuffer` on every non-pr\n\nPackage: qs\nInstalled: 6.14.1\nFixed in: 6.16.0\nSeverity: MEDIUM\nFix: Upgrade qs to 6.16.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d48845eec36357cf", "name": "CVE-2026-8723: qs 6.14.1 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-8723: qs 6.14.1 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "qs: qs: Denial of Service due to improper handling of null/undefined array elements\n\n### Summary\n\n\n\n`qs.stringify` throws `TypeError` when called with `arrayFormat: 'comma'` and `encodeValuesOnly: true` on an array containing `null` or `undefined`. The throw is synchronous and not handled by any of qs's null-related options (`skipNulls`, `strictNullHandling`).\n\n\n\n### Details\n\n\n\nIn the comma + `encodeValuesOnly` branch, `lib/stringify.js:145` mapped the array through the raw encoder before joining:\n\n\n\n```js\n\n\n\nobj = utils.maybeMap(obj, encoder);\n\n\n\n```\n\n\n\n`utils.encode` (`lib/uti\n\nPackage: qs\nInstalled: 6.14.1\nFixed in: 6.15.2\nSeverity: MEDIUM\nFix: Upgrade qs to 6.15.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2ac80dfbbe08da5d", "name": "CVE-2026-2391: qs 6.14.1 \u2014 pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-2391: qs 6.14.1 \u2014 pnpm-lock.yaml"}, "fullDescription": {"text": "qs: qs's arrayLimit bypass in comma parsing allows denial of service\n\n### Summary\nThe `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabled, allowing attackers to cause denial-of-service via memory exhaustion. This is a bypass of the array limit enforcement, similar to the bracket notation bypass addressed in GHSA-6rw7-vpxm-498p (CVE-2025-15284).\n\n### Details\nWhen the `comma` option is set to `true` (not the default, but configurable in applications), qs allows parsing comma-separated strings as arrays (e.g., `?\n\nPackage: qs\nInstalled: 6.14.1\nFixed in: 6.14.2\nSeverity: LOW\nFix: Upgrade qs to 6.14.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3a3527e70129fb18", "name": "DS-0002: Image user should not be 'root' \u2014 Dockerfile", "shortDescription": {"text": "DS-0002: Image user should not be 'root' \u2014 Dockerfile"}, "fullDescription": {"text": "Image user should not be 'root'\n\nSpecify at least 1 USER command in Dockerfile with non-root user as argument\n\nRule: DS-0002\nSeverity: HIGH\nTarget: Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3c4041c454cda88e", "name": "DS-0026: No HEALTHCHECK defined \u2014 Dockerfile", "shortDescription": {"text": "DS-0026: No HEALTHCHECK defined \u2014 Dockerfile"}, "fullDescription": {"text": "No HEALTHCHECK defined\n\nAdd HEALTHCHECK instruction in your Dockerfile\n\nRule: DS-0026\nSeverity: LOW\nTarget: Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bea357a6497a2d5d", "name": "Agent authority lacks a verifier contract: CLAUDE.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: CLAUDE.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-24f2ea4bd14badc1", "name": "Agent instruction contains unpinned remote install: CLAUDE.md", "shortDescription": {"text": "Agent instruction contains unpinned remote install: CLAUDE.md"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2679282aa1c484b5", "name": "Agent authority lacks a verifier contract: AGENTS.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: AGENTS.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e725d2ab884fbd49", "name": "Multiple root agent instruction files without precedence", "shortDescription": {"text": "Multiple root agent instruction files without precedence"}, "fullDescription": {"text": "The repo has multiple top-level AI-coder instruction files. Without precedence rules, different agents may follow different policies."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f3321f3de07fb846", "name": "SkillSpector EA3 (excessive-agency) in LICENSE", "shortDescription": {"text": "SkillSpector EA3 (excessive-agency) in LICENSE"}, "fullDescription": {"text": "NOT LIMITED TO\n\nSkill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.\n\nSkill: unknown\nRule: EA3  Category: excessive-agency\nSeverity: LOW  Confidence: 0.70\n\nRemediation: Limit the skill's scope to its documented purpose. Remove instructions that enable the agent to perform actions outside its stated functionality."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 0.7}}, {"id": "scanner-54b647ff8fed0693", "name": "SkillSpector EA2 (excessive-agency) in src/tools/OpenMetExplorerTool.ts", "shortDescription": {"text": "SkillSpector EA2 (excessive-agency) in src/tools/OpenMetExplorerTool.ts"}, "fullDescription": {"text": "automatically execute\n\nSkill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.\n\nSkill: unknown\nRule: EA2  Category: excessive-agency\nSeverity: MEDIUM  Confidence: 0.80\n\nRemediation: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.8}}, {"id": "scanner-fd12b05866f2e9c3", "name": "SkillSpector P1 (prompt-injection) in README.md", "shortDescription": {"text": "SkillSpector P1 (prompt-injection) in README.md"}, "fullDescription": {"text": "Enable Developer Mode\n\nThis pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.\n\nSkill: unknown\nRule: P1  Category: prompt-injection\nSeverity: HIGH  Confidence: 0.70\n\nRemediation: Remove or rewrite any text that instructs the agent to ignore prompts, override safety rules, or trust unverified content. Ensure skill content cannot be injected to alter agent behavior."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.7}}, {"id": "scanner-1474af525032cfbf", "name": "SkillSpector SC1 (supply-chain) in package.json", "shortDescription": {"text": "SkillSpector SC1 (supply-chain) in package.json"}, "fullDescription": {"text": "\"@modelcontextprotocol/ext-apps\": \"^1.0.1\"\n\nDependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.\n\nSkill: unknown\nRule: SC1  Category: supply-chain\nSeverity: LOW  Confidence: 0.40\n\nRemediation: Pin all dependency versions in requirements.txt or pyproject.toml. Use exact versions (==) or compatible ranges. Run pip-audit regularly."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 0.4}}, {"id": "scanner-3b5b4d5fd228b862", "name": "SkillSpector SC4 (supply-chain) in package.json", "shortDescription": {"text": "SkillSpector SC4 (supply-chain) in package.json"}, "fullDescription": {"text": "esbuild==0.24.2\n\nDependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.\n\nSkill: unknown\nRule: SC4  Category: supply-chain\nSeverity: LOW  Confidence: 0.60\n\nRemediation: Update the dependency to a patched version that addresses the known CVE. Check OSV (osv.dev) or NVD for details on the vulnerability."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 0.6}}, {"id": "scanner-56a2ff46bb94e556", "name": "SkillSpector TM1 (tool-misuse) in .github/workflows/publish.yml", "shortDescription": {"text": "SkillSpector TM1 (tool-misuse) in .github/workflows/publish.yml"}, "fullDescription": {"text": "delete //registry.npmjs.org/:_authToken\n\nTool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).\n\nSkill: unknown\nRule: TM1  Category: tool-misuse\nSeverity: HIGH  Confidence: 0.80\n\nRemediation: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.8}}, {"id": "scanner-32586301a07ba95a", "name": "SkillSpector TM1 (tool-misuse) in pnpm-lock.yaml", "shortDescription": {"text": "SkillSpector TM1 (tool-misuse) in pnpm-lock.yaml"}, "fullDescription": {"text": "RMtmw0iFkeR4YV+fUOSucriAQNb9g8zFR52MWCtl+cCZOFRNL6zeB395vPzFhEjjn4fMxXudmELnl/KF/\n\nTool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).\n\nSkill: unknown\nRule: TM1  Category: tool-misuse\nSeverity: HIGH  Confidence: 0.85\n\nRemediation: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.85}}, {"id": "scanner-e637c415447867e4", "name": "Run SkillSpector's LLM-backed analysis in your own pipeline", "shortDescription": {"text": "Run SkillSpector's LLM-backed analysis in your own pipeline"}, "fullDescription": {"text": "Repobility ran SkillSpector's static rules server-side. The deeper LLM-backed analyzers \u2014 tool-poisoning (TP*), semantic security discovery (SSD*), developer-intent mismatch (SDI*) \u2014 are meant to run on YOUR machine with YOUR model; repobility never sends your code to an LLM. Recipe:\n\n# 1. Install SkillSpector in your own isolated env\npipx install \"skillspector @ git+https://github.com/NVIDIA/SkillSpector.git\"\n\n# 2. Point it at YOUR LLM pipeline (pick one) - your code stays on your machine\nexport SKILLSPECTOR_PROVIDER=anthropic && export ANTHROPIC_API_KEY=sk-ant-...\n# export SKILLSPECTOR_PROVIDER=openai   && export OPENAI_API_KEY=sk-...\n# export SKILLSPECTOR_PROVIDER=openai OPENAI_API_KEY=ollama OPENAI_BASE_URL=http://localhost:11434/v1 SKILLSPECTOR_MODEL=llama3.1:8b\n# export SKILLSPECTOR_PROVIDER=nv_build && export NVIDIA_INFERENCE_KEY=nvapi-...\n\n# 3. Run the LLM-backed scan per skill (omit --no-llm to enable the LLM analyzers)\nskillspector scan . --format sarif --output skillspector-"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d63da3583b14afc0", "name": "Dockerfile runs as root: Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1ca65d9563c664ed", "name": "Docker base image is tag-pinned but not digest-pinned: node:lts-alpine", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:lts-alpine"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a53bf972e19b52fd", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "softprops/action-gh-release@v2 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7ffa33751be3d771", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "0 test file(s) for 30 source file(s) (ratio 0.00). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-11825279136b53a3", "name": "CI is configured but no tests are detected", "shortDescription": {"text": "CI is configured but no tests are detected"}, "fullDescription": {"text": "A CI pipeline exists, but the scan found no test files to gate. Opus labeled this generated-code pattern as config theater: release machinery exists, but it has little behavioral signal."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing tests. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-df847e8351f1e14d", "name": "Vulnerable dependency esbuild 0.24.2: GHSA-67mh-4wv8-2f99", "shortDescription": {"text": "Vulnerable dependency esbuild 0.24.2: GHSA-67mh-4wv8-2f99"}, "fullDescription": {"text": "OSV.dev reports `esbuild` at version `0.24.2` (resolved in `pnpm-lock.yaml`) is affected by GHSA-67mh-4wv8-2f99.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-67mh-4wv8-2f99\nFix: upgrade `esbuild` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-6a5a41c21f048366", "name": "Vulnerable dependency @hono/node-server 1.19.9: GHSA-92pp-h63x-v22m", "shortDescription": {"text": "Vulnerable dependency @hono/node-server 1.19.9: GHSA-92pp-h63x-v22m"}, "fullDescription": {"text": "OSV.dev reports `@hono/node-server` at version `1.19.9` (resolved in `pnpm-lock.yaml`) is affected by GHSA-92pp-h63x-v22m.\nNote: `@hono/node-server` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-92pp-h63x-v22m\nFix: upgrade `@hono/node-server` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-398f232e68b72ea1", "name": "Vulnerable dependency @hono/node-server 1.19.9: GHSA-frvp-7c67-39w9", "shortDescription": {"text": "Vulnerable dependency @hono/node-server 1.19.9: GHSA-frvp-7c67-39w9"}, "fullDescription": {"text": "OSV.dev reports `@hono/node-server` at version `1.19.9` (resolved in `pnpm-lock.yaml`) is affected by GHSA-frvp-7c67-39w9.\nNote: `@hono/node-server` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-frvp-7c67-39w9\nFix: upgrade `@hono/node-server` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-d774af0245fac4c3", "name": "Vulnerable dependency @hono/node-server 1.19.9: GHSA-wc8c-qw6v-h7f6", "shortDescription": {"text": "Vulnerable dependency @hono/node-server 1.19.9: GHSA-wc8c-qw6v-h7f6"}, "fullDescription": {"text": "OSV.dev reports `@hono/node-server` at version `1.19.9` (resolved in `pnpm-lock.yaml`) is affected by GHSA-wc8c-qw6v-h7f6.\nNote: `@hono/node-server` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-wc8c-qw6v-h7f6\nFix: upgrade `@hono/node-server` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-902e7166dd144c83", "name": "Vulnerable dependency @humanfs/node 0.16.7: GHSA-p498-v437-472g", "shortDescription": {"text": "Vulnerable dependency @humanfs/node 0.16.7: GHSA-p498-v437-472g"}, "fullDescription": {"text": "OSV.dev reports `@humanfs/node` at version `0.16.7` (resolved in `pnpm-lock.yaml`) is affected by GHSA-p498-v437-472g.\nNote: `@humanfs/node` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-p498-v437-472g\nFix: upgrade `@humanfs/node` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-fdd65da85c80dbe7", "name": "Vulnerable dependency ajv 6.12.6: GHSA-2g4f-4pwh-qvx6", "shortDescription": {"text": "Vulnerable dependency ajv 6.12.6: GHSA-2g4f-4pwh-qvx6"}, "fullDescription": {"text": "OSV.dev reports `ajv` at version `6.12.6` (resolved in `pnpm-lock.yaml`) is affected by GHSA-2g4f-4pwh-qvx6 (aka CVE-2025-69873).\nNote: `ajv` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\najv has ReDoS when using `$data` option\n\nAliases: CVE-2025-69873\nAdvisory: https://osv.dev/vulnerability/GHSA-2g4f-4pwh-qvx6\nFix: upgrade `ajv` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-67af40d6aa83c0b1", "name": "Vulnerable dependency ajv 8.17.1: GHSA-2g4f-4pwh-qvx6", "shortDescription": {"text": "Vulnerable dependency ajv 8.17.1: GHSA-2g4f-4pwh-qvx6"}, "fullDescription": {"text": "OSV.dev reports `ajv` at version `8.17.1` (resolved in `pnpm-lock.yaml`) is affected by GHSA-2g4f-4pwh-qvx6 (aka CVE-2025-69873).\nNote: `ajv` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\najv has ReDoS when using `$data` option\n\nAliases: CVE-2025-69873\nAdvisory: https://osv.dev/vulnerability/GHSA-2g4f-4pwh-qvx6\nFix: upgrade `ajv` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-5e42adf1e879cfae", "name": "Vulnerable dependency baseline-browser-mapping 2.9.19: GHSA-w5vr-8v7q-w6rv", "shortDescription": {"text": "Vulnerable dependency baseline-browser-mapping 2.9.19: GHSA-w5vr-8v7q-w6rv"}, "fullDescription": {"text": "OSV.dev reports `baseline-browser-mapping` at version `2.9.19` (resolved in `pnpm-lock.yaml`) is affected by GHSA-w5vr-8v7q-w6rv.\nNote: `baseline-browser-mapping` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-w5vr-8v7q-w6rv\nFix: upgrade `baseline-browser-mapping` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-591ee9b305923766", "name": "Vulnerable dependency body-parser 2.2.2: GHSA-v422-hmwv-36x6", "shortDescription": {"text": "Vulnerable dependency body-parser 2.2.2: GHSA-v422-hmwv-36x6"}, "fullDescription": {"text": "OSV.dev reports `body-parser` at version `2.2.2` (resolved in `pnpm-lock.yaml`) is affected by GHSA-v422-hmwv-36x6.\nNote: `body-parser` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-v422-hmwv-36x6\nFix: upgrade `body-parser` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-7fe2a4478326d014", "name": "Vulnerable dependency brace-expansion 1.1.12: GHSA-3jxr-9vmj-r5cp", "shortDescription": {"text": "Vulnerable dependency brace-expansion 1.1.12: GHSA-3jxr-9vmj-r5cp"}, "fullDescription": {"text": "OSV.dev reports `brace-expansion` at version `1.1.12` (resolved in `pnpm-lock.yaml`) is affected by GHSA-3jxr-9vmj-r5cp (aka CVE-2026-13149).\nNote: `brace-expansion` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nbrace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups\n\nAliases: CVE-2026-13149\nAdvisory: https://osv.dev/vulnerability/GHSA-3jxr-9vmj-r5cp\nFix: upgrade `brace-expansion` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-3bb4ec990d05fd3f", "name": "Vulnerable dependency brace-expansion 1.1.12: GHSA-f886-m6hf-6m8v", "shortDescription": {"text": "Vulnerable dependency brace-expansion 1.1.12: GHSA-f886-m6hf-6m8v"}, "fullDescription": {"text": "OSV.dev reports `brace-expansion` at version `1.1.12` (resolved in `pnpm-lock.yaml`) is affected by GHSA-f886-m6hf-6m8v (aka CVE-2026-33750).\nNote: `brace-expansion` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nbrace-expansion: Zero-step sequence causes process hang and memory exhaustion\n\nAliases: CVE-2026-33750\nAdvisory: https://osv.dev/vulnerability/GHSA-f886-m6hf-6m8v\nFix: upgrade `brace-expansion` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-c699ab6d72fb79b5", "name": "Vulnerable dependency brace-expansion 1.1.12: GHSA-mh99-v99m-4gvg", "shortDescription": {"text": "Vulnerable dependency brace-expansion 1.1.12: GHSA-mh99-v99m-4gvg"}, "fullDescription": {"text": "OSV.dev reports `brace-expansion` at version `1.1.12` (resolved in `pnpm-lock.yaml`) is affected by GHSA-mh99-v99m-4gvg (aka CVE-2026-14257).\nNote: `brace-expansion` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nbrace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash\n\nAliases: CVE-2026-14257\nAdvisory: https://osv.dev/vulnerability/GHSA-mh99-v99m-4gvg\nFix: upgrade `brace-expansion` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-4567636ef03b9c72", "name": "Vulnerable dependency brace-expansion 1.1.12: GHSA-rgw5-rvv9-x895", "shortDescription": {"text": "Vulnerable dependency brace-expansion 1.1.12: GHSA-rgw5-rvv9-x895"}, "fullDescription": {"text": "OSV.dev reports `brace-expansion` at version `1.1.12` (resolved in `pnpm-lock.yaml`) is affected by GHSA-rgw5-rvv9-x895 (aka CVE-2026-69152).\nNote: `brace-expansion` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nbrace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation\n\nAliases: CVE-2026-69152\nAdvisory: https://osv.dev/vulnerability/GHSA-rgw5-rvv9-x895\nFix: upgrade `brace-expansion` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-87fd590975693566", "name": "Vulnerable dependency brace-expansion 2.0.2: GHSA-3jxr-9vmj-r5cp", "shortDescription": {"text": "Vulnerable dependency brace-expansion 2.0.2: GHSA-3jxr-9vmj-r5cp"}, "fullDescription": {"text": "OSV.dev reports `brace-expansion` at version `2.0.2` (resolved in `pnpm-lock.yaml`) is affected by GHSA-3jxr-9vmj-r5cp (aka CVE-2026-13149).\nNote: `brace-expansion` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nbrace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups\n\nAliases: CVE-2026-13149\nAdvisory: https://osv.dev/vulnerability/GHSA-3jxr-9vmj-r5cp\nFix: upgrade `brace-expansion` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-67501412e1abc9ed", "name": "Vulnerable dependency brace-expansion 2.0.2: GHSA-f886-m6hf-6m8v", "shortDescription": {"text": "Vulnerable dependency brace-expansion 2.0.2: GHSA-f886-m6hf-6m8v"}, "fullDescription": {"text": "OSV.dev reports `brace-expansion` at version `2.0.2` (resolved in `pnpm-lock.yaml`) is affected by GHSA-f886-m6hf-6m8v (aka CVE-2026-33750).\nNote: `brace-expansion` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nbrace-expansion: Zero-step sequence causes process hang and memory exhaustion\n\nAliases: CVE-2026-33750\nAdvisory: https://osv.dev/vulnerability/GHSA-f886-m6hf-6m8v\nFix: upgrade `brace-expansion` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-c875822c5e31725b", "name": "Vulnerable dependency brace-expansion 2.0.2: GHSA-mh99-v99m-4gvg", "shortDescription": {"text": "Vulnerable dependency brace-expansion 2.0.2: GHSA-mh99-v99m-4gvg"}, "fullDescription": {"text": "OSV.dev reports `brace-expansion` at version `2.0.2` (resolved in `pnpm-lock.yaml`) is affected by GHSA-mh99-v99m-4gvg (aka CVE-2026-14257).\nNote: `brace-expansion` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nbrace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash\n\nAliases: CVE-2026-14257\nAdvisory: https://osv.dev/vulnerability/GHSA-mh99-v99m-4gvg\nFix: upgrade `brace-expansion` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-6dfdfbaa8f70ee4e", "name": "Vulnerable dependency brace-expansion 2.0.2: GHSA-rgw5-rvv9-x895", "shortDescription": {"text": "Vulnerable dependency brace-expansion 2.0.2: GHSA-rgw5-rvv9-x895"}, "fullDescription": {"text": "OSV.dev reports `brace-expansion` at version `2.0.2` (resolved in `pnpm-lock.yaml`) is affected by GHSA-rgw5-rvv9-x895 (aka CVE-2026-69152).\nNote: `brace-expansion` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nbrace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation\n\nAliases: CVE-2026-69152\nAdvisory: https://osv.dev/vulnerability/GHSA-rgw5-rvv9-x895\nFix: upgrade `brace-expansion` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-e10008b52f62ac31", "name": "Vulnerable dependency browserslist 4.28.1: GHSA-73wf-gq98-2v4g", "shortDescription": {"text": "Vulnerable dependency browserslist 4.28.1: GHSA-73wf-gq98-2v4g"}, "fullDescription": {"text": "OSV.dev reports `browserslist` at version `4.28.1` (resolved in `pnpm-lock.yaml`) is affected by GHSA-73wf-gq98-2v4g (aka CVE-2026-73088).\nNote: `browserslist` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nBrowserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)\n\nAliases: CVE-2026-73088\nAdvisory: https://osv.dev/vulnerability/GHSA-73wf-gq98-2v4g\nFix: upgrade `browserslist` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-21ec507dfb5aa005", "name": "Vulnerable dependency browserslist 4.28.1: GHSA-c83g-rgw3-j3cx", "shortDescription": {"text": "Vulnerable dependency browserslist 4.28.1: GHSA-c83g-rgw3-j3cx"}, "fullDescription": {"text": "OSV.dev reports `browserslist` at version `4.28.1` (resolved in `pnpm-lock.yaml`) is affected by GHSA-c83g-rgw3-j3cx (aka CVE-2026-73089).\nNote: `browserslist` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nBrowserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM\n\nAliases: CVE-2026-73089\nAdvisory: https://osv.dev/vulnerability/GHSA-c83g-rgw3-j3cx\nFix: upgrade `browserslist` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-deb12e4024cb47fc", "name": "Vulnerable dependency express-rate-limit 8.2.1: GHSA-46wh-pxpv-q5gq", "shortDescription": {"text": "Vulnerable dependency express-rate-limit 8.2.1: GHSA-46wh-pxpv-q5gq"}, "fullDescription": {"text": "OSV.dev reports `express-rate-limit` at version `8.2.1` (resolved in `pnpm-lock.yaml`) is affected by GHSA-46wh-pxpv-q5gq (aka CVE-2026-30827).\nNote: `express-rate-limit` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nexpress-rate-limit: IPv4-mapped IPv6 addresses bypass per-client rate limiting on servers with dual-stack network\n\nAliases: CVE-2026-30827\nAdvisory: https://osv.dev/vulnerability/GHSA-46wh-pxpv-q5gq\nFix: upgrade `express-rate-limit` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-17aa5822fb19b5ea", "name": "Vulnerable dependency fast-uri 3.1.0: GHSA-4c8g-83qw-93j6", "shortDescription": {"text": "Vulnerable dependency fast-uri 3.1.0: GHSA-4c8g-83qw-93j6"}, "fullDescription": {"text": "OSV.dev reports `fast-uri` at version `3.1.0` (resolved in `pnpm-lock.yaml`) is affected by GHSA-4c8g-83qw-93j6 (aka CVE-2026-13676).\nNote: `fast-uri` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nfast-uri vulnerable to host confusion via failed IDN canonicalization\n\nAliases: CVE-2026-13676\nAdvisory: https://osv.dev/vulnerability/GHSA-4c8g-83qw-93j6\nFix: upgrade `fast-uri` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-0fe246d7e2fade68", "name": "Vulnerable dependency fast-uri 3.1.0: GHSA-7p8r-x3mc-p8w7", "shortDescription": {"text": "Vulnerable dependency fast-uri 3.1.0: GHSA-7p8r-x3mc-p8w7"}, "fullDescription": {"text": "OSV.dev reports `fast-uri` at version `3.1.0` (resolved in `pnpm-lock.yaml`) is affected by GHSA-7p8r-x3mc-p8w7.\nNote: `fast-uri` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-7p8r-x3mc-p8w7\nFix: upgrade `fast-uri` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-79ee3a2be707ea39", "name": "Vulnerable dependency fast-uri 3.1.0: GHSA-f65p-4m7j-42xc", "shortDescription": {"text": "Vulnerable dependency fast-uri 3.1.0: GHSA-f65p-4m7j-42xc"}, "fullDescription": {"text": "OSV.dev reports `fast-uri` at version `3.1.0` (resolved in `pnpm-lock.yaml`) is affected by GHSA-f65p-4m7j-42xc.\nNote: `fast-uri` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-f65p-4m7j-42xc\nFix: upgrade `fast-uri` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-c00161e7cb9c203a", "name": "Vulnerable dependency fast-uri 3.1.0: GHSA-jqff-g426-hqxp", "shortDescription": {"text": "Vulnerable dependency fast-uri 3.1.0: GHSA-jqff-g426-hqxp"}, "fullDescription": {"text": "OSV.dev reports `fast-uri` at version `3.1.0` (resolved in `pnpm-lock.yaml`) is affected by GHSA-jqff-g426-hqxp.\nNote: `fast-uri` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-jqff-g426-hqxp\nFix: upgrade `fast-uri` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-0404b200b0ebf9ef", "name": "Vulnerable dependency fast-uri 3.1.0: GHSA-q3j6-qgpj-74h6", "shortDescription": {"text": "Vulnerable dependency fast-uri 3.1.0: GHSA-q3j6-qgpj-74h6"}, "fullDescription": {"text": "OSV.dev reports `fast-uri` at version `3.1.0` (resolved in `pnpm-lock.yaml`) is affected by GHSA-q3j6-qgpj-74h6.\nNote: `fast-uri` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-q3j6-qgpj-74h6\nFix: upgrade `fast-uri` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-13393af920d90841", "name": "Vulnerable dependency fast-uri 3.1.0: GHSA-v2hh-gcrm-f6hx", "shortDescription": {"text": "Vulnerable dependency fast-uri 3.1.0: GHSA-v2hh-gcrm-f6hx"}, "fullDescription": {"text": "OSV.dev reports `fast-uri` at version `3.1.0` (resolved in `pnpm-lock.yaml`) is affected by GHSA-v2hh-gcrm-f6hx.\nNote: `fast-uri` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-v2hh-gcrm-f6hx\nFix: upgrade `fast-uri` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-368047b8676c085c", "name": "Vulnerable dependency fast-uri 3.1.0: GHSA-v39h-62p7-jpjc", "shortDescription": {"text": "Vulnerable dependency fast-uri 3.1.0: GHSA-v39h-62p7-jpjc"}, "fullDescription": {"text": "OSV.dev reports `fast-uri` at version `3.1.0` (resolved in `pnpm-lock.yaml`) is affected by GHSA-v39h-62p7-jpjc.\nNote: `fast-uri` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-v39h-62p7-jpjc\nFix: upgrade `fast-uri` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-96dc8b411ea76ca3", "name": "Vulnerable dependency flatted 3.3.3: GHSA-25h7-pfq9-p65f", "shortDescription": {"text": "Vulnerable dependency flatted 3.3.3: GHSA-25h7-pfq9-p65f"}, "fullDescription": {"text": "OSV.dev reports `flatted` at version `3.3.3` (resolved in `pnpm-lock.yaml`) is affected by GHSA-25h7-pfq9-p65f (aka CVE-2026-32141).\nNote: `flatted` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nflatted vulnerable to unbounded recursion DoS in parse() revive phase\n\nAliases: CVE-2026-32141\nAdvisory: https://osv.dev/vulnerability/GHSA-25h7-pfq9-p65f\nFix: upgrade `flatted` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-cb44d6a2f1c01418", "name": "Vulnerable dependency flatted 3.3.3: GHSA-rf6f-7fwh-wjgh", "shortDescription": {"text": "Vulnerable dependency flatted 3.3.3: GHSA-rf6f-7fwh-wjgh"}, "fullDescription": {"text": "OSV.dev reports `flatted` at version `3.3.3` (resolved in `pnpm-lock.yaml`) is affected by GHSA-rf6f-7fwh-wjgh.\nNote: `flatted` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-rf6f-7fwh-wjgh\nFix: upgrade `flatted` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-59dea3c8b3726779", "name": "Vulnerable dependency hono 4.11.8: GHSA-26pp-8wgv-hjvm", "shortDescription": {"text": "Vulnerable dependency hono 4.11.8: GHSA-26pp-8wgv-hjvm"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.11.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-26pp-8wgv-hjvm (aka CVE-2026-56762).\nNote: `hono` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nHono missing validation of cookie name on write path in setCookie()\n\nAliases: CVE-2026-56762\nAdvisory: https://osv.dev/vulnerability/GHSA-26pp-8wgv-hjvm\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-eaa1236dbc3836f8", "name": "Vulnerable dependency hono 4.11.8: GHSA-2gcr-mfcq-wcc3", "shortDescription": {"text": "Vulnerable dependency hono 4.11.8: GHSA-2gcr-mfcq-wcc3"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.11.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-2gcr-mfcq-wcc3 (aka CVE-2026-47676).\nNote: `hono` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nHono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths\n\nAliases: CVE-2026-47676\nAdvisory: https://osv.dev/vulnerability/GHSA-2gcr-mfcq-wcc3\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-4a856afe54fc3fa4", "name": "Vulnerable dependency hono 4.11.8: GHSA-3hrh-pfw6-9m5x", "shortDescription": {"text": "Vulnerable dependency hono 4.11.8: GHSA-3hrh-pfw6-9m5x"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.11.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-3hrh-pfw6-9m5x (aka CVE-2026-47675).\nNote: `hono` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nHono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection\n\nAliases: CVE-2026-47675\nAdvisory: https://osv.dev/vulnerability/GHSA-3hrh-pfw6-9m5x\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-cf78b146e50830aa", "name": "Vulnerable dependency hono 4.11.8: GHSA-458j-xx4x-4375", "shortDescription": {"text": "Vulnerable dependency hono 4.11.8: GHSA-458j-xx4x-4375"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.11.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-458j-xx4x-4375 (aka CVE-2026-56761).\nNote: `hono` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nhono Improperly Handles JSX Attribute Names Allows HTML Injection in hono/jsx SSR\n\nAliases: CVE-2026-56761\nAdvisory: https://osv.dev/vulnerability/GHSA-458j-xx4x-4375\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-de064003f0dfeb87", "name": "Vulnerable dependency hono 4.11.8: GHSA-5pq2-9x2x-5p6w", "shortDescription": {"text": "Vulnerable dependency hono 4.11.8: GHSA-5pq2-9x2x-5p6w"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.11.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-5pq2-9x2x-5p6w (aka CVE-2026-29086).\nNote: `hono` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nHono Vulnerable to Cookie Attribute Injection via Unsanitized domain and path in setCookie()\n\nAliases: CVE-2026-29086\nAdvisory: https://osv.dev/vulnerability/GHSA-5pq2-9x2x-5p6w\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-c1129c4a57cfdee4", "name": "Vulnerable dependency hono 4.11.8: GHSA-69xw-7hcm-h432", "shortDescription": {"text": "Vulnerable dependency hono 4.11.8: GHSA-69xw-7hcm-h432"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.11.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-69xw-7hcm-h432.\nNote: `hono` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-69xw-7hcm-h432\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-24d5c4e2a24a451f", "name": "Vulnerable dependency hono 4.11.8: GHSA-79qm-7rj5-m7r9", "shortDescription": {"text": "Vulnerable dependency hono 4.11.8: GHSA-79qm-7rj5-m7r9"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.11.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-79qm-7rj5-m7r9.\nNote: `hono` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-79qm-7rj5-m7r9\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-4e0a7d902d68ef3a", "name": "Vulnerable dependency hono 4.11.8: GHSA-88fw-hqm2-52qc", "shortDescription": {"text": "Vulnerable dependency hono 4.11.8: GHSA-88fw-hqm2-52qc"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.11.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-88fw-hqm2-52qc.\nNote: `hono` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-88fw-hqm2-52qc\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-fd13d3bf14994507", "name": "Vulnerable dependency hono 4.11.8: GHSA-8j4g-w8fx-2239", "shortDescription": {"text": "Vulnerable dependency hono 4.11.8: GHSA-8j4g-w8fx-2239"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.11.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-8j4g-w8fx-2239.\nNote: `hono` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-8j4g-w8fx-2239\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-f0ae7efc36b2c794", "name": "Vulnerable dependency hono 4.11.8: GHSA-9vqf-7f2p-gf9v", "shortDescription": {"text": "Vulnerable dependency hono 4.11.8: GHSA-9vqf-7f2p-gf9v"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.11.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-9vqf-7f2p-gf9v.\nNote: `hono` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-9vqf-7f2p-gf9v\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-3f9a53f18b88dd1c", "name": "Vulnerable dependency hono 4.11.8: GHSA-crvj-82cr-hjcx", "shortDescription": {"text": "Vulnerable dependency hono 4.11.8: GHSA-crvj-82cr-hjcx"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.11.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-crvj-82cr-hjcx.\nNote: `hono` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-crvj-82cr-hjcx\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-24ee0cc5958f2610", "name": "Vulnerable dependency hono 4.11.8: GHSA-f23p-vx2j-j53r", "shortDescription": {"text": "Vulnerable dependency hono 4.11.8: GHSA-f23p-vx2j-j53r"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.11.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-f23p-vx2j-j53r.\nNote: `hono` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-f23p-vx2j-j53r\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-f2a5a5b697015bfc", "name": "Vulnerable dependency hono 4.11.8: GHSA-f577-qrjj-4474", "shortDescription": {"text": "Vulnerable dependency hono 4.11.8: GHSA-f577-qrjj-4474"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.11.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-f577-qrjj-4474.\nNote: `hono` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-f577-qrjj-4474\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-c577105b434132c8", "name": "Vulnerable dependency hono 4.11.8: GHSA-g6gw-c38x-mqfc", "shortDescription": {"text": "Vulnerable dependency hono 4.11.8: GHSA-g6gw-c38x-mqfc"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.11.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-g6gw-c38x-mqfc.\nNote: `hono` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-g6gw-c38x-mqfc\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-cf6230124ad04ea1", "name": "Vulnerable dependency hono 4.11.8: GHSA-gq3j-xvxp-8hrf", "shortDescription": {"text": "Vulnerable dependency hono 4.11.8: GHSA-gq3j-xvxp-8hrf"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.11.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-gq3j-xvxp-8hrf.\nNote: `hono` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-gq3j-xvxp-8hrf\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-cd09414155d18a69", "name": "Vulnerable dependency hono 4.11.8: GHSA-gqvv-2mrq-wpjv", "shortDescription": {"text": "Vulnerable dependency hono 4.11.8: GHSA-gqvv-2mrq-wpjv"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.11.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-gqvv-2mrq-wpjv.\nNote: `hono` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-gqvv-2mrq-wpjv\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-7c6af032f7f72d4e", "name": "Vulnerable dependency hono 4.11.8: GHSA-hm8q-7f3q-5f36", "shortDescription": {"text": "Vulnerable dependency hono 4.11.8: GHSA-hm8q-7f3q-5f36"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.11.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-hm8q-7f3q-5f36.\nNote: `hono` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-hm8q-7f3q-5f36\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-0a0b54385a72c516", "name": "Vulnerable dependency hono 4.11.8: GHSA-hvrm-45r6-mjfj", "shortDescription": {"text": "Vulnerable dependency hono 4.11.8: GHSA-hvrm-45r6-mjfj"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.11.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-hvrm-45r6-mjfj.\nNote: `hono` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-hvrm-45r6-mjfj\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-a8a5a0e0e24688e3", "name": "Vulnerable dependency hono 4.11.8: GHSA-j6c9-x7qj-28xf", "shortDescription": {"text": "Vulnerable dependency hono 4.11.8: GHSA-j6c9-x7qj-28xf"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.11.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-j6c9-x7qj-28xf.\nNote: `hono` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-j6c9-x7qj-28xf\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-f6e9e64d6ad574b2", "name": "Vulnerable dependency hono 4.11.8: GHSA-p6xx-57qc-3wxr", "shortDescription": {"text": "Vulnerable dependency hono 4.11.8: GHSA-p6xx-57qc-3wxr"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.11.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-p6xx-57qc-3wxr.\nNote: `hono` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-p6xx-57qc-3wxr\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-74024105784f4b50", "name": "Vulnerable dependency hono 4.11.8: GHSA-p77w-8qqv-26rm", "shortDescription": {"text": "Vulnerable dependency hono 4.11.8: GHSA-p77w-8qqv-26rm"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.11.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-p77w-8qqv-26rm.\nNote: `hono` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-p77w-8qqv-26rm\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-62d29e8749a8490c", "name": "Vulnerable dependency hono 4.11.8: GHSA-q5qw-h33p-qvwr", "shortDescription": {"text": "Vulnerable dependency hono 4.11.8: GHSA-q5qw-h33p-qvwr"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.11.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-q5qw-h33p-qvwr.\nNote: `hono` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-q5qw-h33p-qvwr\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-166a51a6d85514ec", "name": "Vulnerable dependency hono 4.11.8: GHSA-qp7p-654g-cw7p", "shortDescription": {"text": "Vulnerable dependency hono 4.11.8: GHSA-qp7p-654g-cw7p"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.11.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-qp7p-654g-cw7p.\nNote: `hono` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-qp7p-654g-cw7p\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-55803f9138aa12ec", "name": "Vulnerable dependency hono 4.11.8: GHSA-r5rp-j6wh-rvv4", "shortDescription": {"text": "Vulnerable dependency hono 4.11.8: GHSA-r5rp-j6wh-rvv4"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.11.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-r5rp-j6wh-rvv4.\nNote: `hono` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-r5rp-j6wh-rvv4\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-ebb3a79c06cc7714", "name": "Vulnerable dependency hono 4.11.8: GHSA-rv63-4mwf-qqc2", "shortDescription": {"text": "Vulnerable dependency hono 4.11.8: GHSA-rv63-4mwf-qqc2"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.11.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-rv63-4mwf-qqc2.\nNote: `hono` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-rv63-4mwf-qqc2\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-e6dfaeb6df6d898e", "name": "Vulnerable dependency hono 4.11.8: GHSA-v8w9-8mx6-g223", "shortDescription": {"text": "Vulnerable dependency hono 4.11.8: GHSA-v8w9-8mx6-g223"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.11.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-v8w9-8mx6-g223.\nNote: `hono` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-a4dc3113cf475fb3", "name": "Vulnerable dependency hono 4.11.8: GHSA-w62v-xxxg-mg59", "shortDescription": {"text": "Vulnerable dependency hono 4.11.8: GHSA-w62v-xxxg-mg59"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.11.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-w62v-xxxg-mg59.\nNote: `hono` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-w62v-xxxg-mg59\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-d434014e6dacc9fc", "name": "Vulnerable dependency hono 4.11.8: GHSA-wgpf-jwqj-8h8p", "shortDescription": {"text": "Vulnerable dependency hono 4.11.8: GHSA-wgpf-jwqj-8h8p"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.11.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-wgpf-jwqj-8h8p.\nNote: `hono` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-wgpf-jwqj-8h8p\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-3c9bbbd08b623021", "name": "Vulnerable dependency hono 4.11.8: GHSA-wmmm-f939-6g9c", "shortDescription": {"text": "Vulnerable dependency hono 4.11.8: GHSA-wmmm-f939-6g9c"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.11.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-wmmm-f939-6g9c.\nNote: `hono` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-wmmm-f939-6g9c\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-7740fd71f1a2ef07", "name": "Vulnerable dependency hono 4.11.8: GHSA-wwfh-h76j-fc44", "shortDescription": {"text": "Vulnerable dependency hono 4.11.8: GHSA-wwfh-h76j-fc44"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.11.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-wwfh-h76j-fc44.\nNote: `hono` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-wwfh-h76j-fc44\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-da77c8b0414a6f9a", "name": "Vulnerable dependency hono 4.11.8: GHSA-xf4j-xp2r-rqqx", "shortDescription": {"text": "Vulnerable dependency hono 4.11.8: GHSA-xf4j-xp2r-rqqx"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.11.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-xf4j-xp2r-rqqx.\nNote: `hono` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-xf4j-xp2r-rqqx\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-fc75f9283e8b7803", "name": "Vulnerable dependency hono 4.11.8: GHSA-xgm2-5f3f-mvvc", "shortDescription": {"text": "Vulnerable dependency hono 4.11.8: GHSA-xgm2-5f3f-mvvc"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.11.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-xgm2-5f3f-mvvc.\nNote: `hono` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-xgm2-5f3f-mvvc\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-78a9089bd3e3d6bc", "name": "Vulnerable dependency hono 4.11.8: GHSA-xpcf-pg52-r92g", "shortDescription": {"text": "Vulnerable dependency hono 4.11.8: GHSA-xpcf-pg52-r92g"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.11.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-xpcf-pg52-r92g.\nNote: `hono` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-xpcf-pg52-r92g\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-3efb69e474ae83ea", "name": "Vulnerable dependency hono 4.11.8: GHSA-xrhx-7g5j-rcj5", "shortDescription": {"text": "Vulnerable dependency hono 4.11.8: GHSA-xrhx-7g5j-rcj5"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.11.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-xrhx-7g5j-rcj5.\nNote: `hono` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-xrhx-7g5j-rcj5\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-72a86a382ae4f2bf", "name": "Vulnerable dependency ip-address 10.0.1: GHSA-mwp4-54f8-5fhr", "shortDescription": {"text": "Vulnerable dependency ip-address 10.0.1: GHSA-mwp4-54f8-5fhr"}, "fullDescription": {"text": "OSV.dev reports `ip-address` at version `10.0.1` (resolved in `pnpm-lock.yaml`) is affected by GHSA-mwp4-54f8-5fhr.\nNote: `ip-address` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-mwp4-54f8-5fhr\nFix: upgrade `ip-address` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-d2e4a4d1e6bc65fa", "name": "Vulnerable dependency ip-address 10.0.1: GHSA-v2v4-37r5-5v8g", "shortDescription": {"text": "Vulnerable dependency ip-address 10.0.1: GHSA-v2v4-37r5-5v8g"}, "fullDescription": {"text": "OSV.dev reports `ip-address` at version `10.0.1` (resolved in `pnpm-lock.yaml`) is affected by GHSA-v2v4-37r5-5v8g.\nNote: `ip-address` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-v2v4-37r5-5v8g\nFix: upgrade `ip-address` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-dccbb904bebe7694", "name": "Vulnerable dependency js-yaml 4.1.1: GHSA-2883-xcg3-v3hh", "shortDescription": {"text": "Vulnerable dependency js-yaml 4.1.1: GHSA-2883-xcg3-v3hh"}, "fullDescription": {"text": "OSV.dev reports `js-yaml` at version `4.1.1` (resolved in `pnpm-lock.yaml`) is affected by GHSA-2883-xcg3-v3hh (aka CVE-2026-84375).\nNote: `js-yaml` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\njs-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources\n\nAliases: CVE-2026-84375\nAdvisory: https://osv.dev/vulnerability/GHSA-2883-xcg3-v3hh\nFix: upgrade `js-yaml` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-59b390ce1f5615b9", "name": "Vulnerable dependency js-yaml 4.1.1: GHSA-52cp-r559-cp3m", "shortDescription": {"text": "Vulnerable dependency js-yaml 4.1.1: GHSA-52cp-r559-cp3m"}, "fullDescription": {"text": "OSV.dev reports `js-yaml` at version `4.1.1` (resolved in `pnpm-lock.yaml`) is affected by GHSA-52cp-r559-cp3m (aka CVE-2026-59869).\nNote: `js-yaml` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\njs-yaml: YAML merge-key chains can force quadratic CPU consumption\n\nAliases: CVE-2026-59869\nAdvisory: https://osv.dev/vulnerability/GHSA-52cp-r559-cp3m\nFix: upgrade `js-yaml` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-b2984ac1801dcfd6", "name": "Vulnerable dependency js-yaml 4.1.1: GHSA-5p4m-2wfm-xmqj", "shortDescription": {"text": "Vulnerable dependency js-yaml 4.1.1: GHSA-5p4m-2wfm-xmqj"}, "fullDescription": {"text": "OSV.dev reports `js-yaml` at version `4.1.1` (resolved in `pnpm-lock.yaml`) is affected by GHSA-5p4m-2wfm-xmqj.\nNote: `js-yaml` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nJS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) \u2014 CVE-2026-59870 fix not backported\n\nAdvisory: https://osv.dev/vulnerability/GHSA-5p4m-2wfm-xmqj\nFix: upgrade `js-yaml` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-a2253f9940c5cf8b", "name": "Vulnerable dependency js-yaml 4.1.1: GHSA-h67p-54hq-rp68", "shortDescription": {"text": "Vulnerable dependency js-yaml 4.1.1: GHSA-h67p-54hq-rp68"}, "fullDescription": {"text": "OSV.dev reports `js-yaml` at version `4.1.1` (resolved in `pnpm-lock.yaml`) is affected by GHSA-h67p-54hq-rp68.\nNote: `js-yaml` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-h67p-54hq-rp68\nFix: upgrade `js-yaml` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-5eb5dc61949b1f4e", "name": "Vulnerable dependency lodash 4.17.23: GHSA-f23m-r3pf-42rh", "shortDescription": {"text": "Vulnerable dependency lodash 4.17.23: GHSA-f23m-r3pf-42rh"}, "fullDescription": {"text": "OSV.dev reports `lodash` at version `4.17.23` (resolved in `pnpm-lock.yaml`) is affected by GHSA-f23m-r3pf-42rh (aka CVE-2025-13465, CVE-2026-2950).\nNote: `lodash` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nlodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`\n\nAliases: CVE-2025-13465, CVE-2026-2950, GHSA-xxjr-mmjv-4gpg\nAdvisory: https://osv.dev/vulnerability/GHSA-f23m-r3pf-42rh\nFix: upgrade `lodash` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-67086d01be99fe99", "name": "Vulnerable dependency lodash 4.17.23: GHSA-r5fr-rjxr-66jc", "shortDescription": {"text": "Vulnerable dependency lodash 4.17.23: GHSA-r5fr-rjxr-66jc"}, "fullDescription": {"text": "OSV.dev reports `lodash` at version `4.17.23` (resolved in `pnpm-lock.yaml`) is affected by GHSA-r5fr-rjxr-66jc.\nNote: `lodash` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-r5fr-rjxr-66jc\nFix: upgrade `lodash` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-7444e439b1dcec1d", "name": "Vulnerable dependency minimatch 3.1.2: GHSA-23c5-xmqv-rm74", "shortDescription": {"text": "Vulnerable dependency minimatch 3.1.2: GHSA-23c5-xmqv-rm74"}, "fullDescription": {"text": "OSV.dev reports `minimatch` at version `3.1.2` (resolved in `pnpm-lock.yaml`) is affected by GHSA-23c5-xmqv-rm74 (aka CVE-2026-27904).\nNote: `minimatch` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nminimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions\n\nAliases: CVE-2026-27904\nAdvisory: https://osv.dev/vulnerability/GHSA-23c5-xmqv-rm74\nFix: upgrade `minimatch` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-47065935af486055", "name": "Vulnerable dependency minimatch 3.1.2: GHSA-3ppc-4f35-3m26", "shortDescription": {"text": "Vulnerable dependency minimatch 3.1.2: GHSA-3ppc-4f35-3m26"}, "fullDescription": {"text": "OSV.dev reports `minimatch` at version `3.1.2` (resolved in `pnpm-lock.yaml`) is affected by GHSA-3ppc-4f35-3m26 (aka CVE-2026-26996).\nNote: `minimatch` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nminimatch has a ReDoS via repeated wildcards with non-matching literal in pattern\n\nAliases: CVE-2026-26996\nAdvisory: https://osv.dev/vulnerability/GHSA-3ppc-4f35-3m26\nFix: upgrade `minimatch` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-9655d91892af536e", "name": "Vulnerable dependency minimatch 3.1.2: GHSA-7r86-cg39-jmmj", "shortDescription": {"text": "Vulnerable dependency minimatch 3.1.2: GHSA-7r86-cg39-jmmj"}, "fullDescription": {"text": "OSV.dev reports `minimatch` at version `3.1.2` (resolved in `pnpm-lock.yaml`) is affected by GHSA-7r86-cg39-jmmj (aka CVE-2026-27903).\nNote: `minimatch` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nminimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments\n\nAliases: CVE-2026-27903\nAdvisory: https://osv.dev/vulnerability/GHSA-7r86-cg39-jmmj\nFix: upgrade `minimatch` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-013bd56662132db3", "name": "Vulnerable dependency minimatch 9.0.5: GHSA-23c5-xmqv-rm74", "shortDescription": {"text": "Vulnerable dependency minimatch 9.0.5: GHSA-23c5-xmqv-rm74"}, "fullDescription": {"text": "OSV.dev reports `minimatch` at version `9.0.5` (resolved in `pnpm-lock.yaml`) is affected by GHSA-23c5-xmqv-rm74 (aka CVE-2026-27904).\nNote: `minimatch` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nminimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions\n\nAliases: CVE-2026-27904\nAdvisory: https://osv.dev/vulnerability/GHSA-23c5-xmqv-rm74\nFix: upgrade `minimatch` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-ac43686fd5f1715d", "name": "Vulnerable dependency minimatch 9.0.5: GHSA-3ppc-4f35-3m26", "shortDescription": {"text": "Vulnerable dependency minimatch 9.0.5: GHSA-3ppc-4f35-3m26"}, "fullDescription": {"text": "OSV.dev reports `minimatch` at version `9.0.5` (resolved in `pnpm-lock.yaml`) is affected by GHSA-3ppc-4f35-3m26 (aka CVE-2026-26996).\nNote: `minimatch` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nminimatch has a ReDoS via repeated wildcards with non-matching literal in pattern\n\nAliases: CVE-2026-26996\nAdvisory: https://osv.dev/vulnerability/GHSA-3ppc-4f35-3m26\nFix: upgrade `minimatch` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-fd6c4a3b59b31561", "name": "Vulnerable dependency minimatch 9.0.5: GHSA-7r86-cg39-jmmj", "shortDescription": {"text": "Vulnerable dependency minimatch 9.0.5: GHSA-7r86-cg39-jmmj"}, "fullDescription": {"text": "OSV.dev reports `minimatch` at version `9.0.5` (resolved in `pnpm-lock.yaml`) is affected by GHSA-7r86-cg39-jmmj (aka CVE-2026-27903).\nNote: `minimatch` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nminimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments\n\nAliases: CVE-2026-27903\nAdvisory: https://osv.dev/vulnerability/GHSA-7r86-cg39-jmmj\nFix: upgrade `minimatch` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-fd374351c437d9a4", "name": "Vulnerable dependency nanoid 3.3.11: GHSA-28wg-ghj8-5hjv", "shortDescription": {"text": "Vulnerable dependency nanoid 3.3.11: GHSA-28wg-ghj8-5hjv"}, "fullDescription": {"text": "OSV.dev reports `nanoid` at version `3.3.11` (resolved in `pnpm-lock.yaml`) is affected by GHSA-28wg-ghj8-5hjv (aka CVE-2026-67214).\nNote: `nanoid` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nnanoid: non-secure generators can loop indefinitely with negative size\n\nAliases: CVE-2026-67214\nAdvisory: https://osv.dev/vulnerability/GHSA-28wg-ghj8-5hjv\nFix: upgrade `nanoid` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-58b06ed98103623f", "name": "Vulnerable dependency nanoid 3.3.11: GHSA-2v37-7h3g-55p8", "shortDescription": {"text": "Vulnerable dependency nanoid 3.3.11: GHSA-2v37-7h3g-55p8"}, "fullDescription": {"text": "OSV.dev reports `nanoid` at version `3.3.11` (resolved in `pnpm-lock.yaml`) is affected by GHSA-2v37-7h3g-55p8 (aka CVE-2026-67213).\nNote: `nanoid` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nnanoid: custom generators can loop indefinitely when size is zero\n\nAliases: CVE-2026-67213\nAdvisory: https://osv.dev/vulnerability/GHSA-2v37-7h3g-55p8\nFix: upgrade `nanoid` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-54b85ff6a8ca6781", "name": "Vulnerable dependency nanoid 3.3.11: GHSA-xwg4-73v4-xw9w", "shortDescription": {"text": "Vulnerable dependency nanoid 3.3.11: GHSA-xwg4-73v4-xw9w"}, "fullDescription": {"text": "OSV.dev reports `nanoid` at version `3.3.11` (resolved in `pnpm-lock.yaml`) is affected by GHSA-xwg4-73v4-xw9w.\nNote: `nanoid` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-xwg4-73v4-xw9w\nFix: upgrade `nanoid` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-9598c1ce3568bb87", "name": "Vulnerable dependency path-to-regexp 8.3.0: GHSA-27v5-c462-wpq7", "shortDescription": {"text": "Vulnerable dependency path-to-regexp 8.3.0: GHSA-27v5-c462-wpq7"}, "fullDescription": {"text": "OSV.dev reports `path-to-regexp` at version `8.3.0` (resolved in `pnpm-lock.yaml`) is affected by GHSA-27v5-c462-wpq7 (aka CVE-2026-4923).\nNote: `path-to-regexp` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\npath-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards\n\nAliases: CVE-2026-4923\nAdvisory: https://osv.dev/vulnerability/GHSA-27v5-c462-wpq7\nFix: upgrade `path-to-regexp` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-8ee7df8f6b3faaaa", "name": "Vulnerable dependency path-to-regexp 8.3.0: GHSA-j3q9-mxjg-w52f", "shortDescription": {"text": "Vulnerable dependency path-to-regexp 8.3.0: GHSA-j3q9-mxjg-w52f"}, "fullDescription": {"text": "OSV.dev reports `path-to-regexp` at version `8.3.0` (resolved in `pnpm-lock.yaml`) is affected by GHSA-j3q9-mxjg-w52f.\nNote: `path-to-regexp` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-j3q9-mxjg-w52f\nFix: upgrade `path-to-regexp` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-1404758b576b6dcf", "name": "Vulnerable dependency picomatch 2.3.1: GHSA-3v7f-55p6-f55p", "shortDescription": {"text": "Vulnerable dependency picomatch 2.3.1: GHSA-3v7f-55p6-f55p"}, "fullDescription": {"text": "OSV.dev reports `picomatch` at version `2.3.1` (resolved in `pnpm-lock.yaml`) is affected by GHSA-3v7f-55p6-f55p (aka CVE-2026-33672).\nNote: `picomatch` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nPicomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching\n\nAliases: CVE-2026-33672\nAdvisory: https://osv.dev/vulnerability/GHSA-3v7f-55p6-f55p\nFix: upgrade `picomatch` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-6ee80ddf00a3fb47", "name": "Vulnerable dependency picomatch 2.3.1: GHSA-c2c7-rcm5-vvqj", "shortDescription": {"text": "Vulnerable dependency picomatch 2.3.1: GHSA-c2c7-rcm5-vvqj"}, "fullDescription": {"text": "OSV.dev reports `picomatch` at version `2.3.1` (resolved in `pnpm-lock.yaml`) is affected by GHSA-c2c7-rcm5-vvqj (aka CVE-2026-33671).\nNote: `picomatch` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nPicomatch has a ReDoS vulnerability via extglob quantifiers\n\nAliases: CVE-2026-33671\nAdvisory: https://osv.dev/vulnerability/GHSA-c2c7-rcm5-vvqj\nFix: upgrade `picomatch` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-f917074e8f7cb807", "name": "Vulnerable dependency picomatch 4.0.3: GHSA-3v7f-55p6-f55p", "shortDescription": {"text": "Vulnerable dependency picomatch 4.0.3: GHSA-3v7f-55p6-f55p"}, "fullDescription": {"text": "OSV.dev reports `picomatch` at version `4.0.3` (resolved in `pnpm-lock.yaml`) is affected by GHSA-3v7f-55p6-f55p (aka CVE-2026-33672).\nNote: `picomatch` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nPicomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching\n\nAliases: CVE-2026-33672\nAdvisory: https://osv.dev/vulnerability/GHSA-3v7f-55p6-f55p\nFix: upgrade `picomatch` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-ae923705bdf60d36", "name": "Vulnerable dependency picomatch 4.0.3: GHSA-c2c7-rcm5-vvqj", "shortDescription": {"text": "Vulnerable dependency picomatch 4.0.3: GHSA-c2c7-rcm5-vvqj"}, "fullDescription": {"text": "OSV.dev reports `picomatch` at version `4.0.3` (resolved in `pnpm-lock.yaml`) is affected by GHSA-c2c7-rcm5-vvqj (aka CVE-2026-33671).\nNote: `picomatch` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nPicomatch has a ReDoS vulnerability via extglob quantifiers\n\nAliases: CVE-2026-33671\nAdvisory: https://osv.dev/vulnerability/GHSA-c2c7-rcm5-vvqj\nFix: upgrade `picomatch` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-8b44aadc91682f74", "name": "Vulnerable dependency postcss-selector-parser 7.1.1: GHSA-w9m9-85wc-3x92", "shortDescription": {"text": "Vulnerable dependency postcss-selector-parser 7.1.1: GHSA-w9m9-85wc-3x92"}, "fullDescription": {"text": "OSV.dev reports `postcss-selector-parser` at version `7.1.1` (resolved in `pnpm-lock.yaml`) is affected by GHSA-w9m9-85wc-3x92.\nNote: `postcss-selector-parser` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-w9m9-85wc-3x92\nFix: upgrade `postcss-selector-parser` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-d1e0dd676d27c9c0", "name": "Vulnerable dependency postcss 8.5.6: GHSA-6g55-p6wh-862q", "shortDescription": {"text": "Vulnerable dependency postcss 8.5.6: GHSA-6g55-p6wh-862q"}, "fullDescription": {"text": "OSV.dev reports `postcss` at version `8.5.6` (resolved in `pnpm-lock.yaml`) is affected by GHSA-6g55-p6wh-862q (aka CVE-2026-45623).\nNote: `postcss` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nPostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments\n\nAliases: CVE-2026-45623\nAdvisory: https://osv.dev/vulnerability/GHSA-6g55-p6wh-862q\nFix: upgrade `postcss` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-472514f4284fe176", "name": "Vulnerable dependency postcss 8.5.6: GHSA-fxqj-rqcc-2cmp", "shortDescription": {"text": "Vulnerable dependency postcss 8.5.6: GHSA-fxqj-rqcc-2cmp"}, "fullDescription": {"text": "OSV.dev reports `postcss` at version `8.5.6` (resolved in `pnpm-lock.yaml`) is affected by GHSA-fxqj-rqcc-2cmp (aka CVE-2026-69153).\nNote: `postcss` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nPostCSS: incomplete fix of GHSA-6g55-p6wh-862q \u2014 attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset\n\nAliases: CVE-2026-69153\nAdvisory: https://osv.dev/vulnerability/GHSA-fxqj-rqcc-2cmp\nFix: upgrade `postcss` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-094fff4eac31d6d5", "name": "Vulnerable dependency postcss 8.5.6: GHSA-qx2v-qp2m-jg93", "shortDescription": {"text": "Vulnerable dependency postcss 8.5.6: GHSA-qx2v-qp2m-jg93"}, "fullDescription": {"text": "OSV.dev reports `postcss` at version `8.5.6` (resolved in `pnpm-lock.yaml`) is affected by GHSA-qx2v-qp2m-jg93 (aka CVE-2026-41305).\nNote: `postcss` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nPostCSS has XSS via Unescaped </style> in its CSS Stringify Output\n\nAliases: CVE-2026-41305\nAdvisory: https://osv.dev/vulnerability/GHSA-qx2v-qp2m-jg93\nFix: upgrade `postcss` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-bfdae7735771716e", "name": "Vulnerable dependency postcss 8.5.6: GHSA-r28c-9q8g-f849", "shortDescription": {"text": "Vulnerable dependency postcss 8.5.6: GHSA-r28c-9q8g-f849"}, "fullDescription": {"text": "OSV.dev reports `postcss` at version `8.5.6` (resolved in `pnpm-lock.yaml`) is affected by GHSA-r28c-9q8g-f849 (aka CVE-2026-73646).\nNote: `postcss` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nPostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure\n\nAliases: CVE-2026-73646\nAdvisory: https://osv.dev/vulnerability/GHSA-r28c-9q8g-f849\nFix: upgrade `postcss` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-96a42be839cac476", "name": "Vulnerable dependency qs 6.14.1: GHSA-4mjr-xmp4-gh2g", "shortDescription": {"text": "Vulnerable dependency qs 6.14.1: GHSA-4mjr-xmp4-gh2g"}, "fullDescription": {"text": "OSV.dev reports `qs` at version `6.14.1` (resolved in `pnpm-lock.yaml`) is affected by GHSA-4mjr-xmp4-gh2g (aka CVE-2026-82417).\nNote: `qs` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nqs: Denial of Service via Attacker Controlled isBuffer\n\nAliases: CVE-2026-82417\nAdvisory: https://osv.dev/vulnerability/GHSA-4mjr-xmp4-gh2g\nFix: upgrade `qs` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-aeb135b762b7cfe5", "name": "Vulnerable dependency qs 6.14.1: GHSA-q8mj-m7cp-5q26", "shortDescription": {"text": "Vulnerable dependency qs 6.14.1: GHSA-q8mj-m7cp-5q26"}, "fullDescription": {"text": "OSV.dev reports `qs` at version `6.14.1` (resolved in `pnpm-lock.yaml`) is affected by GHSA-q8mj-m7cp-5q26.\nNote: `qs` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-q8mj-m7cp-5q26\nFix: upgrade `qs` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-7c368d48c081dacb", "name": "Vulnerable dependency qs 6.14.1: GHSA-w7fw-mjwx-w883", "shortDescription": {"text": "Vulnerable dependency qs 6.14.1: GHSA-w7fw-mjwx-w883"}, "fullDescription": {"text": "OSV.dev reports `qs` at version `6.14.1` (resolved in `pnpm-lock.yaml`) is affected by GHSA-w7fw-mjwx-w883.\nNote: `qs` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-w7fw-mjwx-w883\nFix: upgrade `qs` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-f4cdada2a02c5ec2", "name": "Vulnerable dependency yaml 2.8.2: GHSA-48c2-rrv3-qjmp", "shortDescription": {"text": "Vulnerable dependency yaml 2.8.2: GHSA-48c2-rrv3-qjmp"}, "fullDescription": {"text": "OSV.dev reports `yaml` at version `2.8.2` (resolved in `pnpm-lock.yaml`) is affected by GHSA-48c2-rrv3-qjmp (aka CVE-2026-33532).\nNote: `yaml` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nyaml is vulnerable to Stack Overflow via deeply nested YAML collections\n\nAliases: CVE-2026-33532\nAdvisory: https://osv.dev/vulnerability/GHSA-48c2-rrv3-qjmp\nFix: upgrade `yaml` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-20ce30b7c97c7466", "name": "Dependency @modelcontextprotocol/ext-apps is a major version behind", "shortDescription": {"text": "Dependency @modelcontextprotocol/ext-apps is a major version behind"}, "fullDescription": {"text": "`@modelcontextprotocol/ext-apps` is pinned at `1.0.1` in `package.json` while the latest release on the npm registry is `2.0.0` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `@modelcontextprotocol/ext-apps` to `2.0.0`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-d637c276d64febc3", "name": "Dependency zod is a major version behind", "shortDescription": {"text": "Dependency zod is a major version behind"}, "fullDescription": {"text": "`zod` is pinned at `3.24.2` in `package.json` while the latest release on the npm registry is `4.6.2` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `zod` to `4.6.2`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}]}}, "automationDetails": {"id": "repobility/30828"}, "properties": {"repository": "mikechao/metmuseum-mcp", "repoUrl": "https://github.com/mikechao/metmuseum-mcp", "branch": "main"}, "results": [{"ruleId": "scanner-abef9ed845d20db8", "level": "error", "message": {"text": "CVE-2026-29087: @hono/node-server 1.19.9 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "fbf8a6714402e2e1", "scanner": "scanner-primary", "fingerprint": "abef9ed845d20db8", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-29087"]}}, {"ruleId": "scanner-ec953b97064c7855", "level": "warning", "message": {"text": "CVE-2026-39406: @hono/node-server 1.19.9 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "d6a97bbf6a6ac457", "scanner": "scanner-primary", "fingerprint": "ec953b97064c7855", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-39406"]}}, {"ruleId": "scanner-973c54155ad709cc", "level": "warning", "message": {"text": "GHSA-frvp-7c67-39w9: @hono/node-server 1.19.9 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "7a7c2342b3c17e8c", "scanner": "scanner-primary", "fingerprint": "973c54155ad709cc", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-frvp-7c67-39w9"]}}, {"ruleId": "scanner-7742df00435b0e26", "level": "warning", "message": {"text": "CVE-2025-69873: ajv 8.17.1 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "cc82c757e3c8e035", "scanner": "scanner-primary", "fingerprint": "7742df00435b0e26", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-69873"]}}, {"ruleId": "scanner-c9dadc5f9682a312", "level": "note", "message": {"text": "CVE-2026-12590: body-parser 2.2.2 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "c52a5d8da171f050", "scanner": "scanner-primary", "fingerprint": "c9dadc5f9682a312", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-12590"]}}, {"ruleId": "scanner-10aea7802c4f082c", "level": "error", "message": {"text": "CVE-2026-30827: express-rate-limit 8.2.1 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "cff4e82bfe4013a9", "scanner": "scanner-primary", "fingerprint": "10aea7802c4f082c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-30827"]}}, {"ruleId": "scanner-9e925efd8793ae9b", "level": "error", "message": {"text": "CVE-2026-13676: fast-uri 3.1.0 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "22f3458cd6c077d8", "scanner": "scanner-primary", "fingerprint": "9e925efd8793ae9b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-13676"]}}, {"ruleId": "scanner-2281acd7795cdefe", "level": "error", "message": {"text": "CVE-2026-16221: fast-uri 3.1.0 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "d0a482fb1283ccc4", "scanner": "scanner-primary", "fingerprint": "2281acd7795cdefe", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-16221"]}}, {"ruleId": "scanner-455e07bcd192f2d7", "level": "error", "message": {"text": "CVE-2026-18446: fast-uri 3.1.0 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "a36009c55083f4bf", "scanner": "scanner-primary", "fingerprint": "455e07bcd192f2d7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-18446"]}}, {"ruleId": "scanner-ee58b7134906e5d0", "level": "error", "message": {"text": "CVE-2026-6321: fast-uri 3.1.0 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "235bcfe30a3ee7f4", "scanner": "scanner-primary", "fingerprint": "ee58b7134906e5d0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-6321"]}}, {"ruleId": "scanner-fa67cc47d2cf8220", "level": "error", "message": {"text": "CVE-2026-6322: fast-uri 3.1.0 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "45d19c683e75019e", "scanner": "scanner-primary", "fingerprint": "fa67cc47d2cf8220", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-6322"]}}, {"ruleId": "scanner-21c61d768148e319", "level": "error", "message": {"text": "CVE-2026-75975: fast-uri 3.1.0 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "58251eeeac232527", "scanner": "scanner-primary", "fingerprint": "21c61d768148e319", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-75975"]}}, {"ruleId": "scanner-82247a1b0df050d3", "level": "error", "message": {"text": "CVE-2026-76172: fast-uri 3.1.0 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "73ab0b6e72f7dd4e", "scanner": "scanner-primary", "fingerprint": "82247a1b0df050d3", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-76172"]}}, {"ruleId": "scanner-d5d80066afc50fe8", "level": "error", "message": {"text": "CVE-2026-29045: hono 4.11.8 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "612387ebc69347ea", "scanner": "scanner-primary", "fingerprint": "d5d80066afc50fe8", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-29045"]}}, {"ruleId": "scanner-62d7af066689342d", "level": "error", "message": {"text": "CVE-2026-54290: hono 4.11.8 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "7578782077515776", "scanner": "scanner-primary", "fingerprint": "62d7af066689342d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54290"]}}, {"ruleId": "scanner-8b05808018ec8fec", "level": "warning", "message": {"text": "CVE-2026-29085: hono 4.11.8 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "ce0a4e953d6c3369", "scanner": "scanner-primary", "fingerprint": "8b05808018ec8fec", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-29085"]}}, {"ruleId": "scanner-ba4eb2807685115f", "level": "warning", "message": {"text": "CVE-2026-29086: hono 4.11.8 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "c278194ae1ce4a0a", "scanner": "scanner-primary", "fingerprint": "ba4eb2807685115f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-29086"]}}, {"ruleId": "scanner-62cd5b52133020bb", "level": "warning", "message": {"text": "CVE-2026-39407: hono 4.11.8 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "446aae5082a795a9", "scanner": "scanner-primary", "fingerprint": "62cd5b52133020bb", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-39407"]}}, {"ruleId": "scanner-f6da38cd3271eac1", "level": "warning", "message": {"text": "CVE-2026-39408: hono 4.11.8 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "ebdb3f49b3c24b76", "scanner": "scanner-primary", "fingerprint": "f6da38cd3271eac1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-39408"]}}, {"ruleId": "scanner-46a2a12f5b196cec", "level": "warning", "message": {"text": "CVE-2026-39409: hono 4.11.8 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "53ac30ea242ead5d", "scanner": "scanner-primary", "fingerprint": "46a2a12f5b196cec", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-39409"]}}, {"ruleId": "scanner-6ae6648d672b9893", "level": "warning", "message": {"text": "CVE-2026-39410: hono 4.11.8 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "c6deef3de40749bc", "scanner": "scanner-primary", "fingerprint": "6ae6648d672b9893", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-39410"]}}, {"ruleId": "scanner-325ae52f618539ef", "level": "warning", "message": {"text": "CVE-2026-44455: hono 4.11.8 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "0c0920a76efdc72f", "scanner": "scanner-primary", "fingerprint": "325ae52f618539ef", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44455"]}}, {"ruleId": "scanner-20a2ca7966fa835b", "level": "warning", "message": {"text": "CVE-2026-44456: hono 4.11.8 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "e52f6e55d2a2c74f", "scanner": "scanner-primary", "fingerprint": "20a2ca7966fa835b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44456"]}}, {"ruleId": "scanner-1a2956c15be9647b", "level": "warning", "message": {"text": "CVE-2026-44457: hono 4.11.8 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "a5b0879809ef9115", "scanner": "scanner-primary", "fingerprint": "1a2956c15be9647b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44457"]}}, {"ruleId": "scanner-fe4bdf959ddb3c7b", "level": "warning", "message": {"text": "CVE-2026-44458: hono 4.11.8 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "e3f022987442d0fb", "scanner": "scanner-primary", "fingerprint": "fe4bdf959ddb3c7b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44458"]}}, {"ruleId": "scanner-fa928043c9400ed5", "level": "warning", "message": {"text": "CVE-2026-47673: hono 4.11.8 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "9913753757a984c4", "scanner": "scanner-primary", "fingerprint": "fa928043c9400ed5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-47673"]}}, {"ruleId": "scanner-113ce1727fa442bd", "level": "warning", "message": {"text": "CVE-2026-47674: hono 4.11.8 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "68c19dd1cc3e83ec", "scanner": "scanner-primary", "fingerprint": "113ce1727fa442bd", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-47674"]}}, {"ruleId": "scanner-5f2e5da5389733e2", "level": "warning", "message": {"text": "CVE-2026-47675: hono 4.11.8 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "44971e609d9b8d76", "scanner": "scanner-primary", "fingerprint": "5f2e5da5389733e2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-47675"]}}, {"ruleId": "scanner-0d84958b47ffd9d9", "level": "warning", "message": {"text": "CVE-2026-47676: hono 4.11.8 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "bdd62b07de9685c3", "scanner": "scanner-primary", "fingerprint": "0d84958b47ffd9d9", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-47676"]}}, {"ruleId": "scanner-af2491a7d8e1e4af", "level": "warning", "message": {"text": "CVE-2026-54286: hono 4.11.8 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "1133ce53f13cc99c", "scanner": "scanner-primary", "fingerprint": "af2491a7d8e1e4af", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54286"]}}, {"ruleId": "scanner-fc2e66a7c304a44b", "level": "warning", "message": {"text": "CVE-2026-54287: hono 4.11.8 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "ba9c12b5f6f4e34b", "scanner": "scanner-primary", "fingerprint": "fc2e66a7c304a44b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54287"]}}, {"ruleId": "scanner-9119e7bd077305b6", "level": "warning", "message": {"text": "CVE-2026-54288: hono 4.11.8 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "e022311b9ffe3b9c", "scanner": "scanner-primary", "fingerprint": "9119e7bd077305b6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54288"]}}, {"ruleId": "scanner-46c36f05222df792", "level": "warning", "message": {"text": "CVE-2026-54289: hono 4.11.8 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "6b9bf4fee1281934", "scanner": "scanner-primary", "fingerprint": "46c36f05222df792", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54289"]}}, {"ruleId": "scanner-98f26c1538344e15", "level": "warning", "message": {"text": "CVE-2026-56761: hono 4.11.8 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "3f3b310301e95e06", "scanner": "scanner-primary", "fingerprint": "98f26c1538344e15", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-56761"]}}, {"ruleId": "scanner-7789ac439e72cef5", "level": "warning", "message": {"text": "CVE-2026-59895: hono 4.11.8 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "63a78c9ca28d905e", "scanner": "scanner-primary", "fingerprint": "7789ac439e72cef5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59895"]}}, {"ruleId": "scanner-69f522b7f78ec039", "level": "warning", "message": {"text": "CVE-2026-59896: hono 4.11.8 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "d2dc122ba4f9f3d0", "scanner": "scanner-primary", "fingerprint": "69f522b7f78ec039", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59896"]}}, {"ruleId": "scanner-c47daa94e51fdb09", "level": "warning", "message": {"text": "CVE-2026-59897: hono 4.11.8 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "269c964777b9f202", "scanner": "scanner-primary", "fingerprint": "c47daa94e51fdb09", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59897"]}}, {"ruleId": "scanner-d13057b93e9371e2", "level": "warning", "message": {"text": "CVE-2026-69207: hono 4.11.8 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "8992144385f035bd", "scanner": "scanner-primary", "fingerprint": "d13057b93e9371e2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-69207"]}}, {"ruleId": "scanner-6cfdf82a664c4bf9", "level": "warning", "message": {"text": "CVE-2026-71850: hono 4.11.8 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "f732cfdd42833777", "scanner": "scanner-primary", "fingerprint": "6cfdf82a664c4bf9", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-71850"]}}, {"ruleId": "scanner-4eaee57991a9aa32", "level": "warning", "message": {"text": "CVE-2026-84363: hono 4.11.8 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "1cef1de5ed503309", "scanner": "scanner-primary", "fingerprint": "4eaee57991a9aa32", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-84363"]}}, {"ruleId": "scanner-9bb22026616f9d04", "level": "warning", "message": {"text": "CVE-2026-84364: hono 4.11.8 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "6bc5a24ee6589ccd", "scanner": "scanner-primary", "fingerprint": "9bb22026616f9d04", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-84364"]}}, {"ruleId": "scanner-c7acbded28daec00", "level": "warning", "message": {"text": "CVE-2026-84365: hono 4.11.8 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "b4999447a76518c1", "scanner": "scanner-primary", "fingerprint": "c7acbded28daec00", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-84365"]}}, {"ruleId": "scanner-ec1b4f1351693521", "level": "warning", "message": {"text": "GHSA-26pp-8wgv-hjvm: hono 4.11.8 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "2baaba858f35a63e", "scanner": "scanner-primary", "fingerprint": "ec1b4f1351693521", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-26pp-8wgv-hjvm"]}}, {"ruleId": "scanner-bd563e22f03c74c8", "level": "warning", "message": {"text": "GHSA-v8w9-8mx6-g223: hono 4.11.8 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "c2638059d9c5f80d", "scanner": "scanner-primary", "fingerprint": "bd563e22f03c74c8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-v8w9-8mx6-g223"]}}, {"ruleId": "scanner-87466763881d7c1d", "level": "note", "message": {"text": "CVE-2026-44459: hono 4.11.8 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "6e09c25b5f78accf", "scanner": "scanner-primary", "fingerprint": "87466763881d7c1d", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44459"]}}, {"ruleId": "scanner-e708342b5ec3a1d1", "level": "note", "message": {"text": "CVE-2026-71849: hono 4.11.8 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "7f8b76110dfc708e", "scanner": "scanner-primary", "fingerprint": "e708342b5ec3a1d1", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-71849"]}}, {"ruleId": "scanner-60f2fd06ce7b0d86", "level": "note", "message": {"text": "GHSA-gq3j-xvxp-8hrf: hono 4.11.8 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "05bdd9ed32f72ac5", "scanner": "scanner-primary", "fingerprint": "60f2fd06ce7b0d86", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-gq3j-xvxp-8hrf"]}}, {"ruleId": "scanner-70c05257a4691d48", "level": "error", "message": {"text": "CVE-2026-69192: ip-address 10.0.1 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "d07cf73b7903cdda", "scanner": "scanner-primary", "fingerprint": "70c05257a4691d48", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-69192"]}}, {"ruleId": "scanner-0d87a919bb3914db", "level": "warning", "message": {"text": "CVE-2026-42338: ip-address 10.0.1 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "51ecbe5de5837549", "scanner": "scanner-primary", "fingerprint": "0d87a919bb3914db", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42338"]}}, {"ruleId": "scanner-3b5e96f3efb0cb7c", "level": "error", "message": {"text": "CVE-2026-4926: path-to-regexp 8.3.0 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "b07ee42be5d0f0e2", "scanner": "scanner-primary", "fingerprint": "3b5e96f3efb0cb7c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-4926"]}}, {"ruleId": "scanner-f09f7c5fe281fdab", "level": "warning", "message": {"text": "CVE-2026-4923: path-to-regexp 8.3.0 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "fa697ec4fe29cb63", "scanner": "scanner-primary", "fingerprint": "f09f7c5fe281fdab", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-4923"]}}, {"ruleId": "scanner-750d28b009498609", "level": "warning", "message": {"text": "CVE-2026-82417: qs 6.14.1 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "dc0fae8b727f638f", "scanner": "scanner-primary", "fingerprint": "750d28b009498609", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-82417"]}}, {"ruleId": "scanner-d48845eec36357cf", "level": "warning", "message": {"text": "CVE-2026-8723: qs 6.14.1 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "a7adafc808d1b7c4", "scanner": "scanner-primary", "fingerprint": "d48845eec36357cf", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-8723"]}}, {"ruleId": "scanner-2ac80dfbbe08da5d", "level": "note", "message": {"text": "CVE-2026-2391: qs 6.14.1 \u2014 pnpm-lock.yaml"}, "properties": {"repobilityId": "49b027c6f2d929d4", "scanner": "scanner-primary", "fingerprint": "2ac80dfbbe08da5d", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-2391"]}}, {"ruleId": "scanner-3a3527e70129fb18", "level": "error", "message": {"text": "DS-0002: Image user should not be 'root' \u2014 Dockerfile"}, "properties": {"repobilityId": "691787f6b20605df", "scanner": "scanner-primary", "fingerprint": "3a3527e70129fb18", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-3c4041c454cda88e", "level": "note", "message": {"text": "DS-0026: No HEALTHCHECK defined \u2014 Dockerfile"}, "properties": {"repobilityId": "da995bb2cfa21f65", "scanner": "scanner-primary", "fingerprint": "3c4041c454cda88e", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-bea357a6497a2d5d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: CLAUDE.md"}, "properties": {"repobilityId": "aae72df3934829ac", "scanner": "scanner-primary", "fingerprint": "bea357a6497a2d5d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "CLAUDE.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-24f2ea4bd14badc1", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: CLAUDE.md"}, "properties": {"repobilityId": "0f6049734704e537", "scanner": "scanner-primary", "fingerprint": "24f2ea4bd14badc1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "CLAUDE.md"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-2679282aa1c484b5", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: AGENTS.md"}, "properties": {"repobilityId": "27d579812e6be614", "scanner": "scanner-primary", "fingerprint": "2679282aa1c484b5", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "agents_md"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "AGENTS.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e725d2ab884fbd49", "level": "note", "message": {"text": "Multiple root agent instruction files without precedence"}, "properties": {"repobilityId": "1953db6c89508d22", "scanner": "scanner-primary", "fingerprint": "e725d2ab884fbd49", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["agent-instructions", "governance"]}}, {"ruleId": "scanner-f3321f3de07fb846", "level": "note", "message": {"text": "SkillSpector EA3 (excessive-agency) in LICENSE"}, "properties": {"repobilityId": "1b29968a80e56e5c", "scanner": "scanner-primary", "fingerprint": "f3321f3de07fb846", "layer": "security", "severity": "low", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "excessive-agency", "EA3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "LICENSE"}, "region": {"startLine": 16}}}]}, {"ruleId": "scanner-54b647ff8fed0693", "level": "warning", "message": {"text": "SkillSpector EA2 (excessive-agency) in src/tools/OpenMetExplorerTool.ts"}, "properties": {"repobilityId": "9e1158d459421e07", "scanner": "scanner-primary", "fingerprint": "54b647ff8fed0693", "layer": "security", "severity": "medium", "confidence": 0.8, "tags": ["skillspector", "mcp-skill", "excessive-agency", "EA2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/tools/OpenMetExplorerTool.ts"}, "region": {"startLine": 17}}}]}, {"ruleId": "scanner-fd12b05866f2e9c3", "level": "error", "message": {"text": "SkillSpector P1 (prompt-injection) in README.md"}, "properties": {"repobilityId": "1c7ea10da8911688", "scanner": "scanner-primary", "fingerprint": "fd12b05866f2e9c3", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "prompt-injection", "P1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "README.md"}, "region": {"startLine": 209}}}]}, {"ruleId": "scanner-1474af525032cfbf", "level": "note", "message": {"text": "SkillSpector SC1 (supply-chain) in package.json"}, "properties": {"repobilityId": "3383129e33c8e7f0", "scanner": "scanner-primary", "fingerprint": "1474af525032cfbf", "layer": "security", "severity": "low", "confidence": 0.4, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 46}}}]}, {"ruleId": "scanner-3b5b4d5fd228b862", "level": "note", "message": {"text": "SkillSpector SC4 (supply-chain) in package.json"}, "properties": {"repobilityId": "5cf524c71d4922e2", "scanner": "scanner-primary", "fingerprint": "3b5b4d5fd228b862", "layer": "security", "severity": "low", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC4"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 53}}}]}, {"ruleId": "scanner-56a2ff46bb94e556", "level": "error", "message": {"text": "SkillSpector TM1 (tool-misuse) in .github/workflows/publish.yml"}, "properties": {"repobilityId": "fd6c761a779d77a3", "scanner": "scanner-primary", "fingerprint": "56a2ff46bb94e556", "layer": "security", "severity": "high", "confidence": 0.8, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish.yml"}, "region": {"startLine": 20}}}]}, {"ruleId": "scanner-32586301a07ba95a", "level": "error", "message": {"text": "SkillSpector TM1 (tool-misuse) in pnpm-lock.yaml"}, "properties": {"repobilityId": "d4ac932a27660a38", "scanner": "scanner-primary", "fingerprint": "32586301a07ba95a", "layer": "security", "severity": "high", "confidence": 0.85, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 759}}}]}, {"ruleId": "scanner-e637c415447867e4", "level": "none", "message": {"text": "Run SkillSpector's LLM-backed analysis in your own pipeline"}, "properties": {"repobilityId": "1936f198ff5212bf", "scanner": "scanner-primary", "fingerprint": "e637c415447867e4", "layer": "security", "severity": "info", "confidence": 1.0, "tags": ["skillspector", "mcp-skill", "llm-advisory", "ai-coder"]}}, {"ruleId": "scanner-d63da3583b14afc0", "level": "warning", "message": {"text": "Dockerfile runs as root: Dockerfile"}, "properties": {"repobilityId": "a2ed1bd120e507db", "scanner": "scanner-primary", "fingerprint": "d63da3583b14afc0", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-1ca65d9563c664ed", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:lts-alpine"}, "properties": {"repobilityId": "6911fddd5d4593b4", "scanner": "scanner-primary", "fingerprint": "1ca65d9563c664ed", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-a53bf972e19b52fd", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2b57381939c1f612", "scanner": "scanner-primary", "fingerprint": "a53bf972e19b52fd", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish.yml"}, "region": {"startLine": 63}}}]}, {"ruleId": "scanner-7ffa33751be3d771", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "491a3ad29cbaf189", "scanner": "scanner-primary", "fingerprint": "7ffa33751be3d771", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "95520f086bc49bed", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-11825279136b53a3", "level": "warning", "message": {"text": "CI is configured but no tests are detected"}, "properties": {"repobilityId": "f9905c353ed2d2ad", "scanner": "scanner-primary", "fingerprint": "11825279136b53a3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "ci", "config-theater", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "5e6bf69082d8c0cd", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-df847e8351f1e14d", "level": "warning", "message": {"text": "Vulnerable dependency esbuild 0.24.2: GHSA-67mh-4wv8-2f99"}, "properties": {"repobilityId": "75cfbc52491a54f8", "scanner": "scanner-primary", "fingerprint": "df847e8351f1e14d", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-67mh-4wv8-2f99", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6a5a41c21f048366", "level": "warning", "message": {"text": "Vulnerable dependency @hono/node-server 1.19.9: GHSA-92pp-h63x-v22m"}, "properties": {"repobilityId": "7ceab5ad6b1bbfd8", "scanner": "scanner-primary", "fingerprint": "6a5a41c21f048366", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-92pp-h63x-v22m", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-398f232e68b72ea1", "level": "warning", "message": {"text": "Vulnerable dependency @hono/node-server 1.19.9: GHSA-frvp-7c67-39w9"}, "properties": {"repobilityId": "e2b61b4fef8c165d", "scanner": "scanner-primary", "fingerprint": "398f232e68b72ea1", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-frvp-7c67-39w9", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d774af0245fac4c3", "level": "warning", "message": {"text": "Vulnerable dependency @hono/node-server 1.19.9: GHSA-wc8c-qw6v-h7f6"}, "properties": {"repobilityId": "a3b4ce8e59f3787c", "scanner": "scanner-primary", "fingerprint": "d774af0245fac4c3", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-wc8c-qw6v-h7f6", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-902e7166dd144c83", "level": "warning", "message": {"text": "Vulnerable dependency @humanfs/node 0.16.7: GHSA-p498-v437-472g"}, "properties": {"repobilityId": "7f2c1469bc4e26cd", "scanner": "scanner-primary", "fingerprint": "902e7166dd144c83", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-p498-v437-472g", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fdd65da85c80dbe7", "level": "warning", "message": {"text": "Vulnerable dependency ajv 6.12.6: GHSA-2g4f-4pwh-qvx6"}, "properties": {"repobilityId": "cf8ef5d83527dc1c", "scanner": "scanner-primary", "fingerprint": "fdd65da85c80dbe7", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-2g4f-4pwh-qvx6", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-67af40d6aa83c0b1", "level": "warning", "message": {"text": "Vulnerable dependency ajv 8.17.1: GHSA-2g4f-4pwh-qvx6"}, "properties": {"repobilityId": "e37f9a76339c9faa", "scanner": "scanner-primary", "fingerprint": "67af40d6aa83c0b1", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-2g4f-4pwh-qvx6", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5e42adf1e879cfae", "level": "warning", "message": {"text": "Vulnerable dependency baseline-browser-mapping 2.9.19: GHSA-w5vr-8v7q-w6rv"}, "properties": {"repobilityId": "535142ff29961dfe", "scanner": "scanner-primary", "fingerprint": "5e42adf1e879cfae", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-w5vr-8v7q-w6rv", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-591ee9b305923766", "level": "warning", "message": {"text": "Vulnerable dependency body-parser 2.2.2: GHSA-v422-hmwv-36x6"}, "properties": {"repobilityId": "33169ae6017d1ec9", "scanner": "scanner-primary", "fingerprint": "591ee9b305923766", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-v422-hmwv-36x6", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7fe2a4478326d014", "level": "error", "message": {"text": "Vulnerable dependency brace-expansion 1.1.12: GHSA-3jxr-9vmj-r5cp"}, "properties": {"repobilityId": "5d2ce580505ef5a7", "scanner": "scanner-primary", "fingerprint": "7fe2a4478326d014", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-3jxr-9vmj-r5cp", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3bb4ec990d05fd3f", "level": "warning", "message": {"text": "Vulnerable dependency brace-expansion 1.1.12: GHSA-f886-m6hf-6m8v"}, "properties": {"repobilityId": "c4fa6cea7167ee7e", "scanner": "scanner-primary", "fingerprint": "3bb4ec990d05fd3f", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-f886-m6hf-6m8v", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c699ab6d72fb79b5", "level": "error", "message": {"text": "Vulnerable dependency brace-expansion 1.1.12: GHSA-mh99-v99m-4gvg"}, "properties": {"repobilityId": "0fc24bfbdae70a7f", "scanner": "scanner-primary", "fingerprint": "c699ab6d72fb79b5", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-mh99-v99m-4gvg", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4567636ef03b9c72", "level": "error", "message": {"text": "Vulnerable dependency brace-expansion 1.1.12: GHSA-rgw5-rvv9-x895"}, "properties": {"repobilityId": "3d617062bafcab77", "scanner": "scanner-primary", "fingerprint": "4567636ef03b9c72", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-rgw5-rvv9-x895", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-87fd590975693566", "level": "error", "message": {"text": "Vulnerable dependency brace-expansion 2.0.2: GHSA-3jxr-9vmj-r5cp"}, "properties": {"repobilityId": "d0f259a88c45355f", "scanner": "scanner-primary", "fingerprint": "87fd590975693566", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-3jxr-9vmj-r5cp", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-67501412e1abc9ed", "level": "warning", "message": {"text": "Vulnerable dependency brace-expansion 2.0.2: GHSA-f886-m6hf-6m8v"}, "properties": {"repobilityId": "1154f43f37764268", "scanner": "scanner-primary", "fingerprint": "67501412e1abc9ed", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-f886-m6hf-6m8v", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c875822c5e31725b", "level": "error", "message": {"text": "Vulnerable dependency brace-expansion 2.0.2: GHSA-mh99-v99m-4gvg"}, "properties": {"repobilityId": "7d3e92999f8a85d7", "scanner": "scanner-primary", "fingerprint": "c875822c5e31725b", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-mh99-v99m-4gvg", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6dfdfbaa8f70ee4e", "level": "error", "message": {"text": "Vulnerable dependency brace-expansion 2.0.2: GHSA-rgw5-rvv9-x895"}, "properties": {"repobilityId": "fa64862e1c20cdaf", "scanner": "scanner-primary", "fingerprint": "6dfdfbaa8f70ee4e", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-rgw5-rvv9-x895", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e10008b52f62ac31", "level": "error", "message": {"text": "Vulnerable dependency browserslist 4.28.1: GHSA-73wf-gq98-2v4g"}, "properties": {"repobilityId": "f69327e085ad4444", "scanner": "scanner-primary", "fingerprint": "e10008b52f62ac31", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-73wf-gq98-2v4g", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-21ec507dfb5aa005", "level": "error", "message": {"text": "Vulnerable dependency browserslist 4.28.1: GHSA-c83g-rgw3-j3cx"}, "properties": {"repobilityId": "44d455ffa0dafdf0", "scanner": "scanner-primary", "fingerprint": "21ec507dfb5aa005", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-c83g-rgw3-j3cx", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-deb12e4024cb47fc", "level": "error", "message": {"text": "Vulnerable dependency express-rate-limit 8.2.1: GHSA-46wh-pxpv-q5gq"}, "properties": {"repobilityId": "c1781c8c666ee2a7", "scanner": "scanner-primary", "fingerprint": "deb12e4024cb47fc", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-46wh-pxpv-q5gq", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-17aa5822fb19b5ea", "level": "error", "message": {"text": "Vulnerable dependency fast-uri 3.1.0: GHSA-4c8g-83qw-93j6"}, "properties": {"repobilityId": "ccba8e073dd684ab", "scanner": "scanner-primary", "fingerprint": "17aa5822fb19b5ea", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-4c8g-83qw-93j6", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0fe246d7e2fade68", "level": "warning", "message": {"text": "Vulnerable dependency fast-uri 3.1.0: GHSA-7p8r-x3mc-p8w7"}, "properties": {"repobilityId": "a365a7399721ae5d", "scanner": "scanner-primary", "fingerprint": "0fe246d7e2fade68", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-7p8r-x3mc-p8w7", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-79ee3a2be707ea39", "level": "warning", "message": {"text": "Vulnerable dependency fast-uri 3.1.0: GHSA-f65p-4m7j-42xc"}, "properties": {"repobilityId": "2b3d67d06487c176", "scanner": "scanner-primary", "fingerprint": "79ee3a2be707ea39", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-f65p-4m7j-42xc", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c00161e7cb9c203a", "level": "warning", "message": {"text": "Vulnerable dependency fast-uri 3.1.0: GHSA-jqff-g426-hqxp"}, "properties": {"repobilityId": "6297d88c1a31d551", "scanner": "scanner-primary", "fingerprint": "c00161e7cb9c203a", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-jqff-g426-hqxp", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0404b200b0ebf9ef", "level": "warning", "message": {"text": "Vulnerable dependency fast-uri 3.1.0: GHSA-q3j6-qgpj-74h6"}, "properties": {"repobilityId": "9eb02b57c07aeb74", "scanner": "scanner-primary", "fingerprint": "0404b200b0ebf9ef", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-q3j6-qgpj-74h6", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-13393af920d90841", "level": "warning", "message": {"text": "Vulnerable dependency fast-uri 3.1.0: GHSA-v2hh-gcrm-f6hx"}, "properties": {"repobilityId": "c516ccc3502eb13b", "scanner": "scanner-primary", "fingerprint": "13393af920d90841", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-v2hh-gcrm-f6hx", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-368047b8676c085c", "level": "warning", "message": {"text": "Vulnerable dependency fast-uri 3.1.0: GHSA-v39h-62p7-jpjc"}, "properties": {"repobilityId": "06c91e3216e3fe95", "scanner": "scanner-primary", "fingerprint": "368047b8676c085c", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-v39h-62p7-jpjc", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-96dc8b411ea76ca3", "level": "error", "message": {"text": "Vulnerable dependency flatted 3.3.3: GHSA-25h7-pfq9-p65f"}, "properties": {"repobilityId": "d9983483d98c7b10", "scanner": "scanner-primary", "fingerprint": "96dc8b411ea76ca3", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-25h7-pfq9-p65f", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cb44d6a2f1c01418", "level": "warning", "message": {"text": "Vulnerable dependency flatted 3.3.3: GHSA-rf6f-7fwh-wjgh"}, "properties": {"repobilityId": "cf3a229f2fddbb99", "scanner": "scanner-primary", "fingerprint": "cb44d6a2f1c01418", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-rf6f-7fwh-wjgh", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-59dea3c8b3726779", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.11.8: GHSA-26pp-8wgv-hjvm"}, "properties": {"repobilityId": "7824fd823f9f2c63", "scanner": "scanner-primary", "fingerprint": "59dea3c8b3726779", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-26pp-8wgv-hjvm", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-eaa1236dbc3836f8", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.11.8: GHSA-2gcr-mfcq-wcc3"}, "properties": {"repobilityId": "7fda11a4dc15a845", "scanner": "scanner-primary", "fingerprint": "eaa1236dbc3836f8", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-2gcr-mfcq-wcc3", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4a856afe54fc3fa4", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.11.8: GHSA-3hrh-pfw6-9m5x"}, "properties": {"repobilityId": "ad5bac1729b777bd", "scanner": "scanner-primary", "fingerprint": "4a856afe54fc3fa4", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-3hrh-pfw6-9m5x", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cf78b146e50830aa", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.11.8: GHSA-458j-xx4x-4375"}, "properties": {"repobilityId": "779605d58e6d0d3b", "scanner": "scanner-primary", "fingerprint": "cf78b146e50830aa", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-458j-xx4x-4375", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-de064003f0dfeb87", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.11.8: GHSA-5pq2-9x2x-5p6w"}, "properties": {"repobilityId": "93a7f18db7b04d47", "scanner": "scanner-primary", "fingerprint": "de064003f0dfeb87", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-5pq2-9x2x-5p6w", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c1129c4a57cfdee4", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.11.8: GHSA-69xw-7hcm-h432"}, "properties": {"repobilityId": "de5ea4db56dc3093", "scanner": "scanner-primary", "fingerprint": "c1129c4a57cfdee4", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-69xw-7hcm-h432", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-24d5c4e2a24a451f", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.11.8: GHSA-79qm-7rj5-m7r9"}, "properties": {"repobilityId": "56ff4528defb7994", "scanner": "scanner-primary", "fingerprint": "24d5c4e2a24a451f", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-79qm-7rj5-m7r9", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4e0a7d902d68ef3a", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.11.8: GHSA-88fw-hqm2-52qc"}, "properties": {"repobilityId": "f515170bb886d416", "scanner": "scanner-primary", "fingerprint": "4e0a7d902d68ef3a", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-88fw-hqm2-52qc", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fd13d3bf14994507", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.11.8: GHSA-8j4g-w8fx-2239"}, "properties": {"repobilityId": "ee14c1736d3f1d18", "scanner": "scanner-primary", "fingerprint": "fd13d3bf14994507", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-8j4g-w8fx-2239", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f0ae7efc36b2c794", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.11.8: GHSA-9vqf-7f2p-gf9v"}, "properties": {"repobilityId": "664b523cc869b763", "scanner": "scanner-primary", "fingerprint": "f0ae7efc36b2c794", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-9vqf-7f2p-gf9v", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3f9a53f18b88dd1c", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.11.8: GHSA-crvj-82cr-hjcx"}, "properties": {"repobilityId": "e3239529ef8d4d46", "scanner": "scanner-primary", "fingerprint": "3f9a53f18b88dd1c", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-crvj-82cr-hjcx", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-24ee0cc5958f2610", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.11.8: GHSA-f23p-vx2j-j53r"}, "properties": {"repobilityId": "47e26b325fe55472", "scanner": "scanner-primary", "fingerprint": "24ee0cc5958f2610", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-f23p-vx2j-j53r", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f2a5a5b697015bfc", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.11.8: GHSA-f577-qrjj-4474"}, "properties": {"repobilityId": "d0e5f386931db944", "scanner": "scanner-primary", "fingerprint": "f2a5a5b697015bfc", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-f577-qrjj-4474", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c577105b434132c8", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.11.8: GHSA-g6gw-c38x-mqfc"}, "properties": {"repobilityId": "3dcff2e2a2f48c48", "scanner": "scanner-primary", "fingerprint": "c577105b434132c8", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-g6gw-c38x-mqfc", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cf6230124ad04ea1", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.11.8: GHSA-gq3j-xvxp-8hrf"}, "properties": {"repobilityId": "05f94fff7c9e04f4", "scanner": "scanner-primary", "fingerprint": "cf6230124ad04ea1", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-gq3j-xvxp-8hrf", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cd09414155d18a69", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.11.8: GHSA-gqvv-2mrq-wpjv"}, "properties": {"repobilityId": "354ac2a4c21427f7", "scanner": "scanner-primary", "fingerprint": "cd09414155d18a69", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-gqvv-2mrq-wpjv", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7c6af032f7f72d4e", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.11.8: GHSA-hm8q-7f3q-5f36"}, "properties": {"repobilityId": "fc8f3538d7ee2843", "scanner": "scanner-primary", "fingerprint": "7c6af032f7f72d4e", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-hm8q-7f3q-5f36", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0a0b54385a72c516", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.11.8: GHSA-hvrm-45r6-mjfj"}, "properties": {"repobilityId": "298c95b982b2e44b", "scanner": "scanner-primary", "fingerprint": "0a0b54385a72c516", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-hvrm-45r6-mjfj", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a8a5a0e0e24688e3", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.11.8: GHSA-j6c9-x7qj-28xf"}, "properties": {"repobilityId": "43e1fddd3ac390b9", "scanner": "scanner-primary", "fingerprint": "a8a5a0e0e24688e3", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-j6c9-x7qj-28xf", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f6e9e64d6ad574b2", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.11.8: GHSA-p6xx-57qc-3wxr"}, "properties": {"repobilityId": "d84f1a22d3a0a2ca", "scanner": "scanner-primary", "fingerprint": "f6e9e64d6ad574b2", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-p6xx-57qc-3wxr", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-74024105784f4b50", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.11.8: GHSA-p77w-8qqv-26rm"}, "properties": {"repobilityId": "89a374d4466769a4", "scanner": "scanner-primary", "fingerprint": "74024105784f4b50", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-p77w-8qqv-26rm", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-62d29e8749a8490c", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.11.8: GHSA-q5qw-h33p-qvwr"}, "properties": {"repobilityId": "4a37e37ca8d9f882", "scanner": "scanner-primary", "fingerprint": "62d29e8749a8490c", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-q5qw-h33p-qvwr", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-166a51a6d85514ec", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.11.8: GHSA-qp7p-654g-cw7p"}, "properties": {"repobilityId": "ac48db02bcc367c6", "scanner": "scanner-primary", "fingerprint": "166a51a6d85514ec", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-qp7p-654g-cw7p", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-55803f9138aa12ec", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.11.8: GHSA-r5rp-j6wh-rvv4"}, "properties": {"repobilityId": "d8ace289c020d7d6", "scanner": "scanner-primary", "fingerprint": "55803f9138aa12ec", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-r5rp-j6wh-rvv4", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ebb3a79c06cc7714", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.11.8: GHSA-rv63-4mwf-qqc2"}, "properties": {"repobilityId": "4a500e471ee712bc", "scanner": "scanner-primary", "fingerprint": "ebb3a79c06cc7714", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-rv63-4mwf-qqc2", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e6dfaeb6df6d898e", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.11.8: GHSA-v8w9-8mx6-g223"}, "properties": {"repobilityId": "5224011ac2108733", "scanner": "scanner-primary", "fingerprint": "e6dfaeb6df6d898e", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-v8w9-8mx6-g223", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a4dc3113cf475fb3", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.11.8: GHSA-w62v-xxxg-mg59"}, "properties": {"repobilityId": "147721a1b69b7ac5", "scanner": "scanner-primary", "fingerprint": "a4dc3113cf475fb3", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-w62v-xxxg-mg59", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d434014e6dacc9fc", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.11.8: GHSA-wgpf-jwqj-8h8p"}, "properties": {"repobilityId": "5c2e0381d7dc9b6d", "scanner": "scanner-primary", "fingerprint": "d434014e6dacc9fc", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-wgpf-jwqj-8h8p", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3c9bbbd08b623021", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.11.8: GHSA-wmmm-f939-6g9c"}, "properties": {"repobilityId": "ccb9c6ac4f310621", "scanner": "scanner-primary", "fingerprint": "3c9bbbd08b623021", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-wmmm-f939-6g9c", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7740fd71f1a2ef07", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.11.8: GHSA-wwfh-h76j-fc44"}, "properties": {"repobilityId": "1539d3c42b8d858e", "scanner": "scanner-primary", "fingerprint": "7740fd71f1a2ef07", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-wwfh-h76j-fc44", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-da77c8b0414a6f9a", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.11.8: GHSA-xf4j-xp2r-rqqx"}, "properties": {"repobilityId": "06cf7b6868686bb3", "scanner": "scanner-primary", "fingerprint": "da77c8b0414a6f9a", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-xf4j-xp2r-rqqx", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fc75f9283e8b7803", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.11.8: GHSA-xgm2-5f3f-mvvc"}, "properties": {"repobilityId": "fc3997d998f00b85", "scanner": "scanner-primary", "fingerprint": "fc75f9283e8b7803", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-xgm2-5f3f-mvvc", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-78a9089bd3e3d6bc", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.11.8: GHSA-xpcf-pg52-r92g"}, "properties": {"repobilityId": "472c2beb703c8483", "scanner": "scanner-primary", "fingerprint": "78a9089bd3e3d6bc", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-xpcf-pg52-r92g", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3efb69e474ae83ea", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.11.8: GHSA-xrhx-7g5j-rcj5"}, "properties": {"repobilityId": "10df8440a7484c74", "scanner": "scanner-primary", "fingerprint": "3efb69e474ae83ea", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-xrhx-7g5j-rcj5", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-72a86a382ae4f2bf", "level": "warning", "message": {"text": "Vulnerable dependency ip-address 10.0.1: GHSA-mwp4-54f8-5fhr"}, "properties": {"repobilityId": "b65fc09e97c4c4b6", "scanner": "scanner-primary", "fingerprint": "72a86a382ae4f2bf", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-mwp4-54f8-5fhr", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d2e4a4d1e6bc65fa", "level": "warning", "message": {"text": "Vulnerable dependency ip-address 10.0.1: GHSA-v2v4-37r5-5v8g"}, "properties": {"repobilityId": "0a0bc20325af6972", "scanner": "scanner-primary", "fingerprint": "d2e4a4d1e6bc65fa", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-v2v4-37r5-5v8g", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-dccbb904bebe7694", "level": "error", "message": {"text": "Vulnerable dependency js-yaml 4.1.1: GHSA-2883-xcg3-v3hh"}, "properties": {"repobilityId": "a4a192c1553ce82f", "scanner": "scanner-primary", "fingerprint": "dccbb904bebe7694", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-2883-xcg3-v3hh", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-59b390ce1f5615b9", "level": "error", "message": {"text": "Vulnerable dependency js-yaml 4.1.1: GHSA-52cp-r559-cp3m"}, "properties": {"repobilityId": "bb9354b1169e66e2", "scanner": "scanner-primary", "fingerprint": "59b390ce1f5615b9", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-52cp-r559-cp3m", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b2984ac1801dcfd6", "level": "error", "message": {"text": "Vulnerable dependency js-yaml 4.1.1: GHSA-5p4m-2wfm-xmqj"}, "properties": {"repobilityId": "d199cdf9944050fc", "scanner": "scanner-primary", "fingerprint": "b2984ac1801dcfd6", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-5p4m-2wfm-xmqj", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a2253f9940c5cf8b", "level": "warning", "message": {"text": "Vulnerable dependency js-yaml 4.1.1: GHSA-h67p-54hq-rp68"}, "properties": {"repobilityId": "2e7af66f705e9148", "scanner": "scanner-primary", "fingerprint": "a2253f9940c5cf8b", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-h67p-54hq-rp68", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5eb5dc61949b1f4e", "level": "warning", "message": {"text": "Vulnerable dependency lodash 4.17.23: GHSA-f23m-r3pf-42rh"}, "properties": {"repobilityId": "607ab2f72ddbce11", "scanner": "scanner-primary", "fingerprint": "5eb5dc61949b1f4e", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-f23m-r3pf-42rh", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-67086d01be99fe99", "level": "warning", "message": {"text": "Vulnerable dependency lodash 4.17.23: GHSA-r5fr-rjxr-66jc"}, "properties": {"repobilityId": "d0c25b8fd9b674ff", "scanner": "scanner-primary", "fingerprint": "67086d01be99fe99", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-r5fr-rjxr-66jc", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7444e439b1dcec1d", "level": "error", "message": {"text": "Vulnerable dependency minimatch 3.1.2: GHSA-23c5-xmqv-rm74"}, "properties": {"repobilityId": "9f7f5897e94c3644", "scanner": "scanner-primary", "fingerprint": "7444e439b1dcec1d", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-23c5-xmqv-rm74", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-47065935af486055", "level": "error", "message": {"text": "Vulnerable dependency minimatch 3.1.2: GHSA-3ppc-4f35-3m26"}, "properties": {"repobilityId": "1f348c9c38426ebf", "scanner": "scanner-primary", "fingerprint": "47065935af486055", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-3ppc-4f35-3m26", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9655d91892af536e", "level": "error", "message": {"text": "Vulnerable dependency minimatch 3.1.2: GHSA-7r86-cg39-jmmj"}, "properties": {"repobilityId": "20c31d31e282c8df", "scanner": "scanner-primary", "fingerprint": "9655d91892af536e", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-7r86-cg39-jmmj", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-013bd56662132db3", "level": "error", "message": {"text": "Vulnerable dependency minimatch 9.0.5: GHSA-23c5-xmqv-rm74"}, "properties": {"repobilityId": "3879836d3d26f667", "scanner": "scanner-primary", "fingerprint": "013bd56662132db3", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-23c5-xmqv-rm74", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ac43686fd5f1715d", "level": "error", "message": {"text": "Vulnerable dependency minimatch 9.0.5: GHSA-3ppc-4f35-3m26"}, "properties": {"repobilityId": "3dc5c8f5e4159f29", "scanner": "scanner-primary", "fingerprint": "ac43686fd5f1715d", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-3ppc-4f35-3m26", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fd6c4a3b59b31561", "level": "error", "message": {"text": "Vulnerable dependency minimatch 9.0.5: GHSA-7r86-cg39-jmmj"}, "properties": {"repobilityId": "76439b7ceb6791cb", "scanner": "scanner-primary", "fingerprint": "fd6c4a3b59b31561", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-7r86-cg39-jmmj", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fd374351c437d9a4", "level": "error", "message": {"text": "Vulnerable dependency nanoid 3.3.11: GHSA-28wg-ghj8-5hjv"}, "properties": {"repobilityId": "a28fc942b5b14d8c", "scanner": "scanner-primary", "fingerprint": "fd374351c437d9a4", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-28wg-ghj8-5hjv", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-58b06ed98103623f", "level": "error", "message": {"text": "Vulnerable dependency nanoid 3.3.11: GHSA-2v37-7h3g-55p8"}, "properties": {"repobilityId": "b8c23ab323f99001", "scanner": "scanner-primary", "fingerprint": "58b06ed98103623f", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-2v37-7h3g-55p8", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-54b85ff6a8ca6781", "level": "warning", "message": {"text": "Vulnerable dependency nanoid 3.3.11: GHSA-xwg4-73v4-xw9w"}, "properties": {"repobilityId": "d10186191bb440f8", "scanner": "scanner-primary", "fingerprint": "54b85ff6a8ca6781", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-xwg4-73v4-xw9w", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9598c1ce3568bb87", "level": "warning", "message": {"text": "Vulnerable dependency path-to-regexp 8.3.0: GHSA-27v5-c462-wpq7"}, "properties": {"repobilityId": "07bcbb41f52a90f0", "scanner": "scanner-primary", "fingerprint": "9598c1ce3568bb87", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-27v5-c462-wpq7", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8ee7df8f6b3faaaa", "level": "warning", "message": {"text": "Vulnerable dependency path-to-regexp 8.3.0: GHSA-j3q9-mxjg-w52f"}, "properties": {"repobilityId": "125e8c7ad0cf5399", "scanner": "scanner-primary", "fingerprint": "8ee7df8f6b3faaaa", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-j3q9-mxjg-w52f", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1404758b576b6dcf", "level": "warning", "message": {"text": "Vulnerable dependency picomatch 2.3.1: GHSA-3v7f-55p6-f55p"}, "properties": {"repobilityId": "a2746cb9d8be4794", "scanner": "scanner-primary", "fingerprint": "1404758b576b6dcf", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-3v7f-55p6-f55p", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6ee80ddf00a3fb47", "level": "error", "message": {"text": "Vulnerable dependency picomatch 2.3.1: GHSA-c2c7-rcm5-vvqj"}, "properties": {"repobilityId": "676e59b75389f27b", "scanner": "scanner-primary", "fingerprint": "6ee80ddf00a3fb47", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-c2c7-rcm5-vvqj", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f917074e8f7cb807", "level": "warning", "message": {"text": "Vulnerable dependency picomatch 4.0.3: GHSA-3v7f-55p6-f55p"}, "properties": {"repobilityId": "7c1f64a4b9d5ab32", "scanner": "scanner-primary", "fingerprint": "f917074e8f7cb807", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-3v7f-55p6-f55p", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ae923705bdf60d36", "level": "error", "message": {"text": "Vulnerable dependency picomatch 4.0.3: GHSA-c2c7-rcm5-vvqj"}, "properties": {"repobilityId": "75ae39eb60c1525e", "scanner": "scanner-primary", "fingerprint": "ae923705bdf60d36", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-c2c7-rcm5-vvqj", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8b44aadc91682f74", "level": "warning", "message": {"text": "Vulnerable dependency postcss-selector-parser 7.1.1: GHSA-w9m9-85wc-3x92"}, "properties": {"repobilityId": "53a231458ed5450a", "scanner": "scanner-primary", "fingerprint": "8b44aadc91682f74", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-w9m9-85wc-3x92", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d1e0dd676d27c9c0", "level": "error", "message": {"text": "Vulnerable dependency postcss 8.5.6: GHSA-6g55-p6wh-862q"}, "properties": {"repobilityId": "b8944461c8644339", "scanner": "scanner-primary", "fingerprint": "d1e0dd676d27c9c0", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-6g55-p6wh-862q", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-472514f4284fe176", "level": "warning", "message": {"text": "Vulnerable dependency postcss 8.5.6: GHSA-fxqj-rqcc-2cmp"}, "properties": {"repobilityId": "1f793820cbec4a56", "scanner": "scanner-primary", "fingerprint": "472514f4284fe176", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-fxqj-rqcc-2cmp", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-094fff4eac31d6d5", "level": "warning", "message": {"text": "Vulnerable dependency postcss 8.5.6: GHSA-qx2v-qp2m-jg93"}, "properties": {"repobilityId": "6c83605d3aa8fcef", "scanner": "scanner-primary", "fingerprint": "094fff4eac31d6d5", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-qx2v-qp2m-jg93", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bfdae7735771716e", "level": "error", "message": {"text": "Vulnerable dependency postcss 8.5.6: GHSA-r28c-9q8g-f849"}, "properties": {"repobilityId": "952a6afbc97e5c3e", "scanner": "scanner-primary", "fingerprint": "bfdae7735771716e", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-r28c-9q8g-f849", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-96a42be839cac476", "level": "warning", "message": {"text": "Vulnerable dependency qs 6.14.1: GHSA-4mjr-xmp4-gh2g"}, "properties": {"repobilityId": "33366ac1d6048112", "scanner": "scanner-primary", "fingerprint": "96a42be839cac476", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-4mjr-xmp4-gh2g", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-aeb135b762b7cfe5", "level": "warning", "message": {"text": "Vulnerable dependency qs 6.14.1: GHSA-q8mj-m7cp-5q26"}, "properties": {"repobilityId": "1f0b8b0f86313e91", "scanner": "scanner-primary", "fingerprint": "aeb135b762b7cfe5", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-q8mj-m7cp-5q26", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7c368d48c081dacb", "level": "warning", "message": {"text": "Vulnerable dependency qs 6.14.1: GHSA-w7fw-mjwx-w883"}, "properties": {"repobilityId": "837b12f962a87956", "scanner": "scanner-primary", "fingerprint": "7c368d48c081dacb", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-w7fw-mjwx-w883", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f4cdada2a02c5ec2", "level": "warning", "message": {"text": "Vulnerable dependency yaml 2.8.2: GHSA-48c2-rrv3-qjmp"}, "properties": {"repobilityId": "05653192128144a2", "scanner": "scanner-primary", "fingerprint": "f4cdada2a02c5ec2", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-48c2-rrv3-qjmp", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pnpm-lock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-20ce30b7c97c7466", "level": "note", "message": {"text": "Dependency @modelcontextprotocol/ext-apps is a major version behind"}, "properties": {"repobilityId": "40f51108f549e344", "scanner": "scanner-primary", "fingerprint": "20ce30b7c97c7466", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d637c276d64febc3", "level": "note", "message": {"text": "Dependency zod is a major version behind"}, "properties": {"repobilityId": "6497a44c2aee361f", "scanner": "scanner-primary", "fingerprint": "d637c276d64febc3", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}]}]}