{ "history": [ { "added": 0, "commit": "1c37c007d2b625cf9a89f2484634c8ed7a725270", "date": "2026-11-01", "dependencies": 7, "errors": [], "fixable": 1, "go_version": null, "in_binary": null, "new_vulnerabilities": 0, "osv_confirmed": 0, "osv_only": 15, "ref": "1.5.27", "release_changed": false, "release_integrity": "verified", "removed": 0, "resolved_vulnerabilities": 0, "scorecard": 4.5, "upgraded": 0, "vulnerabilities": { "Critical": 0, "High": 1, "Low": 0, "Medium": 0, "Negligible": 0, "Unknown": 0 }, "workflow": { "High": 18, "Low": 2, "Medium": 7, "files": 4 } }, { "added": 273, "commit": "1c37c007d2b625cf9a89f2484634c8ed7a725270", "date": "2026-11-02", "dependencies": 280, "errors": [], "fixable": 14, "go_version": null, "in_binary": null, "kev": 0, "kev_new": 0, "new_vulnerabilities": 15, "osv_confirmed": 15, "osv_only": 0, "ref": "1.5.27", "release_changed": false, "release_integrity": "immutable", "removed": 0, "resolved_vulnerabilities": 1, "scorecard": 4.5, "scorecard_date": "2026-11-02", "scorecard_note": null, "scorecard_source": "scorecard-cli", "upgraded": 0, "vulnerabilities": { "Critical": 0, "High": 6, "Low": 3, "Medium": 6, "Negligible": 0, "Unknown": 0 }, "vulnerable_packages": 4, "workflow": { "High": 18, "Low": 2, "Medium": 7, "files": 4 } } ], "latest": { "archived": false, "category": "Software Composition Analysis (SCA)", "changes": { "added": [ "@aikidosec/safe-chain@1.0.0", "@aikidosec/safe-chain@UNKNOWN", "@aikidosec/safe-chain-e2e-tests@1.0.0", "@aikidosec/safe-chain-e2e-tests@UNKNOWN", "@babel/code-frame@7.29.7", "@babel/generator@7.29.8", "@babel/helper-globals@7.29.7", "@babel/helper-string-parser@7.29.11", "@babel/helper-validator-identifier@7.29.7", "@babel/parser@7.29.11", "@babel/template@7.29.7", "@babel/traverse@7.29.10", "@babel/types@7.29.11", "@esbuild/aix-ppc64@0.27.0", "@esbuild/aix-ppc64@0.28.2", "@esbuild/android-arm@0.27.0", "@esbuild/android-arm@0.28.2", "@esbuild/android-arm64@0.27.0", "@esbuild/android-arm64@0.28.2", "@esbuild/android-x64@0.27.0", "@esbuild/android-x64@0.28.2", "@esbuild/darwin-arm64@0.27.0", "@esbuild/darwin-arm64@0.28.2", "@esbuild/darwin-x64@0.27.0", "@esbuild/darwin-x64@0.28.2", "@esbuild/freebsd-arm64@0.27.0", "@esbuild/freebsd-arm64@0.28.2", "@esbuild/freebsd-x64@0.27.0", "@esbuild/freebsd-x64@0.28.2", "@esbuild/linux-arm@0.27.0", "@esbuild/linux-arm@0.28.2", "@esbuild/linux-arm64@0.27.0", "@esbuild/linux-arm64@0.28.2", "@esbuild/linux-ia32@0.27.0", "@esbuild/linux-ia32@0.28.2", "@esbuild/linux-loong64@0.27.0", "@esbuild/linux-loong64@0.28.2", "@esbuild/linux-mips64el@0.27.0", "@esbuild/linux-mips64el@0.28.2", "@esbuild/linux-ppc64@0.27.0", "@esbuild/linux-ppc64@0.28.2", "@esbuild/linux-riscv64@0.27.0", "@esbuild/linux-riscv64@0.28.2", "@esbuild/linux-s390x@0.27.0", "@esbuild/linux-s390x@0.28.2", "@esbuild/linux-x64@0.27.0", "@esbuild/linux-x64@0.28.2", "@esbuild/netbsd-arm64@0.27.0", "@esbuild/netbsd-arm64@0.28.2", "@esbuild/netbsd-x64@0.27.0", "@esbuild/netbsd-x64@0.28.2", "@esbuild/openbsd-arm64@0.27.0", "@esbuild/openbsd-arm64@0.28.2", "@esbuild/openbsd-x64@0.27.0", "@esbuild/openbsd-x64@0.28.2", "@esbuild/openharmony-arm64@0.27.0", "@esbuild/openharmony-arm64@0.28.2", "@esbuild/sunos-x64@0.27.0", "@esbuild/sunos-x64@0.28.2", "@esbuild/win32-arm64@0.27.0", "@esbuild/win32-arm64@0.28.2", "@esbuild/win32-ia32@0.27.0", "@esbuild/win32-ia32@0.28.2", "@esbuild/win32-x64@0.27.0", "@esbuild/win32-x64@0.28.2", "@isaacs/fs-minipass@4.0.1", "@jridgewell/gen-mapping@0.3.13", "@jridgewell/resolve-uri@3.1.2", "@jridgewell/sourcemap-codec@1.5.5", "@jridgewell/trace-mapping@0.3.31", "@npmcli/agent@4.0.0", "@npmcli/fs@5.0.0", "@npmcli/redact@4.0.0", "@oxlint/darwin-arm64@1.22.0", "@oxlint/darwin-x64@1.22.0", "@oxlint/linux-arm64-gnu@1.22.0", "@oxlint/linux-arm64-musl@1.22.0", "@oxlint/linux-x64-gnu@1.22.0", "@oxlint/linux-x64-musl@1.22.0", "@oxlint/win32-arm64@1.22.0", "@oxlint/win32-x64@1.22.0", "@roberts_lando/vfs@0.3.3", "@types/ini@4.1.1", "@types/make-fetch-happen@10.0.4", "@types/node@18.19.130", "@types/node@24.9.2", "@types/node-fetch@2.6.13", "@types/node-forge@1.3.14", "@types/npm-package-arg@6.1.4", "@types/npm-registry-fetch@8.0.9", "@types/npmlog@7.0.0", "@types/retry@0.12.5", "@types/semver@7.7.1", "@types/ssri@7.1.5", "@yao-pkg/pkg@6.24.0", "@yao-pkg/pkg-fetch@3.6.7", "agent-base@7.1.3", "aikido-safe-chain-workspace@UNKNOWN", "ansi-regex@5.0.1", "ansi-styles@4.3.0", "asynckit@0.4.0", "b4a@1.9.0", "balanced-match@4.0.4", "bare-events@2.9.2", "bare-fs@4.8.4", "bare-path@3.1.2", "bare-stream@2.13.4", "bare-url@2.5.5", "base64-js@1.5.1", "bl@4.1.0", "bluebird@3.7.2", "brace-expansion@5.0.12", "buffer@5.7.1", "cacache@20.0.3", "call-bind-apply-helpers@1.0.2", "chalk@5.4.1", "chownr@1.1.4", "chownr@3.0.0", "cliui@7.0.4", "color-convert@2.0.1", "color-name@1.1.4", "combined-stream@1.0.8", "commander@9.5.0", "core-util-is@1.0.3", "debug@4.4.0", "decompress-response@6.0.0", "deep-extend@0.6.0", "delayed-stream@1.0.0", "detect-libc@2.1.2", "dunder-proto@1.0.1", "duplexer2@0.1.4", "emoji-regex@8.0.0", "encoding@0.1.13", "end-of-stream@1.4.5", "err-code@2.0.3", "es-define-property@1.0.1", "es-errors@1.3.0", "es-object-atoms@1.1.1", "es-set-tostringtag@2.1.0", "esbuild@0.27.0", "esbuild@0.28.2", "escalade@3.2.0", "events-universal@1.0.1", "expand-template@2.0.3", "fast-fifo@1.3.2", "fdir@6.5.0", "form-data@4.0.6", "fs-constants@1.0.0", "fs-extra@11.3.2", "fs-minipass@3.0.3", "function-bind@1.1.2", "get-caller-file@2.0.5", "get-intrinsic@1.3.0", "get-proto@1.0.1", "github-from-package@0.0.0", "glob@13.0.0", "gopd@1.2.0", "graceful-fs@4.2.11", "has-symbols@1.1.0", "has-tostringtag@1.0.2", "hasown@2.0.2", "hasown@2.0.4", "hosted-git-info@9.0.2", "http-cache-semantics@4.3.0", "http-proxy-agent@7.0.2", "https-proxy-agent@7.0.6", "iconv-lite@0.6.3", "ieee754@1.2.1", "imurmurhash@0.1.4", "inherits@2.0.4", "ini@1.3.8", "ini@6.0.0", "into-stream@9.1.0", "ip-address@10.7.3", "is-core-module@2.16.1", "is-fullwidth-code-point@3.0.0", "isarray@1.0.0", "js-tokens@4.0.0", "jsesc@3.1.0", "jsonfile@6.2.0", "jsonparse@1.3.1", "lru-cache@11.2.2", "make-fetch-happen@15.0.3", "math-intrinsics@1.1.0", "mime-db@1.52.0", "mime-types@2.1.35", "mimic-response@3.1.0", "minimatch@10.2.5", "minimist@1.2.8", "minipass@3.3.6", "minipass@7.1.2", "minipass-collect@2.0.1", "minipass-fetch@5.0.0", "minipass-flush@1.0.5", "minipass-pipeline@1.2.4", "minipass-sized@1.0.3", "minizlib@3.1.0", "mkdirp-classic@0.5.3", "ms@2.1.3", "multistream@4.1.0", "nan@2.23.0", "napi-build-utils@2.0.0", "negotiator@1.0.0", "node-abi@3.85.0", "node-forge@1.4.0", "node-int64@0.4.0", "node-pty@1.0.0", "npm-package-arg@13.0.2", "npm-registry-fetch@19.1.1", "once@1.4.0", "oxlint@1.22.0", "p-map@7.0.4", "path-parse@1.0.7", "path-scurry@2.0.1", "picocolors@1.1.1", "picomatch@4.0.7", "postject@1.0.0-alpha.6", "prebuild-install@7.1.3", "proc-log@6.1.0", "process-nextick-args@2.0.1", "progress@2.0.3", "promise-retry@2.0.1", "pump@3.0.3", "rc@1.2.8", "readable-stream@2.3.8", "readable-stream@3.6.2", "require-directory@2.1.1", "resolve@1.22.11", "resolve.exports@2.0.4", "retry@0.12.0", "safe-buffer@5.1.2", "safer-buffer@2.1.2", "semver@7.7.2", "simple-concat@1.0.1", "simple-get@4.0.1", "smart-buffer@4.2.0", "socks@2.8.7", "socks-proxy-agent@8.0.5", "ssri@13.0.0", "stream-meter@1.0.4", "streamx@2.28.1", "string-width@4.2.3", "string_decoder@1.1.1", "strip-ansi@6.0.1", "strip-json-comments@2.0.1", "supports-preserve-symlinks-flag@1.0.0", "tar@7.5.22", "tar-fs@2.1.4", "tar-fs@3.1.3", "tar-stream@2.2.0", "tar-stream@3.2.2", "teex@1.0.1", "text-decoder@1.2.7", "tinyglobby@0.2.15", "tunnel-agent@0.6.0", "typescript@5.9.3", "undici@7.30.1", "undici-types@5.26.5", "undici-types@7.16.0", "unique-filename@5.0.0", "unique-slug@6.0.0", "universalify@2.0.1", "unzipper@0.12.3", "util-deprecate@1.0.2", "validate-npm-package-name@7.0.0", "wrap-ansi@7.0.0", "wrappy@1.0.2", "y18n@5.0.8", "yallist@4.0.0", "yallist@5.0.0", "yaml@2.9.1", "yargs@16.2.2", "yargs-parser@20.2.9" ], "any": true, "baseline": false, "integrity_drift": 0, "license_changes": [], "new_vulnerabilities": [ { "aliases": [ "CVE-2026-118773" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-118773", "percentile": 0.28707, "score": 0.0035 }, "fix_state": "fixed", "fixed_in": [ "14.0.2" ], "id": "GHSA-3g3m-2fjr-6pw4", "kev": null, "location": "npm-shrinkwrap.json", "osv_confirmed": true, "package": "glob", "severity": "Medium", "summary": "Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal", "url": "https://github.com/advisories/GHSA-3g3m-2fjr-6pw4", "version": "13.0.0" }, { "aliases": [ "CVE-2026-118780" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-118780", "percentile": 0.06585, "score": 0.00172 }, "fix_state": "fixed", "fixed_in": [ "1.4.1" ], "id": "GHSA-4487-j8r4-4g2f", "kev": null, "location": "npm-shrinkwrap.json", "osv_confirmed": true, "package": "node-forge", "severity": "Low", "summary": "Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store", "url": "https://github.com/advisories/GHSA-4487-j8r4-4g2f", "version": "1.4.0" }, { "aliases": [ "CVE-2026-118775" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-118775", "percentile": 0.24273, "score": 0.00313 }, "fix_state": "fixed", "fixed_in": [ "1.4.1" ], "id": "GHSA-4642-5mcj-2rqw", "kev": null, "location": "npm-shrinkwrap.json", "osv_confirmed": true, "package": "node-forge", "severity": "Low", "summary": "Forge: ASN.1 OID first arc truncation in asn1.oidToDer", "url": "https://github.com/advisories/GHSA-4642-5mcj-2rqw", "version": "1.4.0" }, { "aliases": [ "CVE-2026-118778" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-118778", "percentile": 0.10363, "score": 0.00204 }, "fix_state": "fixed", "fixed_in": [ "1.4.1" ], "id": "GHSA-525v-9gp9-w22h", "kev": null, "location": "npm-shrinkwrap.json", "osv_confirmed": true, "package": "node-forge", "severity": "Medium", "summary": "Forge: TLS client crash when the server sends no certificate", "url": "https://github.com/advisories/GHSA-525v-9gp9-w22h", "version": "1.4.0" }, { "aliases": [ "CVE-2026-119186" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-119186", "percentile": 0.1069, "score": 0.00206 }, "fix_state": "fixed", "fixed_in": [ "1.4.1" ], "id": "GHSA-5cwg-6vw7-rj6p", "kev": null, "location": "npm-shrinkwrap.json", "osv_confirmed": true, "package": "node-forge", "severity": "Medium", "summary": "Forge: AES-GCM authentication bypass via unvalidated tagLength option", "url": "https://github.com/advisories/GHSA-5cwg-6vw7-rj6p", "version": "1.4.0" }, { "aliases": [ "CVE-2026-119190" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-119190", "percentile": 0.15892, "score": 0.00246 }, "fix_state": "fixed", "fixed_in": [ "1.4.1" ], "id": "GHSA-5x38-2vff-x55p", "kev": null, "location": "npm-shrinkwrap.json", "osv_confirmed": true, "package": "node-forge", "severity": "High", "summary": "Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13", "url": "https://github.com/advisories/GHSA-5x38-2vff-x55p", "version": "1.4.0" }, { "aliases": [ "CVE-2026-118777" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-118777", "percentile": 0.17154, "score": 0.00255 }, "fix_state": "fixed", "fixed_in": [ "1.4.1" ], "id": "GHSA-6wvx-3r32-xmcg", "kev": null, "location": "npm-shrinkwrap.json", "osv_confirmed": true, "package": "node-forge", "severity": "Medium", "summary": "Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie", "url": "https://github.com/advisories/GHSA-6wvx-3r32-xmcg", "version": "1.4.0" }, { "aliases": [ "CVE-2026-118779" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-118779", "percentile": 0.46398, "score": 0.00556 }, "fix_state": "fixed", "fixed_in": [ "1.4.1" ], "id": "GHSA-7wch-p9px-956x", "kev": null, "location": "npm-shrinkwrap.json", "osv_confirmed": true, "package": "node-forge", "severity": "High", "summary": "Forge: Regular expression denial of service in PEM decoding (pem.decode)", "url": "https://github.com/advisories/GHSA-7wch-p9px-956x", "version": "1.4.0" }, { "aliases": [ "CVE-2026-85393" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-85393", "percentile": 0.16151, "score": 0.00248 }, "fix_state": "not-fixed", "fixed_in": [], "id": "GHSA-86w9-cpqp-85rv", "kev": null, "location": "npm-shrinkwrap.json", "osv_confirmed": true, "package": "node-forge", "severity": "High", "summary": "node-forge RSA PKCS#1 v1.5 signature verification accepts extra nested DigestAlgorithm elements", "url": "https://github.com/advisories/GHSA-86w9-cpqp-85rv", "version": "1.4.0" }, { "aliases": [ "CVE-2026-119188" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-119188", "percentile": 0.35414, "score": 0.00411 }, "fix_state": "fixed", "fixed_in": [ "1.4.1" ], "id": "GHSA-8hrf-8g6f-7xwp", "kev": null, "location": "npm-shrinkwrap.json", "osv_confirmed": true, "package": "node-forge", "severity": "High", "summary": "Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message", "url": "https://github.com/advisories/GHSA-8hrf-8g6f-7xwp", "version": "1.4.0" }, { "aliases": [ "CVE-2026-118764" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-118764", "percentile": 0.21751, "score": 0.00291 }, "fix_state": "fixed", "fixed_in": [ "11.0.1" ], "id": "GHSA-g3hv-75wg-m249", "kev": null, "location": "npm-shrinkwrap.json", "osv_confirmed": true, "package": "minimatch", "severity": "Medium", "summary": "minimatch has potential denial of service via globparts amplification", "url": "https://github.com/advisories/GHSA-g3hv-75wg-m249", "version": "10.2.5" }, { "aliases": [ "CVE-2026-118781" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-118781", "percentile": 0.01734, "score": 0.00119 }, "fix_state": "fixed", "fixed_in": [ "1.4.1" ], "id": "GHSA-h6cr-wjv9-3cpp", "kev": null, "location": "npm-shrinkwrap.json", "osv_confirmed": true, "package": "node-forge", "severity": "Low", "summary": "Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891)", "url": "https://github.com/advisories/GHSA-h6cr-wjv9-3cpp", "version": "1.4.0" }, { "aliases": [ "CVE-2026-119187" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-119187", "percentile": 0.35799, "score": 0.00415 }, "fix_state": "fixed", "fixed_in": [ "1.4.1" ], "id": "GHSA-hqq3-7jhf-c5jx", "kev": null, "location": "npm-shrinkwrap.json", "osv_confirmed": true, "package": "node-forge", "severity": "High", "summary": "Forge: Denial of service in TLS record processing via call stack exhaustion", "url": "https://github.com/advisories/GHSA-hqq3-7jhf-c5jx", "version": "1.4.0" }, { "aliases": [ "CVE-2026-118782" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-118782", "percentile": 0.02195, "score": 0.00125 }, "fix_state": "fixed", "fixed_in": [ "1.4.1" ], "id": "GHSA-jc66-7q78-782g", "kev": null, "location": "npm-shrinkwrap.json", "osv_confirmed": true, "package": "node-forge", "severity": "High", "summary": "Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count", "url": "https://github.com/advisories/GHSA-jc66-7q78-782g", "version": "1.4.0" }, { "aliases": [ "CVE-2026-111997" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-111997", "percentile": 0.24409, "score": 0.00315 }, "fix_state": "fixed", "fixed_in": [ "10.7.4" ], "id": "GHSA-rxp7-6hxx-x8q5", "kev": null, "location": "npm-shrinkwrap.json", "osv_confirmed": true, "package": "ip-address", "severity": "Medium", "summary": "ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process", "url": "https://github.com/advisories/GHSA-rxp7-6hxx-x8q5", "version": "10.7.3" } ], "previous_ref": "1.5.27", "release_changed": false, "release_integrity": { "from": "verified", "to": "immutable" }, "removed": [], "resolved_vulnerabilities": [ { "aliases": [], "ecosystem": "github", "fix_state": "fixed", "fixed_in": [ "4.1.3" ], "id": "GHSA-cxww-7g56-2vh6", "location": ".github/workflows/create-artifact.yml", "osv_confirmed": false, "package": "actions/download-artifact", "severity": "High", "url": "https://github.com/advisories/GHSA-cxww-7g56-2vh6", "version": "v4" } ], "upgraded": [], "workflow_new": 0, "workflow_resolved": 0 }, "commit": "1c37c007d2b625cf9a89f2484634c8ed7a725270", "compliance": { "overall_score": 55, "standards": { "bsi_tr03183": { "failed_checks": [ "Component Creator", "Distribution Licences", "SHA-512 Hash", "Dependency Relationship", "SBOM Creator Contact" ], "passed": 4, "score": 44, "total": 9 }, "cisa": { "failed_checks": [ "Software Producer", "Dependency Relationship", "License Information", "Component Hash", "SBOM Author" ], "passed": 5, "score": 50, "total": 10 }, "ntia": { "failed_checks": [ "Supplier Name", "Dependency Relationship" ], "passed": 5, "score": 71, "total": 7 } } }, "components": [ { "ecosystem": "github", "licenses": [], "location": ".github/workflows/build-and-release.yml", "name": "actions/checkout", "purl": "pkg:github/actions/checkout@v3", "version": "v3" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/bump-endpoint.yml", "name": "actions/checkout", "purl": "pkg:github/actions/checkout@v4", "version": "v4" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/build-and-release.yml", "name": "actions/download-artifact", "purl": "pkg:github/actions/download-artifact@v4", "version": "v4" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/build-and-release.yml", "name": "actions/setup-node", "purl": "pkg:github/actions/setup-node@v3", "version": "v3" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/test-on-pr.yml", "name": "actions/setup-node", "purl": "pkg:github/actions/setup-node@v4", "version": "v4" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/create-artifact.yml", "name": "actions/upload-artifact", "purl": "pkg:github/actions/upload-artifact@v4", "version": "v4" }, { "ecosystem": "npm", "licenses": [ "AGPL-3.0-or-later" ], "location": "npm-shrinkwrap.json", "name": "@aikidosec/safe-chain", "purl": "pkg:npm/%40aikidosec/safe-chain@1.0.0", "version": "1.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "npm-shrinkwrap.json", "name": "@aikidosec/safe-chain", "purl": "pkg:npm/%40aikidosec/safe-chain", "version": "UNKNOWN" }, { "ecosystem": "npm", "licenses": [ "AGPL-3.0-or-later" ], "location": "npm-shrinkwrap.json", "name": "@aikidosec/safe-chain-e2e-tests", "purl": "pkg:npm/%40aikidosec/safe-chain-e2e-tests@1.0.0", "version": "1.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "npm-shrinkwrap.json", "name": "@aikidosec/safe-chain-e2e-tests", "purl": "pkg:npm/%40aikidosec/safe-chain-e2e-tests", "version": "UNKNOWN" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "@babel/code-frame", "purl": "pkg:npm/%40babel/code-frame@7.29.7", "version": "7.29.7" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "@babel/generator", "purl": "pkg:npm/%40babel/generator@7.29.8", "version": "7.29.8" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "@babel/helper-globals", "purl": "pkg:npm/%40babel/helper-globals@7.29.7", "version": "7.29.7" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "@babel/helper-string-parser", "purl": "pkg:npm/%40babel/helper-string-parser@7.29.11", "version": "7.29.11" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "@babel/helper-validator-identifier", "purl": "pkg:npm/%40babel/helper-validator-identifier@7.29.7", "version": "7.29.7" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "@babel/parser", "purl": "pkg:npm/%40babel/parser@7.29.11", "version": "7.29.11" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "@babel/template", "purl": "pkg:npm/%40babel/template@7.29.7", "version": "7.29.7" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "@babel/traverse", "purl": "pkg:npm/%40babel/traverse@7.29.10", "version": "7.29.10" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "@babel/types", "purl": "pkg:npm/%40babel/types@7.29.11", "version": "7.29.11" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "@esbuild/aix-ppc64", "purl": "pkg:npm/%40esbuild/aix-ppc64@0.27.0", "version": "0.27.0" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "@esbuild/aix-ppc64", "purl": "pkg:npm/%40esbuild/aix-ppc64@0.28.2", "version": "0.28.2" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "@esbuild/android-arm", "purl": "pkg:npm/%40esbuild/android-arm@0.27.0", "version": "0.27.0" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "@esbuild/android-arm", "purl": "pkg:npm/%40esbuild/android-arm@0.28.2", "version": "0.28.2" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "@esbuild/android-arm64", "purl": "pkg:npm/%40esbuild/android-arm64@0.27.0", "version": "0.27.0" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "@esbuild/android-arm64", "purl": "pkg:npm/%40esbuild/android-arm64@0.28.2", "version": "0.28.2" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "@esbuild/android-x64", "purl": "pkg:npm/%40esbuild/android-x64@0.27.0", "version": "0.27.0" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "@esbuild/android-x64", "purl": "pkg:npm/%40esbuild/android-x64@0.28.2", "version": "0.28.2" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "@esbuild/darwin-arm64", "purl": "pkg:npm/%40esbuild/darwin-arm64@0.27.0", "version": "0.27.0" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "@esbuild/darwin-arm64", "purl": "pkg:npm/%40esbuild/darwin-arm64@0.28.2", "version": "0.28.2" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "@esbuild/darwin-x64", "purl": "pkg:npm/%40esbuild/darwin-x64@0.27.0", "version": "0.27.0" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "@esbuild/darwin-x64", "purl": "pkg:npm/%40esbuild/darwin-x64@0.28.2", "version": "0.28.2" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "@esbuild/freebsd-arm64", "purl": "pkg:npm/%40esbuild/freebsd-arm64@0.27.0", "version": "0.27.0" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "@esbuild/freebsd-arm64", "purl": "pkg:npm/%40esbuild/freebsd-arm64@0.28.2", "version": "0.28.2" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "@esbuild/freebsd-x64", "purl": "pkg:npm/%40esbuild/freebsd-x64@0.27.0", "version": "0.27.0" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "@esbuild/freebsd-x64", "purl": "pkg:npm/%40esbuild/freebsd-x64@0.28.2", "version": "0.28.2" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "@esbuild/linux-arm", "purl": "pkg:npm/%40esbuild/linux-arm@0.27.0", "version": "0.27.0" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "@esbuild/linux-arm", "purl": "pkg:npm/%40esbuild/linux-arm@0.28.2", "version": "0.28.2" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "@esbuild/linux-arm64", "purl": "pkg:npm/%40esbuild/linux-arm64@0.27.0", "version": "0.27.0" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "@esbuild/linux-arm64", "purl": "pkg:npm/%40esbuild/linux-arm64@0.28.2", "version": "0.28.2" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "@esbuild/linux-ia32", "purl": "pkg:npm/%40esbuild/linux-ia32@0.27.0", "version": "0.27.0" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "@esbuild/linux-ia32", "purl": "pkg:npm/%40esbuild/linux-ia32@0.28.2", "version": "0.28.2" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "@esbuild/linux-loong64", "purl": "pkg:npm/%40esbuild/linux-loong64@0.27.0", "version": "0.27.0" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "@esbuild/linux-loong64", "purl": "pkg:npm/%40esbuild/linux-loong64@0.28.2", "version": "0.28.2" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "@esbuild/linux-mips64el", "purl": "pkg:npm/%40esbuild/linux-mips64el@0.27.0", "version": "0.27.0" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "@esbuild/linux-mips64el", "purl": "pkg:npm/%40esbuild/linux-mips64el@0.28.2", "version": "0.28.2" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "@esbuild/linux-ppc64", "purl": "pkg:npm/%40esbuild/linux-ppc64@0.27.0", "version": "0.27.0" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "@esbuild/linux-ppc64", "purl": "pkg:npm/%40esbuild/linux-ppc64@0.28.2", "version": "0.28.2" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "@esbuild/linux-riscv64", "purl": "pkg:npm/%40esbuild/linux-riscv64@0.27.0", "version": "0.27.0" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "@esbuild/linux-riscv64", "purl": "pkg:npm/%40esbuild/linux-riscv64@0.28.2", "version": "0.28.2" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "@esbuild/linux-s390x", "purl": "pkg:npm/%40esbuild/linux-s390x@0.27.0", "version": "0.27.0" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "@esbuild/linux-s390x", "purl": "pkg:npm/%40esbuild/linux-s390x@0.28.2", "version": "0.28.2" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "@esbuild/linux-x64", "purl": "pkg:npm/%40esbuild/linux-x64@0.27.0", "version": "0.27.0" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "@esbuild/linux-x64", "purl": "pkg:npm/%40esbuild/linux-x64@0.28.2", "version": "0.28.2" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "@esbuild/netbsd-arm64", "purl": "pkg:npm/%40esbuild/netbsd-arm64@0.27.0", "version": "0.27.0" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "@esbuild/netbsd-arm64", "purl": "pkg:npm/%40esbuild/netbsd-arm64@0.28.2", "version": "0.28.2" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "@esbuild/netbsd-x64", "purl": "pkg:npm/%40esbuild/netbsd-x64@0.27.0", "version": "0.27.0" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "@esbuild/netbsd-x64", "purl": "pkg:npm/%40esbuild/netbsd-x64@0.28.2", "version": "0.28.2" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "@esbuild/openbsd-arm64", "purl": "pkg:npm/%40esbuild/openbsd-arm64@0.27.0", "version": "0.27.0" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "@esbuild/openbsd-arm64", "purl": "pkg:npm/%40esbuild/openbsd-arm64@0.28.2", "version": "0.28.2" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "@esbuild/openbsd-x64", "purl": "pkg:npm/%40esbuild/openbsd-x64@0.27.0", "version": "0.27.0" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "@esbuild/openbsd-x64", "purl": "pkg:npm/%40esbuild/openbsd-x64@0.28.2", "version": "0.28.2" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "@esbuild/openharmony-arm64", "purl": "pkg:npm/%40esbuild/openharmony-arm64@0.27.0", "version": "0.27.0" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "@esbuild/openharmony-arm64", "purl": "pkg:npm/%40esbuild/openharmony-arm64@0.28.2", "version": "0.28.2" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "@esbuild/sunos-x64", "purl": "pkg:npm/%40esbuild/sunos-x64@0.27.0", "version": "0.27.0" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "@esbuild/sunos-x64", "purl": "pkg:npm/%40esbuild/sunos-x64@0.28.2", "version": "0.28.2" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "@esbuild/win32-arm64", "purl": "pkg:npm/%40esbuild/win32-arm64@0.27.0", "version": "0.27.0" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "@esbuild/win32-arm64", "purl": "pkg:npm/%40esbuild/win32-arm64@0.28.2", "version": "0.28.2" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "@esbuild/win32-ia32", "purl": "pkg:npm/%40esbuild/win32-ia32@0.27.0", "version": "0.27.0" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "@esbuild/win32-ia32", "purl": "pkg:npm/%40esbuild/win32-ia32@0.28.2", "version": "0.28.2" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "@esbuild/win32-x64", "purl": "pkg:npm/%40esbuild/win32-x64@0.27.0", "version": "0.27.0" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "@esbuild/win32-x64", "purl": "pkg:npm/%40esbuild/win32-x64@0.28.2", "version": "0.28.2" }, { "ecosystem": "npm", "licenses": [ "ISC" ], "location": "npm-shrinkwrap.json", "name": "@isaacs/fs-minipass", "purl": "pkg:npm/%40isaacs/fs-minipass@4.0.1", "version": "4.0.1" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "@jridgewell/gen-mapping", "purl": "pkg:npm/%40jridgewell/gen-mapping@0.3.13", "version": "0.3.13" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "@jridgewell/resolve-uri", "purl": "pkg:npm/%40jridgewell/resolve-uri@3.1.2", "version": "3.1.2" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "@jridgewell/sourcemap-codec", "purl": "pkg:npm/%40jridgewell/sourcemap-codec@1.5.5", "version": "1.5.5" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "@jridgewell/trace-mapping", "purl": "pkg:npm/%40jridgewell/trace-mapping@0.3.31", "version": "0.3.31" }, { "ecosystem": "npm", "licenses": [ "ISC" ], "location": "npm-shrinkwrap.json", "name": "@npmcli/agent", "purl": "pkg:npm/%40npmcli/agent@4.0.0", "version": "4.0.0" }, { "ecosystem": "npm", "licenses": [ "ISC" ], "location": "npm-shrinkwrap.json", "name": "@npmcli/fs", "purl": "pkg:npm/%40npmcli/fs@5.0.0", "version": "5.0.0" }, { "ecosystem": "npm", "licenses": [ "ISC" ], "location": "npm-shrinkwrap.json", "name": "@npmcli/redact", "purl": "pkg:npm/%40npmcli/redact@4.0.0", "version": "4.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "npm-shrinkwrap.json", "name": "@oxlint/darwin-arm64", "purl": "pkg:npm/%40oxlint/darwin-arm64@1.22.0", "version": "1.22.0" }, { "ecosystem": "npm", "licenses": [], "location": "npm-shrinkwrap.json", "name": "@oxlint/darwin-x64", "purl": "pkg:npm/%40oxlint/darwin-x64@1.22.0", "version": "1.22.0" }, { "ecosystem": "npm", "licenses": [], "location": "npm-shrinkwrap.json", "name": "@oxlint/linux-arm64-gnu", "purl": "pkg:npm/%40oxlint/linux-arm64-gnu@1.22.0", "version": "1.22.0" }, { "ecosystem": "npm", "licenses": [], "location": "npm-shrinkwrap.json", "name": "@oxlint/linux-arm64-musl", "purl": "pkg:npm/%40oxlint/linux-arm64-musl@1.22.0", "version": "1.22.0" }, { "ecosystem": "npm", "licenses": [], "location": "npm-shrinkwrap.json", "name": "@oxlint/linux-x64-gnu", "purl": "pkg:npm/%40oxlint/linux-x64-gnu@1.22.0", "version": "1.22.0" }, { "ecosystem": "npm", "licenses": [], "location": "npm-shrinkwrap.json", "name": "@oxlint/linux-x64-musl", "purl": "pkg:npm/%40oxlint/linux-x64-musl@1.22.0", "version": "1.22.0" }, { "ecosystem": "npm", "licenses": [], "location": "npm-shrinkwrap.json", "name": "@oxlint/win32-arm64", "purl": "pkg:npm/%40oxlint/win32-arm64@1.22.0", "version": "1.22.0" }, { "ecosystem": "npm", "licenses": [], "location": "npm-shrinkwrap.json", "name": "@oxlint/win32-x64", "purl": "pkg:npm/%40oxlint/win32-x64@1.22.0", "version": "1.22.0" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "@roberts_lando/vfs", "purl": "pkg:npm/%40roberts_lando/vfs@0.3.3", "version": "0.3.3" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "@types/ini", "purl": "pkg:npm/%40types/ini@4.1.1", "version": "4.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "npm-shrinkwrap.json", "name": "@types/make-fetch-happen", "purl": "pkg:npm/%40types/make-fetch-happen@10.0.4", "version": "10.0.4" }, { "ecosystem": "npm", "licenses": [], "location": "npm-shrinkwrap.json", "name": "@types/node", "purl": "pkg:npm/%40types/node@18.19.130", "version": "18.19.130" }, { "ecosystem": "npm", "licenses": [], "location": "npm-shrinkwrap.json", "name": "@types/node", "purl": "pkg:npm/%40types/node@24.9.2", "version": "24.9.2" }, { "ecosystem": "npm", "licenses": [], "location": "npm-shrinkwrap.json", "name": "@types/node-fetch", "purl": "pkg:npm/%40types/node-fetch@2.6.13", "version": "2.6.13" }, { "ecosystem": "npm", "licenses": [], "location": "npm-shrinkwrap.json", "name": "@types/node-forge", "purl": "pkg:npm/%40types/node-forge@1.3.14", "version": "1.3.14" }, { "ecosystem": "npm", "licenses": [], "location": "npm-shrinkwrap.json", "name": "@types/npm-package-arg", "purl": "pkg:npm/%40types/npm-package-arg@6.1.4", "version": "6.1.4" }, { "ecosystem": "npm", "licenses": [], "location": "npm-shrinkwrap.json", "name": "@types/npm-registry-fetch", "purl": "pkg:npm/%40types/npm-registry-fetch@8.0.9", "version": "8.0.9" }, { "ecosystem": "npm", "licenses": [], "location": "npm-shrinkwrap.json", "name": "@types/npmlog", "purl": "pkg:npm/%40types/npmlog@7.0.0", "version": "7.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "npm-shrinkwrap.json", "name": "@types/retry", "purl": "pkg:npm/%40types/retry@0.12.5", "version": "0.12.5" }, { "ecosystem": "npm", "licenses": [], "location": "npm-shrinkwrap.json", "name": "@types/semver", "purl": "pkg:npm/%40types/semver@7.7.1", "version": "7.7.1" }, { "ecosystem": "npm", "licenses": [], "location": "npm-shrinkwrap.json", "name": "@types/ssri", "purl": "pkg:npm/%40types/ssri@7.1.5", "version": "7.1.5" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "@yao-pkg/pkg", "purl": "pkg:npm/%40yao-pkg/pkg@6.24.0", "version": "6.24.0" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "@yao-pkg/pkg-fetch", "purl": "pkg:npm/%40yao-pkg/pkg-fetch@3.6.7", "version": "3.6.7" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "agent-base", "purl": "pkg:npm/agent-base@7.1.3", "version": "7.1.3" }, { "ecosystem": "npm", "licenses": [ "AGPL-3.0-or-later" ], "location": "npm-shrinkwrap.json", "name": "aikido-safe-chain-workspace", "purl": "pkg:npm/aikido-safe-chain-workspace", "version": "UNKNOWN" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "ansi-regex", "purl": "pkg:npm/ansi-regex@5.0.1", "version": "5.0.1" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "ansi-styles", "purl": "pkg:npm/ansi-styles@4.3.0", "version": "4.3.0" }, { "ecosystem": "npm", "licenses": [], "location": "npm-shrinkwrap.json", "name": "asynckit", "purl": "pkg:npm/asynckit@0.4.0", "version": "0.4.0" }, { "ecosystem": "npm", "licenses": [ "Apache-2.0" ], "location": "npm-shrinkwrap.json", "name": "b4a", "purl": "pkg:npm/b4a@1.9.0", "version": "1.9.0" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "balanced-match", "purl": "pkg:npm/balanced-match@4.0.4", "version": "4.0.4" }, { "ecosystem": "npm", "licenses": [ "Apache-2.0" ], "location": "npm-shrinkwrap.json", "name": "bare-events", "purl": "pkg:npm/bare-events@2.9.2", "version": "2.9.2" }, { "ecosystem": "npm", "licenses": [ "Apache-2.0" ], "location": "npm-shrinkwrap.json", "name": "bare-fs", "purl": "pkg:npm/bare-fs@4.8.4", "version": "4.8.4" }, { "ecosystem": "npm", "licenses": [ "Apache-2.0" ], "location": "npm-shrinkwrap.json", "name": "bare-path", "purl": "pkg:npm/bare-path@3.1.2", "version": "3.1.2" }, { "ecosystem": "npm", "licenses": [ "Apache-2.0" ], "location": "npm-shrinkwrap.json", "name": "bare-stream", "purl": "pkg:npm/bare-stream@2.13.4", "version": "2.13.4" }, { "ecosystem": "npm", "licenses": [ "Apache-2.0" ], "location": "npm-shrinkwrap.json", "name": "bare-url", "purl": "pkg:npm/bare-url@2.5.5", "version": "2.5.5" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "base64-js", "purl": "pkg:npm/base64-js@1.5.1", "version": "1.5.1" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "bl", "purl": "pkg:npm/bl@4.1.0", "version": "4.1.0" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "bluebird", "purl": "pkg:npm/bluebird@3.7.2", "version": "3.7.2" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "brace-expansion", "purl": "pkg:npm/brace-expansion@5.0.12", "version": "5.0.12" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "buffer", "purl": "pkg:npm/buffer@5.7.1", "version": "5.7.1" }, { "ecosystem": "npm", "licenses": [ "ISC" ], "location": "npm-shrinkwrap.json", "name": "cacache", "purl": "pkg:npm/cacache@20.0.3", "version": "20.0.3" }, { "ecosystem": "npm", "licenses": [], "location": "npm-shrinkwrap.json", "name": "call-bind-apply-helpers", "purl": "pkg:npm/call-bind-apply-helpers@1.0.2", "version": "1.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "npm-shrinkwrap.json", "name": "chalk", "purl": "pkg:npm/chalk@5.4.1", "version": "5.4.1" }, { "ecosystem": "npm", "licenses": [ "ISC" ], "location": "npm-shrinkwrap.json", "name": "chownr", "purl": "pkg:npm/chownr@1.1.4", "version": "1.1.4" }, { "ecosystem": "npm", "licenses": [ "BlueOak-1.0.0" ], "location": "npm-shrinkwrap.json", "name": "chownr", "purl": "pkg:npm/chownr@3.0.0", "version": "3.0.0" }, { "ecosystem": "npm", "licenses": [ "ISC" ], "location": "npm-shrinkwrap.json", "name": "cliui", "purl": "pkg:npm/cliui@7.0.4", "version": "7.0.4" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "color-convert", "purl": "pkg:npm/color-convert@2.0.1", "version": "2.0.1" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "color-name", "purl": "pkg:npm/color-name@1.1.4", "version": "1.1.4" }, { "ecosystem": "npm", "licenses": [], "location": "npm-shrinkwrap.json", "name": "combined-stream", "purl": "pkg:npm/combined-stream@1.0.8", "version": "1.0.8" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "commander", "purl": "pkg:npm/commander@9.5.0", "version": "9.5.0" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "core-util-is", "purl": "pkg:npm/core-util-is@1.0.3", "version": "1.0.3" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "debug", "purl": "pkg:npm/debug@4.4.0", "version": "4.4.0" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "decompress-response", "purl": "pkg:npm/decompress-response@6.0.0", "version": "6.0.0" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "deep-extend", "purl": "pkg:npm/deep-extend@0.6.0", "version": "0.6.0" }, { "ecosystem": "npm", "licenses": [], "location": "npm-shrinkwrap.json", "name": "delayed-stream", "purl": "pkg:npm/delayed-stream@1.0.0", "version": "1.0.0" }, { "ecosystem": "npm", "licenses": [ "Apache-2.0" ], "location": "npm-shrinkwrap.json", "name": "detect-libc", "purl": "pkg:npm/detect-libc@2.1.2", "version": "2.1.2" }, { "ecosystem": "npm", "licenses": [], "location": "npm-shrinkwrap.json", "name": "dunder-proto", "purl": "pkg:npm/dunder-proto@1.0.1", "version": "1.0.1" }, { "ecosystem": "npm", "licenses": [ "BSD-3-Clause" ], "location": "npm-shrinkwrap.json", "name": "duplexer2", "purl": "pkg:npm/duplexer2@0.1.4", "version": "0.1.4" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "emoji-regex", "purl": "pkg:npm/emoji-regex@8.0.0", "version": "8.0.0" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "encoding", "purl": "pkg:npm/encoding@0.1.13", "version": "0.1.13" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "end-of-stream", "purl": "pkg:npm/end-of-stream@1.4.5", "version": "1.4.5" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "err-code", "purl": "pkg:npm/err-code@2.0.3", "version": "2.0.3" }, { "ecosystem": "npm", "licenses": [], "location": "npm-shrinkwrap.json", "name": "es-define-property", "purl": "pkg:npm/es-define-property@1.0.1", "version": "1.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "npm-shrinkwrap.json", "name": "es-errors", "purl": "pkg:npm/es-errors@1.3.0", "version": "1.3.0" }, { "ecosystem": "npm", "licenses": [], "location": "npm-shrinkwrap.json", "name": "es-object-atoms", "purl": "pkg:npm/es-object-atoms@1.1.1", "version": "1.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "npm-shrinkwrap.json", "name": "es-set-tostringtag", "purl": "pkg:npm/es-set-tostringtag@2.1.0", "version": "2.1.0" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "esbuild", "purl": "pkg:npm/esbuild@0.27.0", "version": "0.27.0" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "esbuild", "purl": "pkg:npm/esbuild@0.28.2", "version": "0.28.2" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "escalade", "purl": "pkg:npm/escalade@3.2.0", "version": "3.2.0" }, { "ecosystem": "npm", "licenses": [ "Apache-2.0" ], "location": "npm-shrinkwrap.json", "name": "events-universal", "purl": "pkg:npm/events-universal@1.0.1", "version": "1.0.1" }, { "ecosystem": "npm", "licenses": [ "MIT OR WTFPL" ], "location": "npm-shrinkwrap.json", "name": "expand-template", "purl": "pkg:npm/expand-template@2.0.3", "version": "2.0.3" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "fast-fifo", "purl": "pkg:npm/fast-fifo@1.3.2", "version": "1.3.2" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "fdir", "purl": "pkg:npm/fdir@6.5.0", "version": "6.5.0" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "form-data", "purl": "pkg:npm/form-data@4.0.6", "version": "4.0.6" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "fs-constants", "purl": "pkg:npm/fs-constants@1.0.0", "version": "1.0.0" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "fs-extra", "purl": "pkg:npm/fs-extra@11.3.2", "version": "11.3.2" }, { "ecosystem": "npm", "licenses": [ "ISC" ], "location": "npm-shrinkwrap.json", "name": "fs-minipass", "purl": "pkg:npm/fs-minipass@3.0.3", "version": "3.0.3" }, { "ecosystem": "npm", "licenses": [], "location": "npm-shrinkwrap.json", "name": "function-bind", "purl": "pkg:npm/function-bind@1.1.2", "version": "1.1.2" }, { "ecosystem": "npm", "licenses": [ "ISC" ], "location": "npm-shrinkwrap.json", "name": "get-caller-file", "purl": "pkg:npm/get-caller-file@2.0.5", "version": "2.0.5" }, { "ecosystem": "npm", "licenses": [], "location": "npm-shrinkwrap.json", "name": "get-intrinsic", "purl": "pkg:npm/get-intrinsic@1.3.0", "version": "1.3.0" }, { "ecosystem": "npm", "licenses": [], "location": "npm-shrinkwrap.json", "name": "get-proto", "purl": "pkg:npm/get-proto@1.0.1", "version": "1.0.1" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "github-from-package", "purl": "pkg:npm/github-from-package@0.0.0", "version": "0.0.0" }, { "ecosystem": "npm", "licenses": [ "BlueOak-1.0.0" ], "location": "npm-shrinkwrap.json", "name": "glob", "purl": "pkg:npm/glob@13.0.0", "version": "13.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "npm-shrinkwrap.json", "name": "gopd", "purl": "pkg:npm/gopd@1.2.0", "version": "1.2.0" }, { "ecosystem": "npm", "licenses": [ "ISC" ], "location": "npm-shrinkwrap.json", "name": "graceful-fs", "purl": "pkg:npm/graceful-fs@4.2.11", "version": "4.2.11" }, { "ecosystem": "npm", "licenses": [], "location": "npm-shrinkwrap.json", "name": "has-symbols", "purl": "pkg:npm/has-symbols@1.1.0", "version": "1.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "npm-shrinkwrap.json", "name": "has-tostringtag", "purl": "pkg:npm/has-tostringtag@1.0.2", "version": "1.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "npm-shrinkwrap.json", "name": "hasown", "purl": "pkg:npm/hasown@2.0.2", "version": "2.0.2" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "hasown", "purl": "pkg:npm/hasown@2.0.4", "version": "2.0.4" }, { "ecosystem": "npm", "licenses": [ "ISC" ], "location": "npm-shrinkwrap.json", "name": "hosted-git-info", "purl": "pkg:npm/hosted-git-info@9.0.2", "version": "9.0.2" }, { "ecosystem": "npm", "licenses": [ "BSD-2-Clause" ], "location": "npm-shrinkwrap.json", "name": "http-cache-semantics", "purl": "pkg:npm/http-cache-semantics@4.3.0", "version": "4.3.0" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "http-proxy-agent", "purl": "pkg:npm/http-proxy-agent@7.0.2", "version": "7.0.2" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "https-proxy-agent", "purl": "pkg:npm/https-proxy-agent@7.0.6", "version": "7.0.6" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "iconv-lite", "purl": "pkg:npm/iconv-lite@0.6.3", "version": "0.6.3" }, { "ecosystem": "npm", "licenses": [ "BSD-3-Clause" ], "location": "npm-shrinkwrap.json", "name": "ieee754", "purl": "pkg:npm/ieee754@1.2.1", "version": "1.2.1" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "imurmurhash", "purl": "pkg:npm/imurmurhash@0.1.4", "version": "0.1.4" }, { "ecosystem": "npm", "licenses": [ "ISC" ], "location": "npm-shrinkwrap.json", "name": "inherits", "purl": "pkg:npm/inherits@2.0.4", "version": "2.0.4" }, { "ecosystem": "npm", "licenses": [ "ISC" ], "location": "npm-shrinkwrap.json", "name": "ini", "purl": "pkg:npm/ini@1.3.8", "version": "1.3.8" }, { "ecosystem": "npm", "licenses": [ "ISC" ], "location": "npm-shrinkwrap.json", "name": "ini", "purl": "pkg:npm/ini@6.0.0", "version": "6.0.0" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "into-stream", "purl": "pkg:npm/into-stream@9.1.0", "version": "9.1.0" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "ip-address", "purl": "pkg:npm/ip-address@10.7.3", "version": "10.7.3" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "is-core-module", "purl": "pkg:npm/is-core-module@2.16.1", "version": "2.16.1" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "is-fullwidth-code-point", "purl": "pkg:npm/is-fullwidth-code-point@3.0.0", "version": "3.0.0" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "isarray", "purl": "pkg:npm/isarray@1.0.0", "version": "1.0.0" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "js-tokens", "purl": "pkg:npm/js-tokens@4.0.0", "version": "4.0.0" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "jsesc", "purl": "pkg:npm/jsesc@3.1.0", "version": "3.1.0" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "jsonfile", "purl": "pkg:npm/jsonfile@6.2.0", "version": "6.2.0" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "jsonparse", "purl": "pkg:npm/jsonparse@1.3.1", "version": "1.3.1" }, { "ecosystem": "npm", "licenses": [ "ISC" ], "location": "npm-shrinkwrap.json", "name": "lru-cache", "purl": "pkg:npm/lru-cache@11.2.2", "version": "11.2.2" }, { "ecosystem": "npm", "licenses": [ "ISC" ], "location": "npm-shrinkwrap.json", "name": "make-fetch-happen", "purl": "pkg:npm/make-fetch-happen@15.0.3", "version": "15.0.3" }, { "ecosystem": "npm", "licenses": [], "location": "npm-shrinkwrap.json", "name": "math-intrinsics", "purl": "pkg:npm/math-intrinsics@1.1.0", "version": "1.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "npm-shrinkwrap.json", "name": "mime-db", "purl": "pkg:npm/mime-db@1.52.0", "version": "1.52.0" }, { "ecosystem": "npm", "licenses": [], "location": "npm-shrinkwrap.json", "name": "mime-types", "purl": "pkg:npm/mime-types@2.1.35", "version": "2.1.35" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "mimic-response", "purl": "pkg:npm/mimic-response@3.1.0", "version": "3.1.0" }, { "ecosystem": "npm", "licenses": [ "BlueOak-1.0.0" ], "location": "npm-shrinkwrap.json", "name": "minimatch", "purl": "pkg:npm/minimatch@10.2.5", "version": "10.2.5" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "minimist", "purl": "pkg:npm/minimist@1.2.8", "version": "1.2.8" }, { "ecosystem": "npm", "licenses": [ "ISC" ], "location": "npm-shrinkwrap.json", "name": "minipass", "purl": "pkg:npm/minipass@3.3.6", "version": "3.3.6" }, { "ecosystem": "npm", "licenses": [ "ISC" ], "location": "npm-shrinkwrap.json", "name": "minipass", "purl": "pkg:npm/minipass@7.1.2", "version": "7.1.2" }, { "ecosystem": "npm", "licenses": [ "ISC" ], "location": "npm-shrinkwrap.json", "name": "minipass-collect", "purl": "pkg:npm/minipass-collect@2.0.1", "version": "2.0.1" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "minipass-fetch", "purl": "pkg:npm/minipass-fetch@5.0.0", "version": "5.0.0" }, { "ecosystem": "npm", "licenses": [ "ISC" ], "location": "npm-shrinkwrap.json", "name": "minipass-flush", "purl": "pkg:npm/minipass-flush@1.0.5", "version": "1.0.5" }, { "ecosystem": "npm", "licenses": [ "ISC" ], "location": "npm-shrinkwrap.json", "name": "minipass-pipeline", "purl": "pkg:npm/minipass-pipeline@1.2.4", "version": "1.2.4" }, { "ecosystem": "npm", "licenses": [ "ISC" ], "location": "npm-shrinkwrap.json", "name": "minipass-sized", "purl": "pkg:npm/minipass-sized@1.0.3", "version": "1.0.3" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "minizlib", "purl": "pkg:npm/minizlib@3.1.0", "version": "3.1.0" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "mkdirp-classic", "purl": "pkg:npm/mkdirp-classic@0.5.3", "version": "0.5.3" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "ms", "purl": "pkg:npm/ms@2.1.3", "version": "2.1.3" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "multistream", "purl": "pkg:npm/multistream@4.1.0", "version": "4.1.0" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "nan", "purl": "pkg:npm/nan@2.23.0", "version": "2.23.0" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "napi-build-utils", "purl": "pkg:npm/napi-build-utils@2.0.0", "version": "2.0.0" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "negotiator", "purl": "pkg:npm/negotiator@1.0.0", "version": "1.0.0" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "node-abi", "purl": "pkg:npm/node-abi@3.85.0", "version": "3.85.0" }, { "ecosystem": "npm", "licenses": [ "BSD-3-Clause OR GPL-2.0" ], "location": "npm-shrinkwrap.json", "name": "node-forge", "purl": "pkg:npm/node-forge@1.4.0", "version": "1.4.0" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "node-int64", "purl": "pkg:npm/node-int64@0.4.0", "version": "0.4.0" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "node-pty", "purl": "pkg:npm/node-pty@1.0.0", "version": "1.0.0" }, { "ecosystem": "npm", "licenses": [ "ISC" ], "location": "npm-shrinkwrap.json", "name": "npm-package-arg", "purl": "pkg:npm/npm-package-arg@13.0.2", "version": "13.0.2" }, { "ecosystem": "npm", "licenses": [ "ISC" ], "location": "npm-shrinkwrap.json", "name": "npm-registry-fetch", "purl": "pkg:npm/npm-registry-fetch@19.1.1", "version": "19.1.1" }, { "ecosystem": "npm", "licenses": [ "ISC" ], "location": "npm-shrinkwrap.json", "name": "once", "purl": "pkg:npm/once@1.4.0", "version": "1.4.0" }, { "ecosystem": "npm", "licenses": [], "location": "npm-shrinkwrap.json", "name": "oxlint", "purl": "pkg:npm/oxlint@1.22.0", "version": "1.22.0" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "p-map", "purl": "pkg:npm/p-map@7.0.4", "version": "7.0.4" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "path-parse", "purl": "pkg:npm/path-parse@1.0.7", "version": "1.0.7" }, { "ecosystem": "npm", "licenses": [ "BlueOak-1.0.0" ], "location": "npm-shrinkwrap.json", "name": "path-scurry", "purl": "pkg:npm/path-scurry@2.0.1", "version": "2.0.1" }, { "ecosystem": "npm", "licenses": [ "ISC" ], "location": "npm-shrinkwrap.json", "name": "picocolors", "purl": "pkg:npm/picocolors@1.1.1", "version": "1.1.1" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "picomatch", "purl": "pkg:npm/picomatch@4.0.7", "version": "4.0.7" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "postject", "purl": "pkg:npm/postject@1.0.0-alpha.6", "version": "1.0.0-alpha.6" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "prebuild-install", "purl": "pkg:npm/prebuild-install@7.1.3", "version": "7.1.3" }, { "ecosystem": "npm", "licenses": [ "ISC" ], "location": "npm-shrinkwrap.json", "name": "proc-log", "purl": "pkg:npm/proc-log@6.1.0", "version": "6.1.0" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "process-nextick-args", "purl": "pkg:npm/process-nextick-args@2.0.1", "version": "2.0.1" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "progress", "purl": "pkg:npm/progress@2.0.3", "version": "2.0.3" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "promise-retry", "purl": "pkg:npm/promise-retry@2.0.1", "version": "2.0.1" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "pump", "purl": "pkg:npm/pump@3.0.3", "version": "3.0.3" }, { "ecosystem": "npm", "licenses": [ "BSD-2-Clause OR MIT OR Apache-2.0" ], "location": "npm-shrinkwrap.json", "name": "rc", "purl": "pkg:npm/rc@1.2.8", "version": "1.2.8" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "readable-stream", "purl": "pkg:npm/readable-stream@2.3.8", "version": "2.3.8" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "readable-stream", "purl": "pkg:npm/readable-stream@3.6.2", "version": "3.6.2" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "require-directory", "purl": "pkg:npm/require-directory@2.1.1", "version": "2.1.1" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "resolve", "purl": "pkg:npm/resolve@1.22.11", "version": "1.22.11" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "resolve.exports", "purl": "pkg:npm/resolve.exports@2.0.4", "version": "2.0.4" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "retry", "purl": "pkg:npm/retry@0.12.0", "version": "0.12.0" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "safe-buffer", "purl": "pkg:npm/safe-buffer@5.1.2", "version": "5.1.2" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "safer-buffer", "purl": "pkg:npm/safer-buffer@2.1.2", "version": "2.1.2" }, { "ecosystem": "npm", "licenses": [ "ISC" ], "location": "npm-shrinkwrap.json", "name": "semver", "purl": "pkg:npm/semver@7.7.2", "version": "7.7.2" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "simple-concat", "purl": "pkg:npm/simple-concat@1.0.1", "version": "1.0.1" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "simple-get", "purl": "pkg:npm/simple-get@4.0.1", "version": "4.0.1" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "smart-buffer", "purl": "pkg:npm/smart-buffer@4.2.0", "version": "4.2.0" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "socks", "purl": "pkg:npm/socks@2.8.7", "version": "2.8.7" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "socks-proxy-agent", "purl": "pkg:npm/socks-proxy-agent@8.0.5", "version": "8.0.5" }, { "ecosystem": "npm", "licenses": [ "ISC" ], "location": "npm-shrinkwrap.json", "name": "ssri", "purl": "pkg:npm/ssri@13.0.0", "version": "13.0.0" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "stream-meter", "purl": "pkg:npm/stream-meter@1.0.4", "version": "1.0.4" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "streamx", "purl": "pkg:npm/streamx@2.28.1", "version": "2.28.1" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "string-width", "purl": "pkg:npm/string-width@4.2.3", "version": "4.2.3" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "string_decoder", "purl": "pkg:npm/string_decoder@1.1.1", "version": "1.1.1" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "strip-ansi", "purl": "pkg:npm/strip-ansi@6.0.1", "version": "6.0.1" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "strip-json-comments", "purl": "pkg:npm/strip-json-comments@2.0.1", "version": "2.0.1" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "supports-preserve-symlinks-flag", "purl": "pkg:npm/supports-preserve-symlinks-flag@1.0.0", "version": "1.0.0" }, { "ecosystem": "npm", "licenses": [ "BlueOak-1.0.0" ], "location": "npm-shrinkwrap.json", "name": "tar", "purl": "pkg:npm/tar@7.5.22", "version": "7.5.22" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "tar-fs", "purl": "pkg:npm/tar-fs@2.1.4", "version": "2.1.4" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "tar-fs", "purl": "pkg:npm/tar-fs@3.1.3", "version": "3.1.3" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "tar-stream", "purl": "pkg:npm/tar-stream@2.2.0", "version": "2.2.0" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "tar-stream", "purl": "pkg:npm/tar-stream@3.2.2", "version": "3.2.2" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "teex", "purl": "pkg:npm/teex@1.0.1", "version": "1.0.1" }, { "ecosystem": "npm", "licenses": [ "Apache-2.0" ], "location": "npm-shrinkwrap.json", "name": "text-decoder", "purl": "pkg:npm/text-decoder@1.2.7", "version": "1.2.7" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "tinyglobby", "purl": "pkg:npm/tinyglobby@0.2.15", "version": "0.2.15" }, { "ecosystem": "npm", "licenses": [ "Apache-2.0" ], "location": "npm-shrinkwrap.json", "name": "tunnel-agent", "purl": "pkg:npm/tunnel-agent@0.6.0", "version": "0.6.0" }, { "ecosystem": "npm", "licenses": [], "location": "npm-shrinkwrap.json", "name": "typescript", "purl": "pkg:npm/typescript@5.9.3", "version": "5.9.3" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "undici", "purl": "pkg:npm/undici@7.30.1", "version": "7.30.1" }, { "ecosystem": "npm", "licenses": [], "location": "npm-shrinkwrap.json", "name": "undici-types", "purl": "pkg:npm/undici-types@5.26.5", "version": "5.26.5" }, { "ecosystem": "npm", "licenses": [], "location": "npm-shrinkwrap.json", "name": "undici-types", "purl": "pkg:npm/undici-types@7.16.0", "version": "7.16.0" }, { "ecosystem": "npm", "licenses": [ "ISC" ], "location": "npm-shrinkwrap.json", "name": "unique-filename", "purl": "pkg:npm/unique-filename@5.0.0", "version": "5.0.0" }, { "ecosystem": "npm", "licenses": [ "ISC" ], "location": "npm-shrinkwrap.json", "name": "unique-slug", "purl": "pkg:npm/unique-slug@6.0.0", "version": "6.0.0" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "universalify", "purl": "pkg:npm/universalify@2.0.1", "version": "2.0.1" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "unzipper", "purl": "pkg:npm/unzipper@0.12.3", "version": "0.12.3" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "util-deprecate", "purl": "pkg:npm/util-deprecate@1.0.2", "version": "1.0.2" }, { "ecosystem": "npm", "licenses": [ "ISC" ], "location": "npm-shrinkwrap.json", "name": "validate-npm-package-name", "purl": "pkg:npm/validate-npm-package-name@7.0.0", "version": "7.0.0" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "wrap-ansi", "purl": "pkg:npm/wrap-ansi@7.0.0", "version": "7.0.0" }, { "ecosystem": "npm", "licenses": [ "ISC" ], "location": "npm-shrinkwrap.json", "name": "wrappy", "purl": "pkg:npm/wrappy@1.0.2", "version": "1.0.2" }, { "ecosystem": "npm", "licenses": [ "ISC" ], "location": "npm-shrinkwrap.json", "name": "y18n", "purl": "pkg:npm/y18n@5.0.8", "version": "5.0.8" }, { "ecosystem": "npm", "licenses": [ "ISC" ], "location": "npm-shrinkwrap.json", "name": "yallist", "purl": "pkg:npm/yallist@4.0.0", "version": "4.0.0" }, { "ecosystem": "npm", "licenses": [ "BlueOak-1.0.0" ], "location": "npm-shrinkwrap.json", "name": "yallist", "purl": "pkg:npm/yallist@5.0.0", "version": "5.0.0" }, { "ecosystem": "npm", "licenses": [ "ISC" ], "location": "npm-shrinkwrap.json", "name": "yaml", "purl": "pkg:npm/yaml@2.9.1", "version": "2.9.1" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "npm-shrinkwrap.json", "name": "yargs", "purl": "pkg:npm/yargs@16.2.2", "version": "16.2.2" }, { "ecosystem": "npm", "licenses": [ "ISC" ], "location": "npm-shrinkwrap.json", "name": "yargs-parser", "purl": "pkg:npm/yargs-parser@20.2.9", "version": "20.2.9" }, { "ecosystem": "unknown", "licenses": [], "location": ".github/workflows/build-and-release.yml", "name": "./.github/workflows/create-artifact.yml", "purl": "", "version": "UNKNOWN" } ], "description": "Block malicious packages during npm/pip install", "errors": [], "excluded_matches": { "action reference to a moving tag or branch": 1 }, "id": "AikidoSec__safe-chain", "manifests": [ ".github/workflows/build-and-release.yml", ".github/workflows/bump-endpoint.yml", ".github/workflows/create-artifact.yml", ".github/workflows/test-on-pr.yml", "npm-shrinkwrap.json", "package.json", "packages/safe-chain/package.json" ], "name": "safe-chain", "osv": { "advisories": 15, "available": true, "confirmed": 15, "osv_only": [], "warning": null }, "ref": "1.5.27", "ref_kind": "release", "release_integrity": { "asset": "safe-chain-linux-x64", "assets": 18, "build_provenance": null, "checksums_published": false, "digest_matches_github": true, "immutable_release": true, "methods": [ { "detail": "GitHub attests the file is unchanged since the release was published", "method": "github-immutable-release", "status": "verified" } ], "provenance_published": false, "sbom_published": false, "signature": null, "signatures_published": false, "signer": null, "verdict": "immutable" }, "released_at": "2026-10-30T08:13:34Z", "repository": "AikidoSec/safe-chain", "sbomlyze_diff": { "added": 235, "changed": 0, "drift": {}, "findings": [ "Attack surface: +274 packages (1522.2%)", "New ecosystem: npm (273 packages)", "0 version changes among 18 shared packages \u2014 no actual upgrades", "Core system packages stable: github (13) unchanged", "License shift: copyleft +4, permissive +218" ], "html": "sbomlyze-diff.html", "removed": 0 }, "scanned_at": "2026-11-02T03:06:22+00:00", "scorecard": { "checks": [ { "name": "CII-Best-Practices", "reason": "no effort to earn an OpenSSF best practices badge detected", "score": 0 }, { "name": "Dependency-Update-Tool", "reason": "no update tool detected", "score": 0 }, { "name": "Fuzzing", "reason": "project is not fuzzed", "score": 0 }, { "name": "SAST", "reason": "SAST tool is not run on all commits -- score normalized to 0", "score": 0 }, { "name": "Security-Policy", "reason": "security policy file not detected", "score": 0 }, { "name": "Signed-Releases", "reason": "Project has not signed or included provenance with any releases.", "score": 0 }, { "name": "Token-Permissions", "reason": "detected GitHub workflow tokens with excessive permissions", "score": 0 }, { "name": "Vulnerabilities", "reason": "15 existing vulnerabilities detected", "score": 0 }, { "name": "Pinned-Dependencies", "reason": "dependency not pinned by hash detected -- score normalized to 1", "score": 1 }, { "name": "Branch-Protection", "reason": "branch protection is not maximal on development and all release branches", "score": 6 }, { "name": "License", "reason": "license file detected", "score": 9 }, { "name": "Binary-Artifacts", "reason": "no binaries found in the repo", "score": 10 }, { "name": "CI-Tests", "reason": "14 out of 14 merged PRs checked by a CI test -- score normalized to 10", "score": 10 }, { "name": "Code-Review", "reason": "all changesets reviewed", "score": 10 }, { "name": "Contributors", "reason": "project has 9 contributing companies or organizations", "score": 10 }, { "name": "Dangerous-Workflow", "reason": "no dangerous workflow patterns detected", "score": 10 }, { "name": "Maintained", "reason": "30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10", "score": 10 }, { "name": "Packaging", "reason": "packaging workflow not detected", "score": -1 } ], "date": "2026-11-02", "score": 4.5, "source": "scorecard-cli", "version": "v5.6.0" }, "vulnerabilities": [ { "aliases": [ "CVE-2026-119190" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-119190", "percentile": 0.15892, "score": 0.00246 }, "fix_state": "fixed", "fixed_in": [ "1.4.1" ], "id": "GHSA-5x38-2vff-x55p", "kev": null, "location": "npm-shrinkwrap.json", "osv_confirmed": true, "package": "node-forge", "severity": "High", "summary": "Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13", "url": "https://github.com/advisories/GHSA-5x38-2vff-x55p", "version": "1.4.0" }, { "aliases": [ "CVE-2026-118779" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-118779", "percentile": 0.46398, "score": 0.00556 }, "fix_state": "fixed", "fixed_in": [ "1.4.1" ], "id": "GHSA-7wch-p9px-956x", "kev": null, "location": "npm-shrinkwrap.json", "osv_confirmed": true, "package": "node-forge", "severity": "High", "summary": "Forge: Regular expression denial of service in PEM decoding (pem.decode)", "url": "https://github.com/advisories/GHSA-7wch-p9px-956x", "version": "1.4.0" }, { "aliases": [ "CVE-2026-85393" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-85393", "percentile": 0.16151, "score": 0.00248 }, "fix_state": "not-fixed", "fixed_in": [], "id": "GHSA-86w9-cpqp-85rv", "kev": null, "location": "npm-shrinkwrap.json", "osv_confirmed": true, "package": "node-forge", "severity": "High", "summary": "node-forge RSA PKCS#1 v1.5 signature verification accepts extra nested DigestAlgorithm elements", "url": "https://github.com/advisories/GHSA-86w9-cpqp-85rv", "version": "1.4.0" }, { "aliases": [ "CVE-2026-119188" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-119188", "percentile": 0.35414, "score": 0.00411 }, "fix_state": "fixed", "fixed_in": [ "1.4.1" ], "id": "GHSA-8hrf-8g6f-7xwp", "kev": null, "location": "npm-shrinkwrap.json", "osv_confirmed": true, "package": "node-forge", "severity": "High", "summary": "Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message", "url": "https://github.com/advisories/GHSA-8hrf-8g6f-7xwp", "version": "1.4.0" }, { "aliases": [ "CVE-2026-119187" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-119187", "percentile": 0.35799, "score": 0.00415 }, "fix_state": "fixed", "fixed_in": [ "1.4.1" ], "id": "GHSA-hqq3-7jhf-c5jx", "kev": null, "location": "npm-shrinkwrap.json", "osv_confirmed": true, "package": "node-forge", "severity": "High", "summary": "Forge: Denial of service in TLS record processing via call stack exhaustion", "url": "https://github.com/advisories/GHSA-hqq3-7jhf-c5jx", "version": "1.4.0" }, { "aliases": [ "CVE-2026-118782" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-118782", "percentile": 0.02195, "score": 0.00125 }, "fix_state": "fixed", "fixed_in": [ "1.4.1" ], "id": "GHSA-jc66-7q78-782g", "kev": null, "location": "npm-shrinkwrap.json", "osv_confirmed": true, "package": "node-forge", "severity": "High", "summary": "Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count", "url": "https://github.com/advisories/GHSA-jc66-7q78-782g", "version": "1.4.0" }, { "aliases": [ "CVE-2026-118773" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-118773", "percentile": 0.28707, "score": 0.0035 }, "fix_state": "fixed", "fixed_in": [ "14.0.2" ], "id": "GHSA-3g3m-2fjr-6pw4", "kev": null, "location": "npm-shrinkwrap.json", "osv_confirmed": true, "package": "glob", "severity": "Medium", "summary": "Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal", "url": "https://github.com/advisories/GHSA-3g3m-2fjr-6pw4", "version": "13.0.0" }, { "aliases": [ "CVE-2026-111997" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-111997", "percentile": 0.24409, "score": 0.00315 }, "fix_state": "fixed", "fixed_in": [ "10.7.4" ], "id": "GHSA-rxp7-6hxx-x8q5", "kev": null, "location": "npm-shrinkwrap.json", "osv_confirmed": true, "package": "ip-address", "severity": "Medium", "summary": "ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process", "url": "https://github.com/advisories/GHSA-rxp7-6hxx-x8q5", "version": "10.7.3" }, { "aliases": [ "CVE-2026-118764" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-118764", "percentile": 0.21751, "score": 0.00291 }, "fix_state": "fixed", "fixed_in": [ "11.0.1" ], "id": "GHSA-g3hv-75wg-m249", "kev": null, "location": "npm-shrinkwrap.json", "osv_confirmed": true, "package": "minimatch", "severity": "Medium", "summary": "minimatch has potential denial of service via globparts amplification", "url": "https://github.com/advisories/GHSA-g3hv-75wg-m249", "version": "10.2.5" }, { "aliases": [ "CVE-2026-118778" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-118778", "percentile": 0.10363, "score": 0.00204 }, "fix_state": "fixed", "fixed_in": [ "1.4.1" ], "id": "GHSA-525v-9gp9-w22h", "kev": null, "location": "npm-shrinkwrap.json", "osv_confirmed": true, "package": "node-forge", "severity": "Medium", "summary": "Forge: TLS client crash when the server sends no certificate", "url": "https://github.com/advisories/GHSA-525v-9gp9-w22h", "version": "1.4.0" }, { "aliases": [ "CVE-2026-119186" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-119186", "percentile": 0.1069, "score": 0.00206 }, "fix_state": "fixed", "fixed_in": [ "1.4.1" ], "id": "GHSA-5cwg-6vw7-rj6p", "kev": null, "location": "npm-shrinkwrap.json", "osv_confirmed": true, "package": "node-forge", "severity": "Medium", "summary": "Forge: AES-GCM authentication bypass via unvalidated tagLength option", "url": "https://github.com/advisories/GHSA-5cwg-6vw7-rj6p", "version": "1.4.0" }, { "aliases": [ "CVE-2026-118777" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-118777", "percentile": 0.17154, "score": 0.00255 }, "fix_state": "fixed", "fixed_in": [ "1.4.1" ], "id": "GHSA-6wvx-3r32-xmcg", "kev": null, "location": "npm-shrinkwrap.json", "osv_confirmed": true, "package": "node-forge", "severity": "Medium", "summary": "Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie", "url": "https://github.com/advisories/GHSA-6wvx-3r32-xmcg", "version": "1.4.0" }, { "aliases": [ "CVE-2026-118780" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-118780", "percentile": 0.06585, "score": 0.00172 }, "fix_state": "fixed", "fixed_in": [ "1.4.1" ], "id": "GHSA-4487-j8r4-4g2f", "kev": null, "location": "npm-shrinkwrap.json", "osv_confirmed": true, "package": "node-forge", "severity": "Low", "summary": "Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store", "url": "https://github.com/advisories/GHSA-4487-j8r4-4g2f", "version": "1.4.0" }, { "aliases": [ "CVE-2026-118775" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-118775", "percentile": 0.24273, "score": 0.00313 }, "fix_state": "fixed", "fixed_in": [ "1.4.1" ], "id": "GHSA-4642-5mcj-2rqw", "kev": null, "location": "npm-shrinkwrap.json", "osv_confirmed": true, "package": "node-forge", "severity": "Low", "summary": "Forge: ASN.1 OID first arc truncation in asn1.oidToDer", "url": "https://github.com/advisories/GHSA-4642-5mcj-2rqw", "version": "1.4.0" }, { "aliases": [ "CVE-2026-118781" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-118781", "percentile": 0.01734, "score": 0.00119 }, "fix_state": "fixed", "fixed_in": [ "1.4.1" ], "id": "GHSA-h6cr-wjv9-3cpp", "kev": null, "location": "npm-shrinkwrap.json", "osv_confirmed": true, "package": "node-forge", "severity": "Low", "summary": "Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891)", "url": "https://github.com/advisories/GHSA-h6cr-wjv9-3cpp", "version": "1.4.0" } ], "workflow_audit": { "files": 4, "findings": [ { "confidence": "High", "description": "code injection via template expansion", "file": ".github/workflows/build-and-release.yml", "line": 21, "note": "this step", "rule": "template-injection", "severity": "High", "url": "https://docs.zizmor.sh/audits/#template-injection" }, { "confidence": "High", "description": "unpinned action reference", "file": ".github/workflows/build-and-release.yml", "line": 46, "note": "this step", "rule": "unpinned-uses", "severity": "High", "url": "https://docs.zizmor.sh/audits/#unpinned-uses" }, { "confidence": "High", "description": "unpinned action reference", "file": ".github/workflows/build-and-release.yml", "line": 49, "note": "this step", "rule": "unpinned-uses", "severity": "High", "url": "https://docs.zizmor.sh/audits/#unpinned-uses" }, { "confidence": "High", "description": "unpinned action reference", "file": ".github/workflows/build-and-release.yml", "line": 185, "note": "this step", "rule": "unpinned-uses", "severity": "High", "url": "https://docs.zizmor.sh/audits/#unpinned-uses" }, { "confidence": "High", "description": "unpinned action reference", "file": ".github/workflows/build-and-release.yml", "line": 188, "note": "this step", "rule": "unpinned-uses", "severity": "High", "url": "https://docs.zizmor.sh/audits/#unpinned-uses" }, { "confidence": "High", "description": "code injection via template expansion", "file": ".github/workflows/build-and-release.yml", "line": 201, "note": "this step", "rule": "template-injection", "severity": "High", "url": "https://docs.zizmor.sh/audits/#template-injection" }, { "confidence": "High", "description": "code injection via template expansion", "file": ".github/workflows/build-and-release.yml", "line": 219, "note": "this step", "rule": "template-injection", "severity": "High", "url": "https://docs.zizmor.sh/audits/#template-injection" }, { "confidence": "High", "description": "unpinned action reference", "file": ".github/workflows/bump-endpoint.yml", "line": 16, "note": "this step", "rule": "unpinned-uses", "severity": "High", "url": "https://docs.zizmor.sh/audits/#unpinned-uses" }, { "confidence": "High", "description": "unpinned action reference", "file": ".github/workflows/create-artifact.yml", "line": 75, "note": "this step", "rule": "unpinned-uses", "severity": "High", "url": "https://docs.zizmor.sh/audits/#unpinned-uses" }, { "confidence": "High", "description": "unpinned action reference", "file": ".github/workflows/create-artifact.yml", "line": 78, "note": "this step", "rule": "unpinned-uses", "severity": "High", "url": "https://docs.zizmor.sh/audits/#unpinned-uses" }, { "confidence": "High", "description": "unpinned action reference", "file": ".github/workflows/create-artifact.yml", "line": 101, "note": "this step", "rule": "unpinned-uses", "severity": "High", "url": "https://docs.zizmor.sh/audits/#unpinned-uses" }, { "confidence": "High", "description": "unpinned action reference", "file": ".github/workflows/create-artifact.yml", "line": 124, "note": "this step", "rule": "unpinned-uses", "severity": "High", "url": "https://docs.zizmor.sh/audits/#unpinned-uses" }, { "confidence": "High", "description": "unpinned action reference", "file": ".github/workflows/create-artifact.yml", "line": 146, "note": "this step", "rule": "unpinned-uses", "severity": "High", "url": "https://docs.zizmor.sh/audits/#unpinned-uses" }, { "confidence": "High", "description": "unpinned action reference", "file": ".github/workflows/test-on-pr.yml", "line": 17, "note": "this step", "rule": "unpinned-uses", "severity": "High", "url": "https://docs.zizmor.sh/audits/#unpinned-uses" }, { "confidence": "High", "description": "unpinned action reference", "file": ".github/workflows/test-on-pr.yml", "line": 20, "note": "this step", "rule": "unpinned-uses", "severity": "High", "url": "https://docs.zizmor.sh/audits/#unpinned-uses" }, { "confidence": "High", "description": "unpinned action reference", "file": ".github/workflows/test-on-pr.yml", "line": 45, "note": "this step", "rule": "unpinned-uses", "severity": "High", "url": "https://docs.zizmor.sh/audits/#unpinned-uses" }, { "confidence": "High", "description": "unpinned action reference", "file": ".github/workflows/test-on-pr.yml", "line": 98, "note": "this step", "rule": "unpinned-uses", "severity": "High", "url": "https://docs.zizmor.sh/audits/#unpinned-uses" }, { "confidence": "High", "description": "unpinned action reference", "file": ".github/workflows/test-on-pr.yml", "line": 101, "note": "this step", "rule": "unpinned-uses", "severity": "High", "url": "https://docs.zizmor.sh/audits/#unpinned-uses" }, { "confidence": "High", "description": "secrets unconditionally inherited by called workflow", "file": ".github/workflows/build-and-release.yml", "line": 32, "note": "this reusable workflow", "rule": "secrets-inherit", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#secrets-inherit" }, { "confidence": "Medium", "description": "overly broad permissions", "file": ".github/workflows/create-artifact.yml", "line": 1, "note": "default permissions used due to no permissions: block", "rule": "excessive-permissions", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#excessive-permissions" }, { "confidence": "Medium", "description": "overly broad permissions", "file": ".github/workflows/create-artifact.yml", "line": 24, "note": "this job", "rule": "excessive-permissions", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#excessive-permissions" }, { "confidence": "Medium", "description": "overly broad permissions", "file": ".github/workflows/create-artifact.yml", "line": 109, "note": "this job", "rule": "excessive-permissions", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#excessive-permissions" }, { "confidence": "Medium", "description": "overly broad permissions", "file": ".github/workflows/test-on-pr.yml", "line": 1, "note": "default permissions used due to no permissions: block", "rule": "excessive-permissions", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#excessive-permissions" }, { "confidence": "Medium", "description": "overly broad permissions", "file": ".github/workflows/test-on-pr.yml", "line": 6, "note": "this job", "rule": "excessive-permissions", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#excessive-permissions" }, { "confidence": "Medium", "description": "overly broad permissions", "file": ".github/workflows/test-on-pr.yml", "line": 52, "note": "this job", "rule": "excessive-permissions", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#excessive-permissions" }, { "confidence": "High", "description": "use GitHub's dedicated self-repository syntax", "file": ".github/workflows/build-and-release.yml", "line": 27, "note": "this job", "rule": "self-repository", "severity": "Low", "url": "https://docs.zizmor.sh/audits/#self-repository" }, { "confidence": "High", "description": "ad-hoc installation of packages", "file": ".github/workflows/build-and-release.yml", "line": 194, "note": "this step", "rule": "adhoc-packages", "severity": "Low", "url": "https://docs.zizmor.sh/audits/#adhoc-packages" } ] } }, "updated": "2026-11-02" }