{ "history": [ { "added": 0, "commit": "ea584f4502babc6f60d9bc799dbbb13c1caa9ee6", "date": "2026-11-01", "dependencies": 163, "errors": [], "fixable": 87, "go_version": "go1.23.5", "in_binary": { "dependencies": 27, "stdlib": 52, "total": 79 }, "new_vulnerabilities": 0, "osv_confirmed": 93, "osv_only": 100, "ref": "v2.7.1", "release_changed": false, "release_integrity": "verified", "removed": 0, "resolved_vulnerabilities": 0, "scorecard": null, "upgraded": 0, "vulnerabilities": { "Critical": 9, "High": 34, "Low": 6, "Medium": 40, "Negligible": 0, "Unknown": 4 }, "workflow": { "High": 2, "Low": 5, "Medium": 3, "files": 15 } }, { "added": 1035, "commit": "ea584f4502babc6f60d9bc799dbbb13c1caa9ee6", "date": "2026-11-02", "dependencies": 1198, "errors": [], "fixable": 243, "go_version": "go1.23.5", "in_binary": { "dependencies": 26, "stdlib": 53, "total": 79 }, "kev": 0, "kev_new": 0, "new_vulnerabilities": 132, "osv_confirmed": 253, "osv_only": 3, "ref": "v2.7.1", "release_changed": false, "release_integrity": "verified", "removed": 0, "resolved_vulnerabilities": 0, "scorecard": null, "scorecard_date": null, "scorecard_note": "the OpenSSF public dataset entry is 66 days old (limit 30); the Scorecard CLI fallback was skipped because this shard's weekly budget was used", "scorecard_source": null, "upgraded": 0, "vulnerabilities": { "Critical": 19, "High": 116, "Low": 16, "Medium": 98, "Negligible": 0, "Unknown": 4 }, "vulnerable_packages": 70, "workflow": { "High": 2, "Low": 5, "Medium": 3, "files": 15 } } ], "latest": { "archived": false, "category": "Supply Chain Compliance", "changes": { "added": [ "@aashutoshrathi/word-wrap@1.2.6", "@arcanis/slice-ansi@1.1.1", "@aws-crypto/crc32@3.0.0", "@aws-crypto/crc32c@3.0.0", "@aws-crypto/ie11-detection@3.0.0", "@aws-crypto/sha1-browser@3.0.0", "@aws-crypto/sha256-browser@3.0.0", "@aws-crypto/sha256-js@3.0.0", "@aws-crypto/supports-web-crypto@3.0.0", "@aws-crypto/util@3.0.0", "@aws-sdk/client-codecommit@3.565.0", "@aws-sdk/client-cognito-identity@3.565.0", "@aws-sdk/client-ec2@3.565.0", "@aws-sdk/client-ecr@3.565.0", "@aws-sdk/client-rds@3.565.0", "@aws-sdk/client-s3@3.565.0", "@aws-sdk/client-sso@3.556.0", "@aws-sdk/client-sso@3.575.0", "@aws-sdk/client-sso@3.576.0", "@aws-sdk/client-sso-oidc@3.575.0", "@aws-sdk/client-sso-oidc@3.576.0", "@aws-sdk/client-sts@3.565.0", "@aws-sdk/client-sts@3.575.0", "@aws-sdk/client-sts@3.576.0", "@aws-sdk/core@3.556.0", "@aws-sdk/core@3.575.0", "@aws-sdk/core@3.576.0", "@aws-sdk/credential-provider-cognito-identity@3.565.0", "@aws-sdk/credential-provider-env@3.535.0", "@aws-sdk/credential-provider-env@3.575.0", "@aws-sdk/credential-provider-http@3.552.0", "@aws-sdk/credential-provider-http@3.575.0", "@aws-sdk/credential-provider-ini@3.565.0", "@aws-sdk/credential-provider-ini@3.575.0", "@aws-sdk/credential-provider-ini@3.576.0", "@aws-sdk/credential-provider-node@3.565.0", "@aws-sdk/credential-provider-node@3.575.0", "@aws-sdk/credential-provider-node@3.576.0", "@aws-sdk/credential-provider-process@3.535.0", "@aws-sdk/credential-provider-process@3.575.0", "@aws-sdk/credential-provider-sso@3.565.0", "@aws-sdk/credential-provider-sso@3.575.0", "@aws-sdk/credential-provider-sso@3.576.0", "@aws-sdk/credential-provider-web-identity@3.565.0", "@aws-sdk/credential-provider-web-identity@3.575.0", "@aws-sdk/credential-providers@3.565.0", "@aws-sdk/middleware-bucket-endpoint@3.535.0", "@aws-sdk/middleware-expect-continue@3.535.0", "@aws-sdk/middleware-flexible-checksums@3.535.0", "@aws-sdk/middleware-host-header@3.535.0", "@aws-sdk/middleware-host-header@3.575.0", "@aws-sdk/middleware-location-constraint@3.535.0", "@aws-sdk/middleware-logger@3.535.0", "@aws-sdk/middleware-logger@3.575.0", "@aws-sdk/middleware-recursion-detection@3.535.0", "@aws-sdk/middleware-recursion-detection@3.575.0", "@aws-sdk/middleware-sdk-ec2@3.556.0", "@aws-sdk/middleware-sdk-rds@3.556.0", "@aws-sdk/middleware-sdk-s3@3.556.0", "@aws-sdk/middleware-signing@3.556.0", "@aws-sdk/middleware-ssec@3.537.0", "@aws-sdk/middleware-user-agent@3.540.0", "@aws-sdk/middleware-user-agent@3.575.0", "@aws-sdk/region-config-resolver@3.535.0", "@aws-sdk/region-config-resolver@3.575.0", "@aws-sdk/signature-v4-multi-region@3.556.0", "@aws-sdk/token-providers@3.565.0", "@aws-sdk/token-providers@3.575.0", "@aws-sdk/types@3.535.0", "@aws-sdk/types@3.575.0", "@aws-sdk/util-arn-parser@3.535.0", "@aws-sdk/util-endpoints@3.540.0", "@aws-sdk/util-endpoints@3.575.0", "@aws-sdk/util-format-url@3.535.0", "@aws-sdk/util-locate-window@3.568.0", "@aws-sdk/util-user-agent-browser@3.535.0", "@aws-sdk/util-user-agent-browser@3.575.0", "@aws-sdk/util-user-agent-node@3.535.0", "@aws-sdk/util-user-agent-node@3.575.0", "@aws-sdk/util-utf8-browser@3.259.0", "@aws-sdk/xml-builder@3.535.0", "@babel/code-frame@7.24.2", "@babel/helper-validator-identifier@7.24.5", "@babel/highlight@7.24.5", "@babel/runtime@7.21.0", "@babel/runtime-corejs3@7.24.5", "@breejs/later@4.2.0", "@cdktf/hcl2json@0.20.7", "@eslint-community/eslint-utils@4.4.0", "@eslint-community/regexpp@4.10.0", "@eslint/eslintrc@2.1.4", "@eslint/js@8.57.0", "@github/browserslist-config@1.0.0", "@gwhitney/detect-indent@7.0.1", "@humanwhocodes/config-array@0.11.14", "@humanwhocodes/module-importer@1.0.1", "@humanwhocodes/object-schema@2.0.3", "@isaacs/cliui@8.0.2", "@kwsites/file-exists@1.1.1", "@kwsites/promise-deferred@1.1.1", "@nodelib/fs.scandir@2.1.5", "@nodelib/fs.stat@2.0.5", "@nodelib/fs.walk@1.2.8", "@npmcli/agent@2.2.2", "@npmcli/fs@3.1.1", "@octokit/core@5.2.0", "@octokit/graphql@7.1.0", "@octokit/plugin-paginate-rest@11.4.4-cjs.2", "@octokit/plugin-request-log@4.0.1", "@octokit/plugin-rest-endpoint-methods@13.3.2-cjs.1", "@octokit/rest@20.1.2", "@one-ini/wasm@0.1.1", "@opentelemetry/api@1.8.0", "@opentelemetry/api-logs@0.51.1", "@opentelemetry/context-async-hooks@1.24.1", "@opentelemetry/core@1.24.1", "@opentelemetry/exporter-trace-otlp-http@0.51.1", "@opentelemetry/instrumentation@0.51.1", "@opentelemetry/instrumentation-bunyan@0.38.0", "@opentelemetry/instrumentation-http@0.51.1", "@opentelemetry/otlp-exporter-base@0.51.1", "@opentelemetry/otlp-transformer@0.51.1", "@opentelemetry/propagator-b3@1.24.1", "@opentelemetry/propagator-jaeger@1.24.1", "@opentelemetry/resources@1.24.1", "@opentelemetry/sdk-logs@0.51.1", "@opentelemetry/sdk-metrics@1.24.1", "@opentelemetry/sdk-trace-base@1.24.1", "@opentelemetry/sdk-trace-node@1.24.1", "@opentelemetry/semantic-conventions@1.24.1", "@pkgjs/parseargs@0.11.0", "@pkgr/core@0.1.1", "@pnpm/constants@6.1.0", "@pnpm/error@4.0.0", "@pnpm/graceful-fs@2.0.0", "@pnpm/read-project-manifest@4.1.1", "@pnpm/text.comments-parser@1.0.0", "@pnpm/types@8.9.0", "@pnpm/util.lex-comparator@1.0.0", "@pnpm/write-project-manifest@4.1.1", "@qnighy/marshal@0.1.3", "@redis/bloom@1.2.0", "@redis/client@1.5.14", "@redis/graph@1.1.1", "@redis/json@1.0.6", "@redis/search@1.1.6", "@redis/time-series@1.0.5", "@renovatebot/kbpgp@3.0.1", "@renovatebot/osv-offline@1.5.5", "@renovatebot/osv-offline-db@1.6.0", "@renovatebot/pep440@3.0.20", "@renovatebot/ruby-semver@3.0.23", "@seald-io/binary-search-tree@1.0.3", "@seald-io/nedb@4.0.4", "@sindresorhus/is@4.6.0", "@smithy/abort-controller@2.2.0", "@smithy/abort-controller@3.0.0", "@smithy/chunked-blob-reader@2.2.0", "@smithy/chunked-blob-reader-native@2.2.0", "@smithy/config-resolver@2.2.0", "@smithy/config-resolver@3.0.0", "@smithy/core@1.4.2", "@smithy/core@2.0.1", "@smithy/credential-provider-imds@2.3.0", "@smithy/credential-provider-imds@3.0.0", "@smithy/eventstream-codec@2.2.0", "@smithy/eventstream-serde-browser@2.2.0", "@smithy/eventstream-serde-config-resolver@2.2.0", "@smithy/eventstream-serde-node@2.2.0", "@smithy/eventstream-serde-universal@2.2.0", "@smithy/fetch-http-handler@2.5.0", "@smithy/fetch-http-handler@3.0.1", "@smithy/hash-blob-browser@2.2.0", "@smithy/hash-node@2.2.0", "@smithy/hash-node@3.0.0", "@smithy/hash-stream-node@2.2.0", "@smithy/invalid-dependency@2.2.0", "@smithy/invalid-dependency@3.0.0", "@smithy/is-array-buffer@2.2.0", "@smithy/is-array-buffer@3.0.0", "@smithy/md5-js@2.2.0", "@smithy/middleware-content-length@2.2.0", "@smithy/middleware-content-length@3.0.0", "@smithy/middleware-endpoint@2.5.1", "@smithy/middleware-endpoint@3.0.0", "@smithy/middleware-retry@2.3.1", "@smithy/middleware-retry@3.0.1", "@smithy/middleware-serde@2.3.0", "@smithy/middleware-serde@3.0.0", "@smithy/middleware-stack@2.2.0", "@smithy/middleware-stack@3.0.0", "@smithy/node-config-provider@2.3.0", "@smithy/node-config-provider@3.0.0", "@smithy/node-http-handler@2.5.0", "@smithy/node-http-handler@3.0.0", "@smithy/property-provider@2.2.0", "@smithy/property-provider@3.0.0", "@smithy/protocol-http@3.3.0", "@smithy/protocol-http@4.0.0", "@smithy/querystring-builder@2.2.0", "@smithy/querystring-builder@3.0.0", "@smithy/querystring-parser@2.2.0", "@smithy/querystring-parser@3.0.0", "@smithy/service-error-classification@2.1.5", "@smithy/service-error-classification@3.0.0", "@smithy/shared-ini-file-loader@2.4.0", "@smithy/shared-ini-file-loader@3.0.0", "@smithy/signature-v4@2.3.0", "@smithy/signature-v4@3.0.0", "@smithy/smithy-client@2.5.1", "@smithy/smithy-client@3.0.1", "@smithy/types@2.12.0", "@smithy/types@3.0.0", "@smithy/url-parser@2.2.0", "@smithy/url-parser@3.0.0", "@smithy/util-base64@2.3.0", "@smithy/util-base64@3.0.0", "@smithy/util-body-length-browser@2.2.0", "@smithy/util-body-length-browser@3.0.0", "@smithy/util-body-length-node@2.3.0", "@smithy/util-body-length-node@3.0.0", "@smithy/util-buffer-from@2.2.0", "@smithy/util-buffer-from@3.0.0", "@smithy/util-config-provider@2.3.0", "@smithy/util-config-provider@3.0.0", "@smithy/util-defaults-mode-browser@2.2.1", "@smithy/util-defaults-mode-browser@3.0.1", "@smithy/util-defaults-mode-node@2.3.1", "@smithy/util-defaults-mode-node@3.0.1", "@smithy/util-endpoints@1.2.0", "@smithy/util-endpoints@2.0.0", "@smithy/util-hex-encoding@2.2.0", "@smithy/util-hex-encoding@3.0.0", "@smithy/util-middleware@2.2.0", "@smithy/util-middleware@3.0.0", "@smithy/util-retry@2.2.0", "@smithy/util-retry@3.0.0", "@smithy/util-stream@2.2.0", "@smithy/util-stream@3.0.1", "@smithy/util-uri-escape@2.2.0", "@smithy/util-uri-escape@3.0.0", "@smithy/util-utf8@2.3.0", "@smithy/util-utf8@3.0.0", "@smithy/util-waiter@2.2.0", "@szmarczak/http-timer@4.0.6", "@thi.ng/api@7.2.0", "@thi.ng/arrays@1.0.3", "@thi.ng/checks@2.9.11", "@thi.ng/compare@1.3.34", "@thi.ng/equiv@1.0.45", "@thi.ng/errors@1.3.4", "@thi.ng/hex@1.0.4", "@thi.ng/random@2.4.8", "@thi.ng/zipper@1.0.3", "@types/bunyan@1.8.9", "@types/cacheable-request@6.0.3", "@types/emscripten@1.39.12", "@types/http-cache-semantics@4.0.4", "@types/jasmine@4.6.4", "@types/json-schema@7.0.15", "@types/json5@0.0.29", "@types/keyv@3.1.4", "@types/mdast@3.0.15", "@types/minimist@1.2.5", "@types/moo@0.5.5", "@types/node@18.19.33", "@types/node@20.12.12", "@types/normalize-package-data@2.4.4", "@types/responselike@1.0.3", "@types/semver@7.5.8", "@types/shimmer@1.0.5", "@types/treeify@1.0.3", "@types/unist@2.0.10", "@types/yauzl@2.10.3", "@typescript-eslint/eslint-plugin@7.5.0", "@typescript-eslint/parser@7.5.0", "@typescript-eslint/scope-manager@7.5.0", "@typescript-eslint/type-utils@7.5.0", "@typescript-eslint/types@7.5.0", "@typescript-eslint/typescript-estree@7.5.0", "@typescript-eslint/utils@7.5.0", "@typescript-eslint/visitor-keys@7.5.0", "@ungap/structured-clone@1.2.0", "@vercel/ncc@0.38.1", "@yarnpkg/core@4.0.5", "@yarnpkg/fslib@3.1.0", "@yarnpkg/libzip@3.1.0", "@yarnpkg/parsers@3.0.2", "@yarnpkg/shell@4.0.2", "abbrev@2.0.0", "acorn@8.11.3", "acorn-import-attributes@1.9.5", "acorn-jsx@5.3.2", "adm-zip@0.5.12", "agent-base@7.1.1", "agentkeepalive@4.5.0", "aggregate-error@3.1.0", "ajv@6.12.6", "ansi-red@0.1.1", "ansi-regex@5.0.1", "ansi-regex@6.0.1", "ansi-styles@3.2.1", "ansi-styles@4.3.0", "ansi-styles@6.2.1", "ansi-wrap@0.1.0", "argparse@1.0.10", "argparse@2.0.1", "aria-query@5.3.0", "array-buffer-byte-length@1.0.1", "array-includes@3.1.6", "array-union@2.1.0", "array.prototype.flat@1.3.0", "array.prototype.flatmap@1.3.1", "arraybuffer.prototype.slice@1.0.3", "arrify@1.0.1", "asn1.js@5.4.1", "ast-types-flow@0.0.7", "auth-header@1.0.0", "autolinker@4.0.0", "available-typed-arrays@1.0.5", "available-typed-arrays@1.0.7", "aws4@1.12.0", "axe-core@4.6.3", "axobject-query@3.1.1", "azure-devops-node-api@13.0.0", "backslash@0.2.0", "bail@1.0.5", "balanced-match@1.0.2", "base64-js@1.5.1", "better-sqlite3@9.6.0", "bignumber.js@9.1.2", "bindings@1.5.0", "bl@4.1.0", "bn@1.0.5", "bn.js@4.12.0", "boolbase@1.0.0", "boolean@3.2.0", "bowser@2.11.0", "brace-expansion@1.1.11", "brace-expansion@2.0.1", "braces@3.0.3", "browserslist@4.21.3", "buffer@5.7.1", "buffer-crc32@0.2.13", "buffer-equal-constant-time@1.0.1", "buffer-from@1.1.2", "bunyan@1.8.15", "bzip-deflate@1.0.0", "cacache@18.0.3", "cacheable-lookup@5.0.4", "cacheable-request@7.0.4", "call-bind@1.0.2", "call-bind@1.0.7", "callsites@3.1.0", "camelcase@5.3.1", "camelcase-keys@6.2.2", "caniuse-lite@1.0.30001387", "chalk@2.4.2", "chalk@3.0.0", "chalk@4.1.2", "changelog-filename-regex@2.0.1", "character-entities@1.2.4", "character-entities-legacy@1.1.4", "character-reference-invalid@1.1.4", "chownr@1.1.4", "chownr@2.0.0", "ci-info@3.9.0", "cjs-module-lexer@1.3.1", "clean-git-ref@2.0.1", "clean-stack@2.2.0", "clipanion@4.0.0-rc.3", "clone-response@1.0.3", "cluster-key-slot@1.1.2", "coffee-script@1.12.7", "color-convert@1.9.3", "color-convert@2.0.1", "color-name@1.1.3", "color-name@1.1.4", "commander@11.1.0", "commander@12.0.0", "concat-map@0.0.1", "concat-stream@1.6.2", "conventional-commits-detector@1.0.3", "core-js-pure@3.37.1", "core-util-is@1.0.3", "cron-parser@4.9.0", "cross-spawn@7.0.3", "css-select@5.1.0", "css-what@6.1.0", "damerau-levenshtein@1.0.8", "dargs@7.0.0", "data-view-buffer@1.0.1", "data-view-byte-length@1.0.1", "data-view-byte-offset@1.0.0", "debug@2.6.9", "debug@3.2.7", "debug@4.3.4", "decamelize@1.2.0", "decamelize-keys@1.1.1", "decompress-response@6.0.0", "deep-equal@2.2.0", "deep-equal@2.2.3", "deep-extend@0.6.0", "deep-is@0.1.4", "deepmerge@4.3.1", "defer-to-connect@2.0.1", "define-data-property@1.1.4", "define-properties@1.1.4", "define-properties@1.2.1", "dequal@2.0.3", "detect-indent@6.1.0", "detect-libc@2.0.3", "detect-node@2.1.0", "diacritics-map@0.1.0", "diff@5.2.0", "dir-glob@3.0.1", "doctrine@2.1.0", "doctrine@3.0.0", "dom-serializer@2.0.0", "domelementtype@2.3.0", "domhandler@5.0.3", "domutils@3.1.0", "dotenv@16.4.5", "dtrace-provider@0.8.8", "eastasianwidth@0.2.0", "ecdsa-sig-formatter@1.0.11", "editorconfig@2.0.0", "electron-to-chromium@1.4.238", "email-addresses@5.0.0", "emoji-regex@10.3.0", "emoji-regex@8.0.0", "emoji-regex@9.2.2", "emojibase@15.3.0", "emojibase-regex@15.3.0", "encoding@0.1.13", "end-of-stream@1.4.4", "entities@4.5.0", "env-paths@2.2.1", "err-code@2.0.3", "error-ex@1.3.2", "es-abstract@1.21.1", "es-abstract@1.23.3", "es-define-property@1.0.0", "es-errors@1.3.0", "es-get-iterator@1.1.3", "es-object-atoms@1.0.0", "es-set-tostringtag@2.0.1", "es-set-tostringtag@2.0.3", "es-shim-unscopables@1.0.0", "es-to-primitive@1.2.1", "es6-error@4.1.1", "escalade@3.1.1", "escape-string-regexp@1.0.5", "escape-string-regexp@4.0.0", "eslint@8.57.0", "eslint-config-prettier@8.5.0", "eslint-import-resolver-node@0.3.6", "eslint-module-utils@2.7.4", "eslint-plugin-escompat@3.3.3", "eslint-plugin-eslint-comments@3.2.0", "eslint-plugin-filenames@1.3.2", "eslint-plugin-github@4.10.2", "eslint-plugin-i18n-text@1.0.1", "eslint-plugin-import@2.26.0", "eslint-plugin-jsx-a11y@6.7.1", "eslint-plugin-no-only-tests@3.0.0", "eslint-plugin-prettier@5.1.3", "eslint-rule-documentation@1.0.23", "eslint-scope@7.2.2", "eslint-visitor-keys@3.4.3", "espree@9.6.1", "esprima@4.0.1", "esquery@1.4.2", "esrecurse@4.3.0", "estraverse@5.3.0", "esutils@2.0.3", "eventemitter3@4.0.7", "expand-range@1.8.2", "expand-template@2.0.3", "exponential-backoff@3.1.1", "extend@3.0.2", "extend-shallow@2.0.1", "extract-zip@2.0.1", "fast-deep-equal@3.1.3", "fast-diff@1.2.0", "fast-glob@3.3.2", "fast-json-stable-stringify@2.1.0", "fast-levenshtein@2.0.6", "fast-xml-parser@4.2.5", "fastq@1.13.0", "fastq@1.17.1", "fd-slicer@1.1.0", "file-entry-cache@6.0.1", "file-uri-to-path@1.0.0", "fill-range@2.2.4", "fill-range@7.1.1", "find-packages@10.0.4", "find-up@4.1.0", "find-up@5.0.0", "flat-cache@3.0.4", "flatted@3.2.7", "for-each@0.3.3", "for-in@1.0.2", "foreground-child@3.1.1", "fs-constants@1.0.0", "fs-extra@11.2.0", "fs-minipass@2.1.0", "fs-minipass@3.0.3", "fs.realpath@1.0.0", "function-bind@1.1.1", "function-bind@1.1.2", "function.prototype.name@1.1.5", "function.prototype.name@1.1.6", "functions-have-names@1.2.3", "gaxios@6.5.0", "gcp-metadata@6.1.0", "generic-pool@3.9.0", "get-intrinsic@1.2.0", "get-intrinsic@1.2.4", "get-stream@5.2.0", "get-symbol-description@1.0.0", "get-symbol-description@1.0.2", "git-raw-commits@2.0.11", "git-up@7.0.0", "git-url-parse@14.0.0", "github-from-package@0.0.0", "github-url-from-git@1.5.0", "glob@10.3.12", "glob@10.3.15", "glob@6.0.4", "glob@7.2.3", "glob-parent@5.1.2", "glob-parent@6.0.2", "global-agent@3.0.0", "globals@13.19.0", "globalthis@1.0.3", "globalthis@1.0.4", "globby@11.1.0", "good-enough-parser@1.1.23", "google-auth-library@9.10.0", "gopd@1.0.1", "got@11.8.6", "graceful-fs@4.2.11", "graph-data-structure@3.5.0", "grapheme-splitter@1.0.4", "graphemer@1.4.0", "gray-matter@2.1.1", "gtoken@7.1.0", "handlebars@4.7.8", "hard-rejection@2.1.0", "has@1.0.3", "has-bigints@1.0.2", "has-flag@3.0.0", "has-flag@4.0.0", "has-property-descriptors@1.0.0", "has-property-descriptors@1.0.2", "has-proto@1.0.1", "has-proto@1.0.3", "has-symbols@1.0.3", "has-tostringtag@1.0.0", "has-tostringtag@1.0.2", "hasown@2.0.2", "he@1.2.0", "hosted-git-info@2.8.9", "hosted-git-info@4.1.0", "http-cache-semantics@4.1.1", "http-proxy-agent@7.0.2", "http2-wrapper@1.0.3", "https-proxy-agent@7.0.4", "humanize-ms@1.2.1", "iced-error@0.0.13", "iced-lock@1.1.0", "iced-lock@2.0.1", "iced-runtime@1.0.4", "iced-runtime-3@3.0.5", "iconv-lite@0.6.3", "ieee754@1.2.1", "ignore@5.3.1", "immediate@3.0.6", "import-fresh@3.3.0", "import-in-the-middle@1.7.4", "imurmurhash@0.1.4", "indent-string@4.0.0", "inflight@1.0.6", "inherits@2.0.4", "ini@1.3.8", "ini@4.1.2", "install-artifact-from-github@1.3.5", "internal-slot@1.0.5", "internal-slot@1.0.7", "ip-address@9.0.5", "is-alphabetical@1.0.4", "is-alphanumerical@1.0.4", "is-arguments@1.1.1", "is-array-buffer@3.0.1", "is-array-buffer@3.0.4", "is-arrayish@0.2.1", "is-bigint@1.0.4", "is-boolean-object@1.1.2", "is-buffer@1.1.6", "is-buffer@2.0.5", "is-callable@1.2.7", "is-core-module@2.10.0", "is-core-module@2.13.1", "is-data-view@1.0.1", "is-date-object@1.0.5", "is-decimal@1.0.4", "is-extendable@0.1.1", "is-extendable@1.0.1", "is-extglob@2.1.1", "is-fullwidth-code-point@3.0.0", "is-generator-function@1.0.10", "is-glob@4.0.3", "is-hexadecimal@1.0.4", "is-lambda@1.0.1", "is-map@2.0.2", "is-map@2.0.3", "is-negative-zero@2.0.2", "is-negative-zero@2.0.3", "is-number@2.1.0", "is-number@4.0.0", "is-number@7.0.0", "is-number-object@1.0.7", "is-path-inside@3.0.3", "is-plain-obj@1.1.0", "is-plain-obj@2.1.0", "is-plain-object@2.0.4", "is-regex@1.1.4", "is-set@2.0.2", "is-set@2.0.3", "is-shared-array-buffer@1.0.2", "is-shared-array-buffer@1.0.3", "is-ssh@1.4.0", "is-stream@2.0.1", "is-string@1.0.7", "is-symbol@1.0.4", "is-typed-array@1.1.10", "is-typed-array@1.1.13", "is-typedarray@1.0.0", "is-weakmap@2.0.1", "is-weakmap@2.0.2", "is-weakref@1.0.2", "is-weakset@2.0.2", "is-weakset@2.0.3", "is-windows@1.0.2", "isarray@1.0.0", "isarray@2.0.5", "isexe@2.0.0", "isexe@3.1.1", "isobject@2.1.0", "isobject@3.0.1", "jackspeak@2.3.6", "jasmine@5.1.0", "jasmine-core@5.1.2", "js-tokens@4.0.0", "js-yaml@3.14.1", "js-yaml@4.1.0", "jsbn@1.1.0", "json-bigint@1.0.0", "json-buffer@3.0.1", "json-dup-key-validator@1.0.3", "json-parse-even-better-errors@2.3.1", "json-schema-traverse@0.4.1", "json-stable-stringify-without-jsonify@1.0.1", "json-stringify-pretty-compact@3.0.0", "json-stringify-safe@5.0.1", "json5@1.0.2", "json5@2.2.3", "jsonata@2.0.5", "jsonc-parser@3.2.1", "jsonfile@6.1.0", "jsx-ast-utils@3.3.3", "jwa@2.0.0", "jws@4.0.0", "keybase-ecurve@1.0.1", "keybase-nacl@1.1.4", "keyv@4.5.4", "kind-of@3.2.2", "kind-of@6.0.3", "klona@2.0.6", "language-subtag-registry@0.3.22", "language-tags@1.0.5", "lazy-cache@2.0.2", "levn@0.4.1", "lie@3.1.1", "lines-and-columns@1.2.4", "linkify-it@5.0.0", "list-item@1.1.1", "localforage@1.10.0", "locate-path@5.0.0", "locate-path@6.0.0", "lodash@4.17.21", "lodash.camelcase@4.3.0", "lodash.kebabcase@4.1.1", "lodash.merge@4.6.2", "lodash.snakecase@4.1.1", "lodash.upperfirst@4.3.1", "longest-streak@2.0.4", "lowercase-keys@2.0.0", "lru-cache@10.2.0", "lru-cache@10.2.2", "lru-cache@6.0.0", "luxon@3.4.4", "make-fetch-happen@13.0.1", "map-obj@1.0.1", "map-obj@4.3.0", "markdown-it@14.1.0", "markdown-link@0.1.1", "markdown-table@2.0.0", "markdown-toc@1.2.0", "matcher@3.0.0", "math-random@1.0.4", "mdast-util-find-and-replace@1.1.1", "mdast-util-from-markdown@0.8.5", "mdast-util-to-markdown@0.6.5", "mdast-util-to-string@1.1.0", "mdast-util-to-string@2.0.0", "mdurl@2.0.0", "meow@7.1.1", "meow@8.1.2", "merge2@1.4.1", "micromark@2.11.4", "micromatch@4.0.5", "mimic-response@1.0.1", "mimic-response@3.1.0", "min-indent@1.0.1", "minimalistic-assert@1.0.1", "minimatch@3.1.2", "minimatch@9.0.2", "minimatch@9.0.3", "minimatch@9.0.4", "minimist@1.2.6", "minimist@1.2.8", "minimist-options@4.1.0", "minipass@3.3.6", "minipass@5.0.0", "minipass@7.0.4", "minipass@7.1.1", "minipass-collect@2.0.1", "minipass-fetch@3.0.5", "minipass-flush@1.0.5", "minipass-pipeline@1.2.4", "minipass-sized@1.0.3", "minizlib@2.1.2", "mixin-deep@1.3.2", "mkdirp@0.5.6", "mkdirp@1.0.4", "mkdirp-classic@0.5.3", "module-details-from-path@1.0.3", "moment@2.30.1", "moo@0.5.2", "more-entropy@0.0.7", "ms@2.0.0", "ms@2.1.2", "ms@2.1.3", "mv@2.1.1", "nan@2.19.0", "nanoid@3.3.7", "napi-build-utils@1.0.2", "natural-compare@1.4.0", "ncp@2.0.0", "negotiator@0.6.3", "neo-async@2.6.2", "node-abi@3.62.0", "node-fetch@2.7.0", "node-gyp@10.1.0", "node-html-parser@6.1.13", "node-releases@2.0.6", "nopt@7.2.1", "normalize-package-data@2.5.0", "normalize-package-data@3.0.3", "normalize-url@6.1.0", "nth-check@2.1.1", "object-inspect@1.12.2", "object-inspect@1.13.1", "object-is@1.1.5", "object-is@1.1.6", "object-keys@1.1.1", "object.assign@4.1.4", "object.assign@4.1.5", "object.entries@1.1.6", "object.fromentries@2.0.6", "object.pick@1.3.0", "object.values@1.1.5", "openpgp@5.11.1", "optionator@0.9.3", "p-all@3.0.0", "p-cancelable@2.1.1", "p-filter@2.1.0", "p-finally@1.0.0", "p-limit@2.3.0", "p-limit@3.1.0", "p-locate@4.1.0", "p-locate@5.0.0", "p-map@2.1.0", "p-map@4.0.0", "p-queue@6.6.2", "p-throttle@4.1.1", "p-timeout@3.2.0", "p-try@2.2.0", "parent-module@1.0.1", "parse-entities@2.0.0", "parse-json@5.2.0", "parse-link-header@2.0.0", "parse-path@7.0.0", "parse-url@8.1.0", "path-exists@4.0.0", "path-is-absolute@1.0.1", "path-key@3.1.1", "path-parse@1.0.7", "path-scurry@1.10.2", "path-scurry@1.11.1", "path-type@4.0.0", "pend@1.2.0", "pgp-utils@0.0.35", "picocolors@1.0.0", "picocolors@1.0.1", "picomatch@2.3.1", "possible-typed-array-names@1.0.0", "prebuild-install@7.1.2", "prelude-ls@1.2.1", "prettier@3.2.5", "prettier-linter-helpers@1.0.0", "proc-log@3.0.0", "proc-log@4.2.0", "process-nextick-args@2.0.1", "progress@1.1.8", "promise-retry@2.0.1", "protocols@2.0.1", "pump@3.0.0", "punycode@2.1.1", "punycode.js@2.3.1", "purepack@1.0.6", "qs@6.12.1", "queue-microtask@1.2.3", "quick-lru@4.0.1", "quick-lru@5.1.1", "randomatic@3.1.1", "rc@1.2.8", "re2@1.20.11", "read-pkg@5.2.0", "read-pkg-up@7.0.1", "read-yaml-file@2.1.0", "readable-stream@2.3.8", "readable-stream@3.6.2", "redent@3.0.0", "redis@4.6.13", "regenerator-runtime@0.13.11", "regenerator-runtime@0.14.1", "regexp.prototype.flags@1.4.3", "regexp.prototype.flags@1.5.2", "remark@13.0.0", "remark-github@10.1.0", "remark-parse@9.0.0", "remark-stringify@9.0.1", "remarkable@1.7.4", "renovate@37.374.1", "repeat-element@1.1.4", "repeat-string@1.6.1", "require-in-the-middle@7.3.0", "resolve@1.22.1", "resolve@1.22.8", "resolve-alpn@1.2.1", "resolve-from@4.0.0", "responselike@2.0.1", "retry@0.12.0", "reusify@1.0.4", "rimraf@2.4.5", "rimraf@3.0.2", "roarr@2.15.4", "run-parallel@1.2.0", "safe-array-concat@1.1.2", "safe-buffer@5.1.2", "safe-json-stringify@1.2.0", "safe-regex-test@1.0.0", "safe-regex-test@1.0.3", "safe-stable-stringify@2.4.3", "safer-buffer@2.1.2", "sax@1.3.0", "semver@5.7.2", "semver@7.6.0", "semver@7.6.2", "semver-compare@1.0.0", "semver-stable@3.0.0", "semver-utils@1.1.4", "serialize-error@7.0.1", "set-function-length@1.2.2", "set-function-name@2.0.2", "set-getter@0.1.1", "shebang-command@2.0.0", "shebang-regex@3.0.0", "shimmer@1.2.1", "shlex@2.1.2", "side-channel@1.0.4", "side-channel@1.0.6", "signal-exit@3.0.7", "signal-exit@4.0.2", "signal-exit@4.1.0", "simple-concat@1.0.1", "simple-get@4.0.1", "simple-git@3.24.0", "slash@3.0.0", "slugify@1.6.6", "smart-buffer@4.2.0", "socks@2.8.3", "socks-proxy-agent@8.0.3", "sort-keys@4.2.0", "source-map@0.6.1", "source-map-support@0.5.21", "spdx-correct@3.2.0", "spdx-exceptions@2.5.0", "spdx-expression-parse@3.0.1", "spdx-license-ids@3.0.17", "split2@3.2.2", "sprintf-js@1.0.3", "sprintf-js@1.1.3", "ssri@10.0.6", "stop-iteration-iterator@1.0.0", "string-width@4.2.3", "string-width@5.1.2", "string.prototype.trim@1.2.9", "string.prototype.trimend@1.0.6", "string.prototype.trimend@1.0.8", "string.prototype.trimstart@1.0.6", "string.prototype.trimstart@1.0.8", "string_decoder@1.1.1", "strip-ansi@6.0.1", "strip-ansi@7.0.1", "strip-ansi@7.1.0", "strip-bom@3.0.0", "strip-bom@4.0.0", "strip-color@0.1.0", "strip-comments-strings@1.2.0", "strip-indent@3.0.0", "strip-json-comments@2.0.1", "strip-json-comments@3.1.1", "strnum@1.0.5", "supports-color@5.5.0", "supports-color@7.2.0", "supports-preserve-symlinks-flag@1.0.0", "svg-element-attributes@1.3.1", "synckit@0.8.8", "tar@6.2.1", "tar-fs@2.1.3", "tar-stream@2.2.0", "text-table@0.2.0", "through2@2.0.5", "through2@4.0.2", "through2-concurrent@2.0.0", "tinylogic@2.0.0", "to-object-path@0.3.0", "to-regex-range@5.0.1", "toml@2.3.6", "toml-eslint-parser@0.9.3", "tr46@0.0.3", "traverse@0.6.9", "treeify@1.1.0", "trim-newlines@3.0.1", "triplesec@4.0.3", "trough@1.0.5", "ts-api-utils@1.3.0", "tsconfig-paths@3.14.1", "tslib@1.14.1", "tslib@2.6.2", "tunnel-agent@0.6.0", "tweetnacl@0.13.3", "tweetnacl@1.0.3", "typanion@3.14.0", "type-check@0.4.0", "type-fest@0.13.1", "type-fest@0.18.1", "type-fest@0.20.2", "type-fest@0.6.0", "type-fest@0.8.1", "typed-array-buffer@1.0.2", "typed-array-byte-length@1.0.1", "typed-array-byte-offset@1.0.2", "typed-array-length@1.0.4", "typed-array-length@1.0.6", "typed-rest-client@1.8.11", "typedarray@0.0.6", "typedarray-to-buffer@3.1.5", "typedarray.prototype.slice@1.0.3", "typescript@5.4.3", "typescript-eslint@7.5.0", "uc.micro@2.1.0", "uglify-js@3.17.4", "uint64be@1.0.1", "unbox-primitive@1.0.2", "underscore@1.13.6", "undici-types@5.26.5", "unified@9.2.2", "unique-filename@3.0.0", "unique-slug@4.0.0", "unist-util-is@4.1.0", "unist-util-stringify-position@2.0.3", "unist-util-visit@2.0.3", "unist-util-visit-parents@3.1.1", "universalify@2.0.1", "upath@2.0.1", "update-browserslist-db@1.0.5", "uri-js@4.4.1", "url-join@4.0.1", "util@0.12.5", "util-deprecate@1.0.2", "uuid@9.0.1", "validate-npm-package-license@3.0.4", "validate-npm-package-name@5.0.1", "vfile@4.2.1", "vfile-message@2.0.4", "vuln-vects@1.1.0", "webidl-conversions@3.0.1", "whatwg-url@5.0.0", "which@2.0.2", "which@4.0.0", "which-boxed-primitive@1.0.2", "which-collection@1.0.1", "which-collection@1.0.2", "which-typed-array@1.1.15", "which-typed-array@1.1.9", "wordwrap@1.0.0", "wrap-ansi@7.0.0", "wrap-ansi@8.1.0", "write-file-atomic@3.0.3", "write-file-atomic@5.0.1", "write-yaml-file@4.2.0", "xmldoc@1.3.0", "xtend@4.0.2", "yallist@4.0.0", "yargs-parser@18.1.3", "yargs-parser@20.2.9", "yauzl@2.10.0", "yocto-queue@0.1.0", "zod@3.23.8", "zwitch@1.0.5" ], "any": true, "baseline": false, "in_binary_new": [], "in_binary_resolved": [], "integrity_drift": 0, "license_changes": [ { "from": [], "package": "@octokit/endpoint", "to": [ "MIT" ] }, { "from": [], "package": "@octokit/openapi-types", "to": [ "MIT" ] }, { "from": [], "package": "@octokit/request", "to": [ "MIT" ] }, { "from": [], "package": "@octokit/types", "to": [ "MIT" ] } ], "new_vulnerabilities": [ { "aliases": [ "CVE-2026-48801" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-48801", "percentile": 0.3357, "score": 0.00394 }, "fix_state": "fixed", "fixed_in": [ "5.0.1" ], "id": "GHSA-22p9-wv53-3rq4", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "linkify-it", "severity": "High", "summary": "LinkifyIt#match scan loop has quadratic algorithmic complexity", "url": "https://github.com/advisories/GHSA-22p9-wv53-3rq4", "version": "5.0.0" }, { "aliases": [ "CVE-2026-27904" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-27904", "percentile": 0.44525, "score": 0.00525 }, "fix_state": "fixed", "fixed_in": [ "9.0.7" ], "id": "GHSA-23c5-xmqv-rm74", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "minimatch", "severity": "High", "summary": "minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions", "url": "https://github.com/advisories/GHSA-23c5-xmqv-rm74", "version": "9.0.4" }, { "aliases": [ "CVE-2026-59873" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-59873", "percentile": 0.47807, "score": 0.00582 }, "fix_state": "fixed", "fixed_in": [ "7.5.19" ], "id": "GHSA-23hp-3jrh-7fpw", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "tar", "severity": "Critical", "summary": "node-tar: Decompression/parse DoS via unlimited input", "url": "https://github.com/advisories/GHSA-23hp-3jrh-7fpw", "version": "6.2.1" }, { "aliases": [], "ecosystem": "npm", "epss": null, "fix_state": "fixed", "fixed_in": [ "14.3.1" ], "id": "GHSA-253c-mchw-3w2r", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "markdown-it", "severity": "Medium", "summary": "markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds", "url": "https://github.com/advisories/GHSA-253c-mchw-3w2r", "version": "14.1.0" }, { "aliases": [ "CVE-2026-32141" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-32141", "percentile": 0.57853, "score": 0.00839 }, "fix_state": "fixed", "fixed_in": [ "3.4.0" ], "id": "GHSA-25h7-pfq9-p65f", "kev": null, "location": "actions/installer/package-lock.json", "osv_confirmed": true, "package": "flatted", "severity": "High", "summary": "flatted vulnerable to unbounded recursion DoS in parse() revive phase", "url": "https://github.com/advisories/GHSA-25h7-pfq9-p65f", "version": "3.2.7" }, { "aliases": [ "CVE-2026-84375" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-84375", "percentile": 0.45503, "score": 0.00541 }, "fix_state": "fixed", "fixed_in": [ "4.3.2" ], "id": "GHSA-2883-xcg3-v3hh", "kev": null, "location": "actions/installer/package-lock.json", "osv_confirmed": true, "package": "js-yaml", "severity": "High", "summary": "js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources", "url": "https://github.com/advisories/GHSA-2883-xcg3-v3hh", "version": "4.1.0" }, { "aliases": [ "CVE-2026-67214" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-67214", "percentile": 0.26147, "score": 0.0033 }, "fix_state": "fixed", "fixed_in": [ "3.3.16" ], "id": "GHSA-28wg-ghj8-5hjv", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "nanoid", "severity": "High", "summary": "nanoid: non-secure generators can loop indefinitely with negative size", "url": "https://github.com/advisories/GHSA-28wg-ghj8-5hjv", "version": "3.3.7" }, { "aliases": [ "CVE-2026-77414" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-77414", "percentile": 0.47186, "score": 0.0057 }, "fix_state": "fixed", "fixed_in": [ "2.2.1" ], "id": "GHSA-2943-5xfg-gq5f", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "jsonata", "severity": "Critical", "summary": "JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions", "url": "https://github.com/advisories/GHSA-2943-5xfg-gq5f", "version": "2.0.5" }, { "aliases": [ "CVE-2025-69873" ], "ecosystem": "npm", "epss": { "cve": "CVE-2025-69873", "percentile": 0.45842, "score": 0.00547 }, "fix_state": "fixed", "fixed_in": [ "6.14.0" ], "id": "GHSA-2g4f-4pwh-qvx6", "kev": null, "location": "actions/installer/package-lock.json", "osv_confirmed": true, "package": "ajv", "severity": "Medium", "summary": "ajv has ReDoS when using `$data` option", "url": "https://github.com/advisories/GHSA-2g4f-4pwh-qvx6", "version": "6.12.6" }, { "aliases": [ "CVE-2026-33916" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-33916", "percentile": 0.20535, "score": 0.0028 }, "fix_state": "fixed", "fixed_in": [ "4.7.9" ], "id": "GHSA-2qvq-rjwj-gvw9", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "handlebars", "severity": "Medium", "summary": "Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection", "url": "https://github.com/advisories/GHSA-2qvq-rjwj-gvw9", "version": "4.7.8" }, { "aliases": [ "CVE-2026-67213" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-67213", "percentile": 0.26279, "score": 0.00331 }, "fix_state": "fixed", "fixed_in": [ "3.3.18" ], "id": "GHSA-2v37-7h3g-55p8", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "nanoid", "severity": "High", "summary": "nanoid: custom generators can loop indefinitely when size is zero", "url": "https://github.com/advisories/GHSA-2v37-7h3g-55p8", "version": "3.3.7" }, { "aliases": [ "CVE-2026-33937" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-33937", "percentile": 0.79759, "score": 0.01907 }, "fix_state": "fixed", "fixed_in": [ "4.7.9" ], "id": "GHSA-2w6w-674q-4c4q", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "handlebars", "severity": "Critical", "summary": "Handlebars.js has JavaScript Injection via AST Type Confusion", "url": "https://github.com/advisories/GHSA-2w6w-674q-4c4q", "version": "4.7.8" }, { "aliases": [ "CVE-2026-24842" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-24842", "percentile": 0.49102, "score": 0.00608 }, "fix_state": "fixed", "fixed_in": [ "7.5.7" ], "id": "GHSA-34x7-hfp2-rc4v", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "tar", "severity": "High", "summary": "node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal", "url": "https://github.com/advisories/GHSA-34x7-hfp2-rc4v", "version": "6.2.1" }, { "aliases": [], "ecosystem": "npm", "epss": null, "fix_state": "fixed", "fixed_in": [ "40.33.0" ], "id": "GHSA-36j9-mx87-2cff", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "renovate", "severity": "Medium", "summary": "Renovate vulnerable to arbitrary command injection via hermit manager and maliciously named dependencies", "url": "https://github.com/advisories/GHSA-36j9-mx87-2cff", "version": "37.374.1" }, { "aliases": [ "CVE-2026-2739" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-2739", "percentile": 0.44892, "score": 0.00531 }, "fix_state": "fixed", "fixed_in": [ "4.12.3" ], "id": "GHSA-378v-28hj-76wf", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "bn.js", "severity": "Medium", "summary": "bn.js affected by an infinite loop", "url": "https://github.com/advisories/GHSA-378v-28hj-76wf", "version": "4.12.0" }, { "aliases": [ "CVE-2026-2327" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-2327", "percentile": 0.54574, "score": 0.00739 }, "fix_state": "fixed", "fixed_in": [ "14.1.1" ], "id": "GHSA-38c4-r59v-3vqw", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "markdown-it", "severity": "Medium", "summary": "markdown-it is has a Regular Expression Denial of Service (ReDoS)", "url": "https://github.com/advisories/GHSA-38c4-r59v-3vqw", "version": "14.1.0" }, { "aliases": [], "ecosystem": "npm", "epss": null, "fix_state": "fixed", "fixed_in": [ "40.33.0" ], "id": "GHSA-3f44-xw83-3pmg", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "renovate", "severity": "Medium", "summary": "Renovate vulnerable to arbitrary command injection via helmv3 manager and malicious Chart.yaml file", "url": "https://github.com/advisories/GHSA-3f44-xw83-3pmg", "version": "37.374.1" }, { "aliases": [ "CVE-2026-118773" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-118773", "percentile": 0.28707, "score": 0.0035 }, "fix_state": "fixed", "fixed_in": [ "14.0.2" ], "id": "GHSA-3g3m-2fjr-6pw4", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "glob", "severity": "Medium", "summary": "Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal", "url": "https://github.com/advisories/GHSA-3g3m-2fjr-6pw4", "version": "10.3.15" }, { "aliases": [ "CVE-2026-13149" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-13149", "percentile": 0.3024, "score": 0.00364 }, "fix_state": "fixed", "fixed_in": [ "2.1.2" ], "id": "GHSA-3jxr-9vmj-r5cp", "kev": null, "location": "actions/installer/package-lock.json", "osv_confirmed": true, "package": "brace-expansion", "severity": "High", "summary": "brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups", "url": "https://github.com/advisories/GHSA-3jxr-9vmj-r5cp", "version": "2.0.1" }, { "aliases": [ "CVE-2026-33938" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-33938", "percentile": 0.53978, "score": 0.00721 }, "fix_state": "fixed", "fixed_in": [ "4.7.9" ], "id": "GHSA-3mfm-83xf-c92r", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "handlebars", "severity": "High", "summary": "Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block", "url": "https://github.com/advisories/GHSA-3mfm-83xf-c92r", "version": "4.7.8" }, { "aliases": [ "CVE-2026-26996" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-26996", "percentile": 0.47571, "score": 0.00577 }, "fix_state": "fixed", "fixed_in": [ "9.0.6" ], "id": "GHSA-3ppc-4f35-3m26", "kev": null, "location": "actions/installer/package-lock.json", "osv_confirmed": true, "package": "minimatch", "severity": "High", "summary": "minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern", "url": "https://github.com/advisories/GHSA-3ppc-4f35-3m26", "version": "9.0.4" }, { "aliases": [ "CVE-2026-33672" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-33672", "percentile": 0.36831, "score": 0.00425 }, "fix_state": "fixed", "fixed_in": [ "2.3.2" ], "id": "GHSA-3v7f-55p6-f55p", "kev": null, "location": "actions/installer/package-lock.json", "osv_confirmed": true, "package": "picomatch", "severity": "Medium", "summary": "Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching", "url": "https://github.com/advisories/GHSA-3v7f-55p6-f55p", "version": "2.3.1" }, { "aliases": [ "CVE-2024-21538" ], "ecosystem": "npm", "epss": { "cve": "CVE-2024-21538", "percentile": 0.58749, "score": 0.00868 }, "fix_state": "fixed", "fixed_in": [ "7.0.5" ], "id": "GHSA-3xgq-45jj-v275", "kev": null, "location": "actions/installer/package-lock.json", "osv_confirmed": true, "package": "cross-spawn", "severity": "High", "summary": "Regular Expression Denial of Service (ReDoS) in cross-spawn", "url": "https://github.com/advisories/GHSA-3xgq-45jj-v275", "version": "7.0.3" }, { "aliases": [], "ecosystem": "npm", "epss": null, "fix_state": "fixed", "fixed_in": [ "4.7.9" ], "id": "GHSA-442j-39wm-28r2", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "handlebars", "severity": "Low", "summary": "Handlebars.js has a Property Access Validation Bypass in container.lookup", "url": "https://github.com/advisories/GHSA-442j-39wm-28r2", "version": "4.7.8" }, { "aliases": [ "CVE-2026-59892" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-59892", "percentile": 0.46464, "score": 0.00557 }, "fix_state": "fixed", "fixed_in": [ "2.9.0" ], "id": "GHSA-45rx-2jwx-cxfr", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "@opentelemetry/propagator-jaeger", "severity": "High", "summary": "OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header", "url": "https://github.com/advisories/GHSA-45rx-2jwx-cxfr", "version": "1.24.1" }, { "aliases": [ "CVE-2026-82417" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-82417", "percentile": 0.33809, "score": 0.00396 }, "fix_state": "fixed", "fixed_in": [ "6.16.0" ], "id": "GHSA-4mjr-xmp4-gh2g", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "qs", "severity": "Medium", "summary": "qs: Denial of Service via Attacker Controlled isBuffer", "url": "https://github.com/advisories/GHSA-4mjr-xmp4-gh2g", "version": "6.12.1" }, { "aliases": [ "CVE-2026-17495" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-17495", "percentile": 0.44156, "score": 0.00519 }, "fix_state": "fixed", "fixed_in": [ "2.31.0" ], "id": "GHSA-4p3w-j4w9-5jqw", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "moment", "severity": "Medium", "summary": "moment vulnerable to Path Traversal via crafted non-string locale name", "url": "https://github.com/advisories/GHSA-4p3w-j4w9-5jqw", "version": "2.30.1" }, { "aliases": [ "CVE-2026-114141" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-114141", "percentile": 0.40891, "score": 0.00473 }, "fix_state": "fixed", "fixed_in": [ "5.0.1" ], "id": "GHSA-4qx8-w7c3-pj3p", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "toml", "severity": "High", "summary": "toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()", "url": "https://github.com/advisories/GHSA-4qx8-w7c3-pj3p", "version": "2.3.6" }, { "aliases": [ "CVE-2026-59869" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-59869", "percentile": 0.47992, "score": 0.00585 }, "fix_state": "fixed", "fixed_in": [ "4.3.0" ], "id": "GHSA-52cp-r559-cp3m", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "js-yaml", "severity": "High", "summary": "js-yaml: YAML merge-key chains can force quadratic CPU consumption", "url": "https://github.com/advisories/GHSA-52cp-r559-cp3m", "version": "4.1.0" }, { "aliases": [ "CVE-2025-64756" ], "ecosystem": "npm", "epss": { "cve": "CVE-2025-64756", "percentile": 0.87717, "score": 0.0309 }, "fix_state": "fixed", "fixed_in": [ "10.5.0" ], "id": "GHSA-5j98-mcp5-4vw2", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "glob", "severity": "High", "summary": "glob CLI: Command injection via -c/--cmd executes matches with shell:true", "url": "https://github.com/advisories/GHSA-5j98-mcp5-4vw2", "version": "10.3.15" }, { "aliases": [], "ecosystem": "npm", "epss": null, "fix_state": "fixed", "fixed_in": [ "4.3.1" ], "id": "GHSA-5p4m-2wfm-xmqj", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "js-yaml", "severity": "High", "summary": "JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) \u2014 CVE-2026-59870 fix not backported", "url": "https://github.com/advisories/GHSA-5p4m-2wfm-xmqj", "version": "4.1.0" }, { "aliases": [], "ecosystem": "npm", "epss": null, "fix_state": "fixed", "fixed_in": [ "4.4.0" ], "id": "GHSA-6475-r3vj-m8vf", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "@smithy/config-resolver", "severity": "Low", "summary": "AWS SDK for JavaScript v3 adopted defense in depth enhancement for region parameter value", "url": "https://github.com/advisories/GHSA-6475-r3vj-m8vf", "version": "3.0.0" }, { "aliases": [ "CVE-2026-12208" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-12208", "percentile": 0.24365, "score": 0.00314 }, "fix_state": "fixed", "fixed_in": [ "2.2.1" ], "id": "GHSA-663r-x48j-fg8p", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "jsonata", "severity": "Medium", "summary": "jsonata: Function Binding Prototype Pollution via hasOwnProperty Override", "url": "https://github.com/advisories/GHSA-663r-x48j-fg8p", "version": "2.0.5" }, { "aliases": [ "CVE-2026-77415" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-77415", "percentile": 0.59438, "score": 0.00892 }, "fix_state": "fixed", "fixed_in": [ "2.2.1" ], "id": "GHSA-66mm-25pp-rfff", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "jsonata", "severity": "Critical", "summary": "JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions", "url": "https://github.com/advisories/GHSA-66mm-25pp-rfff", "version": "2.0.5" }, { "aliases": [ "CVE-2026-68499" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-68499", "percentile": 0.07964, "score": 0.00184 }, "fix_state": "fixed", "fixed_in": [ "1.25.2" ], "id": "GHSA-6hxr-mr5r-9836", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "re2", "severity": "Medium", "summary": "re2: Global `String.prototype.match` with an empty-matchable pattern never advances \u2192 infinite loop with unbounded native memory growth (DoS)", "url": "https://github.com/advisories/GHSA-6hxr-mr5r-9836", "version": "1.20.11" }, { "aliases": [ "CVE-2026-102276" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-102276", "percentile": 0.39514, "score": 0.00455 }, "fix_state": "fixed", "fixed_in": [ "2.1.5" ], "id": "GHSA-6j4f-fj2g-mc7p", "kev": null, "location": "actions/installer/package-lock.json", "osv_confirmed": true, "package": "brace-expansion", "severity": "High", "summary": "brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion", "url": "https://github.com/advisories/GHSA-6j4f-fj2g-mc7p", "version": "2.0.1" }, { "aliases": [ "CVE-2026-110816" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-110816", "percentile": 0.30708, "score": 0.00368 }, "fix_state": "fixed", "fixed_in": [ "6.16.1" ], "id": "GHSA-6pq8-jhm2-2vcw", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "qs", "severity": "Medium", "summary": "qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)", "url": "https://github.com/advisories/GHSA-6pq8-jhm2-2vcw", "version": "6.12.1" }, { "aliases": [ "CVE-2025-15284" ], "ecosystem": "npm", "epss": { "cve": "CVE-2025-15284", "percentile": 0.39084, "score": 0.0045 }, "fix_state": "fixed", "fixed_in": [ "6.14.1" ], "id": "GHSA-6rw7-vpxm-498p", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "qs", "severity": "Medium", "summary": "qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion", "url": "https://github.com/advisories/GHSA-6rw7-vpxm-498p", "version": "6.12.1" }, { "aliases": [ "CVE-2026-48988" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-48988", "percentile": 0.3186, "score": 0.00379 }, "fix_state": "fixed", "fixed_in": [ "14.2.0" ], "id": "GHSA-6v5v-wf23-fmfq", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "markdown-it", "severity": "Medium", "summary": "markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations", "url": "https://github.com/advisories/GHSA-6v5v-wf23-fmfq", "version": "14.1.0" }, { "aliases": [ "CVE-2026-24001" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-24001", "percentile": 0.49541, "score": 0.00616 }, "fix_state": "fixed", "fixed_in": [ "5.2.2" ], "id": "GHSA-73rr-hh4g-fpgx", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "diff", "severity": "Low", "summary": "jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch", "url": "https://github.com/advisories/GHSA-73rr-hh4g-fpgx", "version": "5.2.0" }, { "aliases": [ "CVE-2026-73088" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-73088", "percentile": 0.51498, "score": 0.00658 }, "fix_state": "fixed", "fixed_in": [ "4.28.7" ], "id": "GHSA-73wf-gq98-2v4g", "kev": null, "location": "actions/installer/package-lock.json", "osv_confirmed": true, "package": "browserslist", "severity": "High", "summary": "Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)", "url": "https://github.com/advisories/GHSA-73wf-gq98-2v4g", "version": "4.21.3" }, { "aliases": [ "CVE-2026-19693" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-19693", "percentile": 0.39341, "score": 0.00453 }, "fix_state": "not-fixed", "fixed_in": [], "id": "GHSA-7pqw-9j4j-h8q3", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "extract-zip", "severity": "High", "summary": "extract-zip allows arbitrary file writes through symlink archive entries", "url": "https://github.com/advisories/GHSA-7pqw-9j4j-h8q3", "version": "2.0.1" }, { "aliases": [ "CVE-2026-77301" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-77301", "percentile": 0.49181, "score": 0.00609 }, "fix_state": "fixed", "fixed_in": [ "0.6.1" ], "id": "GHSA-7q85-xj36-vmfc", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "adm-zip", "severity": "High", "summary": "adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)", "url": "https://github.com/advisories/GHSA-7q85-xj36-vmfc", "version": "0.5.12" }, { "aliases": [ "CVE-2026-27903" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-27903", "percentile": 0.4749, "score": 0.00576 }, "fix_state": "fixed", "fixed_in": [ "9.0.7" ], "id": "GHSA-7r86-cg39-jmmj", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "minimatch", "severity": "High", "summary": "minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments", "url": "https://github.com/advisories/GHSA-7r86-cg39-jmmj", "version": "9.0.4" }, { "aliases": [], "ecosystem": "npm", "epss": null, "fix_state": "fixed", "fixed_in": [ "4.7.9" ], "id": "GHSA-7rx3-28cr-v5wh", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "handlebars", "severity": "Medium", "summary": "Handlebars.js has a Prototype Method Access Control Gap via Missing __lookupSetter__ Blocklist Entry", "url": "https://github.com/advisories/GHSA-7rx3-28cr-v5wh", "version": "4.7.8" }, { "aliases": [], "ecosystem": "npm", "epss": null, "fix_state": "fixed", "fixed_in": [ "0.6.1" ], "id": "GHSA-8238-w5pm-2374", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "adm-zip", "severity": "High", "summary": "adm-zip: Unhandled error event in async DEFLATE decompression crashes Node.js process (DoS)", "url": "https://github.com/advisories/GHSA-8238-w5pm-2374", "version": "0.5.12" }, { "aliases": [ "CVE-2026-77465" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-77465", "percentile": 0.49169, "score": 0.00609 }, "fix_state": "fixed", "fixed_in": [ "4.2.0" ], "id": "GHSA-82x6-q7mm-w9cf", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "toml", "severity": "High", "summary": "toml-node: Uncontrolled Recursion", "url": "https://github.com/advisories/GHSA-82x6-q7mm-w9cf", "version": "2.3.6" }, { "aliases": [ "CVE-2026-26960" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-26960", "percentile": 0.2599, "score": 0.00328 }, "fix_state": "fixed", "fixed_in": [ "7.5.8" ], "id": "GHSA-83g3-92jg-28cx", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "tar", "severity": "High", "summary": "Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction", "url": "https://github.com/advisories/GHSA-83g3-92jg-28cx", "version": "6.2.1" }, { "aliases": [ "CVE-2026-102827" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-102827", "percentile": 0.47538, "score": 0.00576 }, "fix_state": "fixed", "fixed_in": [ "4.0.0" ], "id": "GHSA-858h-whjf-mvg5", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "simple-git", "severity": "High", "summary": "simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)", "url": "https://github.com/advisories/GHSA-858h-whjf-mvg5", "version": "3.24.0" }, { "aliases": [ "CVE-2025-65945" ], "ecosystem": "npm", "epss": { "cve": "CVE-2025-65945", "percentile": 0.11984, "score": 0.00215 }, "fix_state": "fixed", "fixed_in": [ "4.0.1" ], "id": "GHSA-869p-cjfg-cm3x", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "jws", "severity": "High", "summary": "auth0/node-jws Improperly Verifies HMAC Signature", "url": "https://github.com/advisories/GHSA-869p-cjfg-cm3x", "version": "4.0.0" }, { "aliases": [ "CVE-2026-52746" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-52746", "percentile": 0.52771, "score": 0.00689 }, "fix_state": "fixed", "fixed_in": [ "2.2.0" ], "id": "GHSA-86vw-mfpg-wwv9", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "jsonata", "severity": "High", "summary": "jsonata: Malicious inputs to \"$toMillis\" function can cause resource exhaustion", "url": "https://github.com/advisories/GHSA-86vw-mfpg-wwv9", "version": "2.0.5" }, { "aliases": [ "CVE-2026-54285" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-54285", "percentile": 0.34479, "score": 0.00402 }, "fix_state": "fixed", "fixed_in": [ "2.8.0" ], "id": "GHSA-8988-4f7v-96qf", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "@opentelemetry/core", "severity": "Medium", "summary": "OpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagation", "url": "https://github.com/advisories/GHSA-8988-4f7v-96qf", "version": "1.24.1" }, { "aliases": [ "CVE-2026-33036" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-33036", "percentile": 0.4867, "score": 0.00599 }, "fix_state": "fixed", "fixed_in": [ "4.5.5" ], "id": "GHSA-8gc5-j5rx-235r", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "fast-xml-parser", "severity": "High", "summary": "fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278)", "url": "https://github.com/advisories/GHSA-8gc5-j5rx-235r", "version": "4.2.5" }, { "aliases": [ "CVE-2026-77413" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-77413", "percentile": 0.53898, "score": 0.00719 }, "fix_state": "fixed", "fixed_in": [ "2.2.0" ], "id": "GHSA-8gq3-vp5j-2grp", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "jsonata", "severity": "Critical", "summary": "JSONata: Arbitrary Code Execution via crafted JSONata expressions", "url": "https://github.com/advisories/GHSA-8gq3-vp5j-2grp", "version": "2.0.5" }, { "aliases": [ "CVE-2026-71430" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-71430", "percentile": 0.04865, "score": 0.00157 }, "fix_state": "fixed", "fixed_in": [ "1.25.1" ], "id": "GHSA-8hcv-x26h-mcgp", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "re2", "severity": "Medium", "summary": "node-re2: String.prototype.replace(re2, template) aborts the Node process (uncatchable ToLocalChecked on empty MaybeLocal) when the result exceeds V8's max string length", "url": "https://github.com/advisories/GHSA-8hcv-x26h-mcgp", "version": "1.20.11" }, { "aliases": [ "CVE-2025-47934" ], "ecosystem": "npm", "epss": { "cve": "CVE-2025-47934", "percentile": 0.50936, "score": 0.00645 }, "fix_state": "fixed", "fixed_in": [ "5.11.3" ], "id": "GHSA-8qff-qr5q-5pr8", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "openpgp", "severity": "High", "summary": "OpenPGP.js's message signature verification can be spoofed", "url": "https://github.com/advisories/GHSA-8qff-qr5q-5pr8", "version": "5.11.1" }, { "aliases": [ "CVE-2026-23745" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-23745", "percentile": 0.31588, "score": 0.00376 }, "fix_state": "fixed", "fixed_in": [ "7.5.3" ], "id": "GHSA-8qq5-rm4j-mr97", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "tar", "severity": "High", "summary": "node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization", "url": "https://github.com/advisories/GHSA-8qq5-rm4j-mr97", "version": "6.2.1" }, { "aliases": [ "CVE-2026-106446" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-106446", "percentile": 0.56143, "score": 0.00786 }, "fix_state": "fixed", "fixed_in": [ "4.7.10" ], "id": "GHSA-8r5x-fm3f-whwj", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "handlebars", "severity": "Critical", "summary": "Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)", "url": "https://github.com/advisories/GHSA-8r5x-fm3f-whwj", "version": "4.7.8" }, { "aliases": [ "CVE-2026-59874" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-59874", "percentile": 0.37686, "score": 0.00434 }, "fix_state": "fixed", "fixed_in": [ "7.5.18" ], "id": "GHSA-8x88-c5mf-7j5w", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "tar", "severity": "High", "summary": "node-tar: Negative tar entry size causes infinite loop in archive replace", "url": "https://github.com/advisories/GHSA-8x88-c5mf-7j5w", "version": "6.2.1" }, { "aliases": [ "CVE-2024-4067" ], "ecosystem": "npm", "epss": { "cve": "CVE-2024-4067", "percentile": 0.73001, "score": 0.01429 }, "fix_state": "fixed", "fixed_in": [ "4.0.8" ], "id": "GHSA-952p-6rrq-rcjv", "kev": null, "location": "actions/installer/package-lock.json", "osv_confirmed": true, "package": "micromatch", "severity": "Medium", "summary": "Regular Expression Denial of Service (ReDoS) in micromatch", "url": "https://github.com/advisories/GHSA-952p-6rrq-rcjv", "version": "4.0.5" }, { "aliases": [ "CVE-2025-27789" ], "ecosystem": "npm", "epss": { "cve": "CVE-2025-27789", "percentile": 0.46829, "score": 0.00563 }, "fix_state": "fixed", "fixed_in": [ "7.26.10" ], "id": "GHSA-968p-4wvh-cqc8", "kev": null, "location": "actions/installer/package-lock.json", "osv_confirmed": true, "package": "@babel/runtime", "severity": "Medium", "summary": "Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups", "url": "https://github.com/advisories/GHSA-968p-4wvh-cqc8", "version": "7.21.0" }, { "aliases": [ "CVE-2025-27789" ], "ecosystem": "npm", "epss": { "cve": "CVE-2025-27789", "percentile": 0.46829, "score": 0.00563 }, "fix_state": "fixed", "fixed_in": [ "7.26.10" ], "id": "GHSA-968p-4wvh-cqc8", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "@babel/runtime-corejs3", "severity": "Medium", "summary": "Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups", "url": "https://github.com/advisories/GHSA-968p-4wvh-cqc8", "version": "7.24.5" }, { "aliases": [ "CVE-2026-33939" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-33939", "percentile": 0.50065, "score": 0.00627 }, "fix_state": "fixed", "fixed_in": [ "4.7.9" ], "id": "GHSA-9cx6-37pm-9jff", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "handlebars", "severity": "High", "summary": "Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation", "url": "https://github.com/advisories/GHSA-9cx6-37pm-9jff", "version": "4.7.8" }, { "aliases": [ "CVE-2026-114143" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-114143", "percentile": 0.4089, "score": 0.00473 }, "fix_state": "fixed", "fixed_in": [ "5.0.1" ], "id": "GHSA-9j65-hcg3-gc64", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "toml", "severity": "High", "summary": "toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()", "url": "https://github.com/advisories/GHSA-9j65-hcg3-gc64", "version": "2.3.6" }, { "aliases": [ "CVE-2026-31802" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-31802", "percentile": 0.19054, "score": 0.00269 }, "fix_state": "fixed", "fixed_in": [ "7.5.11" ], "id": "GHSA-9ppj-qmqm-q256", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "tar", "severity": "High", "summary": "node-tar Symlink Path Traversal via Drive-Relative Linkpath", "url": "https://github.com/advisories/GHSA-9ppj-qmqm-q256", "version": "6.2.1" }, { "aliases": [ "CVE-2026-114144" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-114144", "percentile": 0.38278, "score": 0.0044 }, "fix_state": "fixed", "fixed_in": [ "5.0.1" ], "id": "GHSA-9qmh-m7c6-f92p", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "toml", "severity": "High", "summary": "toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()", "url": "https://github.com/advisories/GHSA-9qmh-m7c6-f92p", "version": "2.3.6" }, { "aliases": [ "CVE-2026-33671" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-33671", "percentile": 0.36317, "score": 0.0042 }, "fix_state": "fixed", "fixed_in": [ "2.3.2" ], "id": "GHSA-c2c7-rcm5-vvqj", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "picomatch", "severity": "High", "summary": "Picomatch has a ReDoS vulnerability via extglob quantifiers", "url": "https://github.com/advisories/GHSA-c2c7-rcm5-vvqj", "version": "2.3.1" }, { "aliases": [], "ecosystem": "npm", "epss": null, "fix_state": "fixed", "fixed_in": [ "0.6.1" ], "id": "GHSA-c6fg-446q-cg94", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "adm-zip", "severity": "Medium", "summary": "adm-zip: getDataAsync() bypasses the maxOutputLength size guard enforced by the synchronous getData() path", "url": "https://github.com/advisories/GHSA-c6fg-446q-cg94", "version": "0.5.12" }, { "aliases": [ "CVE-2026-73089" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-73089", "percentile": 0.51386, "score": 0.00655 }, "fix_state": "fixed", "fixed_in": [ "4.28.7" ], "id": "GHSA-c83g-rgw3-j3cx", "kev": null, "location": "actions/installer/package-lock.json", "osv_confirmed": true, "package": "browserslist", "severity": "High", "summary": "Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM", "url": "https://github.com/advisories/GHSA-c83g-rgw3-j3cx", "version": "4.21.3" }, { "aliases": [ "CVE-2026-2950" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-2950", "percentile": 0.2717, "score": 0.00337 }, "fix_state": "fixed", "fixed_in": [ "4.18.0" ], "id": "GHSA-f23m-r3pf-42rh", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "lodash", "severity": "Medium", "summary": "lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`", "url": "https://github.com/advisories/GHSA-f23m-r3pf-42rh", "version": "4.17.21" }, { "aliases": [ "CVE-2026-33750" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-33750", "percentile": 0.38904, "score": 0.00447 }, "fix_state": "fixed", "fixed_in": [ "2.0.3" ], "id": "GHSA-f886-m6hf-6m8v", "kev": null, "location": "actions/installer/package-lock.json", "osv_confirmed": true, "package": "brace-expansion", "severity": "Medium", "summary": "brace-expansion: Zero-step sequence causes process hang and memory exhaustion", "url": "https://github.com/advisories/GHSA-f886-m6hf-6m8v", "version": "2.0.1" }, { "aliases": [ "CVE-2026-67550" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-67550", "percentile": 0.05292, "score": 0.00161 }, "fix_state": "fixed", "fixed_in": [ "1.25.2" ], "id": "GHSA-ff84-5f28-78qj", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "re2", "severity": "Medium", "summary": "re2: Out-of-bounds heap read in `exec`/`test`/`match` via attacker-influenced `lastIndex` on a non-ASCII subject \u2192 uncatchable process crash (DoS)", "url": "https://github.com/advisories/GHSA-ff84-5f28-78qj", "version": "1.20.11" }, { "aliases": [ "CVE-2026-27942" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-27942", "percentile": 0.45634, "score": 0.00543 }, "fix_state": "fixed", "fixed_in": [ "4.5.4" ], "id": "GHSA-fj3w-jwp8-x2g3", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "fast-xml-parser", "severity": "Low", "summary": "fast-xml-parser has stack overflow in XMLBuilder with preserveOrder", "url": "https://github.com/advisories/GHSA-fj3w-jwp8-x2g3", "version": "4.2.5" }, { "aliases": [], "ecosystem": "npm", "epss": null, "fix_state": "fixed", "fixed_in": [ "40.33.0" ], "id": "GHSA-fr4j-65pv-gjjj", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "renovate", "severity": "Medium", "summary": "Renovate vulnerable to arbitrary command injection via npm manager and malicious Renovate configuration", "url": "https://github.com/advisories/GHSA-fr4j-65pv-gjjj", "version": "37.374.1" }, { "aliases": [ "CVE-2026-118764" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-118764", "percentile": 0.21751, "score": 0.00291 }, "fix_state": "fixed", "fixed_in": [ "11.0.1" ], "id": "GHSA-g3hv-75wg-m249", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "minimatch", "severity": "Medium", "summary": "minimatch has potential denial of service via globparts amplification", "url": "https://github.com/advisories/GHSA-g3hv-75wg-m249", "version": "9.0.4" }, { "aliases": [ "CVE-2026-102826" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-102826", "percentile": 0.40183, "score": 0.00464 }, "fix_state": "fixed", "fixed_in": [ "4.0.0" ], "id": "GHSA-g4wm-2vf7-vfgr", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "simple-git", "severity": "High", "summary": "simple-git allows command execution through unblocked Git configuration includes", "url": "https://github.com/advisories/GHSA-g4wm-2vf7-vfgr", "version": "3.24.0" }, { "aliases": [ "CVE-2026-93753" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-93753", "percentile": 0.43819, "score": 0.00514 }, "fix_state": "not-fixed", "fixed_in": [], "id": "GHSA-gcqx-w48m-w2h4", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "deepmerge", "severity": "Low", "summary": "deepmerge mergeObject() allows prototype poisoning of returned objects", "url": "https://github.com/advisories/GHSA-gcqx-w48m-w2h4", "version": "4.3.1" }, { "aliases": [ "CVE-2026-111758" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-111758", "percentile": 0.46036, "score": 0.0055 }, "fix_state": "fixed", "fixed_in": [ "14.3.3" ], "id": "GHSA-gfr2-rv44-r23c", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "markdown-it", "severity": "High", "summary": "markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)", "url": "https://github.com/advisories/GHSA-gfr2-rv44-r23c", "version": "14.1.0" }, { "aliases": [ "CVE-2026-41650" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-41650", "percentile": 0.14933, "score": 0.00238 }, "fix_state": "fixed", "fixed_in": [ "5.7.0" ], "id": "GHSA-gh4j-gqv2-49f6", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "fast-xml-parser", "severity": "Medium", "summary": "fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters", "url": "https://github.com/advisories/GHSA-gh4j-gqv2-49f6", "version": "4.2.5" }, { "aliases": [ "CVE-2026-59875" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-59875", "percentile": 0.29158, "score": 0.00354 }, "fix_state": "fixed", "fixed_in": [ "7.5.17" ], "id": "GHSA-gvwx-54wh-qm9j", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "tar", "severity": "Medium", "summary": "node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records", "url": "https://github.com/advisories/GHSA-gvwx-54wh-qm9j", "version": "6.2.1" }, { "aliases": [ "CVE-2026-101911" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-101911", "percentile": 0.32357, "score": 0.00383 }, "fix_state": "fixed", "fixed_in": [ "10.7.1" ], "id": "GHSA-h3mg-xc3c-68pw", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "ip-address", "severity": "Medium", "summary": "ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process", "url": "https://github.com/advisories/GHSA-h3mg-xc3c-68pw", "version": "9.0.5" }, { "aliases": [ "CVE-2026-53550" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-53550", "percentile": 0.35866, "score": 0.00415 }, "fix_state": "fixed", "fixed_in": [ "4.2.0" ], "id": "GHSA-h67p-54hq-rp68", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "js-yaml", "severity": "Medium", "summary": "JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases", "url": "https://github.com/advisories/GHSA-h67p-54hq-rp68", "version": "4.1.0" }, { "aliases": [ "CVE-2026-6951" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-6951", "percentile": 0.59045, "score": 0.00877 }, "fix_state": "fixed", "fixed_in": [ "3.36.0" ], "id": "GHSA-hffm-xvc3-vprc", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "simple-git", "severity": "High", "summary": "simple-git is vulnerable to Remote Code Execution", "url": "https://github.com/advisories/GHSA-hffm-xvc3-vprc", "version": "3.24.0" }, { "aliases": [ "CVE-2026-71498" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-71498", "percentile": 0.06811, "score": 0.00174 }, "fix_state": "fixed", "fixed_in": [ "1.26.1" ], "id": "GHSA-j4r3-hg7j-8chg", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "re2", "severity": "Medium", "summary": "node-re2: Out-of-bounds heap read in `replace`/`split` via a `Buffer` ending in a truncated multi-byte UTF-8 character \u2192 adjacent heap memory disclosed to JavaScript", "url": "https://github.com/advisories/GHSA-j4r3-hg7j-8chg", "version": "1.20.11" }, { "aliases": [ "CVE-2026-102282" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-102282", "percentile": 0.09814, "score": 0.00199 }, "fix_state": "fixed", "fixed_in": [ "0.6.1" ], "id": "GHSA-j5f4-cc29-5x44", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "adm-zip", "severity": "High", "summary": "adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation", "url": "https://github.com/advisories/GHSA-j5f4-cc29-5x44", "version": "0.5.12" }, { "aliases": [ "CVE-2026-101912" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-101912", "percentile": 0.30994, "score": 0.0037 }, "fix_state": "fixed", "fixed_in": [ "10.7.1" ], "id": "GHSA-j6r3-76f7-8jcv", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "ip-address", "severity": "Medium", "summary": "ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range", "url": "https://github.com/advisories/GHSA-j6r3-76f7-8jcv", "version": "9.0.5" }, { "aliases": [ "CVE-2026-28291" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-28291", "percentile": 0.5559, "score": 0.00768 }, "fix_state": "fixed", "fixed_in": [ "3.32.0" ], "id": "GHSA-jcxm-m3jx-f287", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "simple-git", "severity": "High", "summary": "simple-git Affected by Command Execution via Option-Parsing Bypass", "url": "https://github.com/advisories/GHSA-jcxm-m3jx-f287", "version": "3.24.0" }, { "aliases": [ "CVE-2026-26278" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-26278", "percentile": 0.60869, "score": 0.00937 }, "fix_state": "fixed", "fixed_in": [ "4.5.4" ], "id": "GHSA-jmr7-xgp7-cmfj", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "fast-xml-parser", "severity": "High", "summary": "fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)", "url": "https://github.com/advisories/GHSA-jmr7-xgp7-cmfj", "version": "4.2.5" }, { "aliases": [ "CVE-2026-56876" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-56876", "percentile": 0.44568, "score": 0.00526 }, "fix_state": "not-fixed", "fixed_in": [], "id": "GHSA-jmr9-qjv8-65gv", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "extract-zip", "severity": "High", "summary": "extract-zip unvalidated symlink path traversal", "url": "https://github.com/advisories/GHSA-jmr9-qjv8-65gv", "version": "2.0.1" }, { "aliases": [ "CVE-2026-33349" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-33349", "percentile": 0.40434, "score": 0.00467 }, "fix_state": "fixed", "fixed_in": [ "4.5.5" ], "id": "GHSA-jp2q-39xq-3w4g", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "fast-xml-parser", "severity": "Medium", "summary": "Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in fast-xml-parser", "url": "https://github.com/advisories/GHSA-jp2q-39xq-3w4g", "version": "4.2.5" }, { "aliases": [ "CVE-2026-25896" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-25896", "percentile": 0.44685, "score": 0.00527 }, "fix_state": "fixed", "fixed_in": [ "4.5.4" ], "id": "GHSA-m7jm-9gc2-mpf2", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "fast-xml-parser", "severity": "Critical", "summary": "fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names", "url": "https://github.com/advisories/GHSA-m7jm-9gc2-mpf2", "version": "4.2.5" }, { "aliases": [ "CVE-2025-64718" ], "ecosystem": "npm", "epss": { "cve": "CVE-2025-64718", "percentile": 0.36631, "score": 0.00423 }, "fix_state": "fixed", "fixed_in": [ "4.1.1" ], "id": "GHSA-mh29-5h37-fv8m", "kev": null, "location": "actions/installer/package-lock.json", "osv_confirmed": true, "package": "js-yaml", "severity": "Medium", "summary": "js-yaml has prototype pollution in merge (<<)", "url": "https://github.com/advisories/GHSA-mh29-5h37-fv8m", "version": "4.1.0" }, { "aliases": [ "CVE-2026-14257" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-14257", "percentile": 0.50816, "score": 0.00643 }, "fix_state": "fixed", "fixed_in": [ "2.1.3" ], "id": "GHSA-mh99-v99m-4gvg", "kev": null, "location": "actions/installer/package-lock.json", "osv_confirmed": true, "package": "brace-expansion", "severity": "High", "summary": "brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash", "url": "https://github.com/advisories/GHSA-mh99-v99m-4gvg", "version": "2.0.1" }, { "aliases": [ "CVE-2023-54404" ], "ecosystem": "npm", "epss": null, "fix_state": "fixed", "fixed_in": [ "4.6.6" ], "id": "GHSA-mrhx-c7xc-m3w5", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "zod", "severity": "High", "summary": "Zod can exhaust memory while validating oversized constrained collections", "url": "https://github.com/advisories/GHSA-mrhx-c7xc-m3w5", "version": "3.23.8" }, { "aliases": [ "CVE-2024-55565" ], "ecosystem": "npm", "epss": { "cve": "CVE-2024-55565", "percentile": 0.51785, "score": 0.00665 }, "fix_state": "fixed", "fixed_in": [ "3.3.8" ], "id": "GHSA-mwcw-c2x4-8c55", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "nanoid", "severity": "Medium", "summary": "Predictable results in nanoid generation when given non-integer values", "url": "https://github.com/advisories/GHSA-mwcw-c2x4-8c55", "version": "3.3.7" }, { "aliases": [ "CVE-2026-69192" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-69192", "percentile": 0.40267, "score": 0.00465 }, "fix_state": "fixed", "fixed_in": [ "10.3.1" ], "id": "GHSA-mwp4-54f8-5fhr", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "ip-address", "severity": "High", "summary": "ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass", "url": "https://github.com/advisories/GHSA-mwp4-54f8-5fhr", "version": "9.0.5" }, { "aliases": [], "ecosystem": "npm", "epss": null, "fix_state": "fixed", "fixed_in": [ "0.6.1" ], "id": "GHSA-p634-w6r4-rjp2", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "adm-zip", "severity": "Medium", "summary": "adm-zip: Duplicate ZIP entry names: getEntry() and extractAllTo() resolve to different content", "url": "https://github.com/advisories/GHSA-p634-w6r4-rjp2", "version": "0.5.12" }, { "aliases": [ "CVE-2026-106445" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-106445", "percentile": 0.48158, "score": 0.00589 }, "fix_state": "fixed", "fixed_in": [ "4.7.10" ], "id": "GHSA-p8wg-vrv2-v86f", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "handlebars", "severity": "Critical", "summary": "Handlebars: JavaScript Injection via Own Property Check Bypass", "url": "https://github.com/advisories/GHSA-p8wg-vrv2-v86f", "version": "4.7.8" }, { "aliases": [], "ecosystem": "npm", "epss": null, "fix_state": "fixed", "fixed_in": [ "42.68.5" ], "id": "GHSA-pfq2-hh62-7m96", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "renovate", "severity": "Medium", "summary": "Renovate vulnerable to arbitrary command injection via Gradle Wrapper and malicious `distributionUrl`", "url": "https://github.com/advisories/GHSA-pfq2-hh62-7m96", "version": "37.374.1" }, { "aliases": [ "CVE-2026-102277" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-102277", "percentile": 0.37116, "score": 0.00428 }, "fix_state": "fixed", "fixed_in": [ "2.1.7" ], "id": "GHSA-q2hr-2g5m-vwhr", "kev": null, "location": "actions/installer/package-lock.json", "osv_confirmed": true, "package": "brace-expansion", "severity": "Medium", "summary": "brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service", "url": "https://github.com/advisories/GHSA-q2hr-2g5m-vwhr", "version": "2.0.1" }, { "aliases": [ "CVE-2026-8723" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-8723", "percentile": 0.34217, "score": 0.00399 }, "fix_state": "fixed", "fixed_in": [ "6.15.2" ], "id": "GHSA-q8mj-m7cp-5q26", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "qs", "severity": "Medium", "summary": "qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set", "url": "https://github.com/advisories/GHSA-q8mj-m7cp-5q26", "version": "6.12.1" }, { "aliases": [ "CVE-2026-29786" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-29786", "percentile": 0.40344, "score": 0.00466 }, "fix_state": "fixed", "fixed_in": [ "7.5.10" ], "id": "GHSA-qffp-2rhf-9h96", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "tar", "severity": "High", "summary": "tar has Hardlink Path Traversal via Drive-Relative Linkpath", "url": "https://github.com/advisories/GHSA-qffp-2rhf-9h96", "version": "6.2.1" }, { "aliases": [ "CVE-2026-102278" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-102278", "percentile": 0.42209, "score": 0.00491 }, "fix_state": "fixed", "fixed_in": [ "2.1.6" ], "id": "GHSA-qhr7-859c-m2p7", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "brace-expansion", "severity": "High", "summary": "brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion", "url": "https://github.com/advisories/GHSA-qhr7-859c-m2p7", "version": "2.0.1" }, { "aliases": [ "CVE-2026-27601" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-27601", "percentile": 0.64629, "score": 0.01063 }, "fix_state": "fixed", "fixed_in": [ "1.13.8" ], "id": "GHSA-qpx9-hpmf-5gmw", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "underscore", "severity": "High", "summary": "Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack", "url": "https://github.com/advisories/GHSA-qpx9-hpmf-5gmw", "version": "1.13.6" }, { "aliases": [ "CVE-2026-28292" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-28292", "percentile": 0.71474, "score": 0.01348 }, "fix_state": "fixed", "fixed_in": [ "3.32.3" ], "id": "GHSA-r275-fr43-pm7q", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "simple-git", "severity": "Critical", "summary": "simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key enables RCE", "url": "https://github.com/advisories/GHSA-r275-fr43-pm7q", "version": "3.24.0" }, { "aliases": [ "CVE-2026-73566" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-73566", "percentile": 0.44902, "score": 0.00531 }, "fix_state": "fixed", "fixed_in": [ "7.5.21" ], "id": "GHSA-r292-9mhp-454m", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "tar", "severity": "High", "summary": "node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection", "url": "https://github.com/advisories/GHSA-r292-9mhp-454m", "version": "6.2.1" }, { "aliases": [ "CVE-2026-4800" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-4800", "percentile": 0.86507, "score": 0.02808 }, "fix_state": "fixed", "fixed_in": [ "4.18.0" ], "id": "GHSA-r5fr-rjxr-66jc", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "lodash", "severity": "High", "summary": "lodash vulnerable to Code Injection via `_.template` imports key names", "url": "https://github.com/advisories/GHSA-r5fr-rjxr-66jc", "version": "4.17.21" }, { "aliases": [ "CVE-2026-23950" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-23950", "percentile": 0.18342, "score": 0.00264 }, "fix_state": "fixed", "fixed_in": [ "7.5.4" ], "id": "GHSA-r6q2-hw4h-h46w", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "tar", "severity": "High", "summary": "Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS", "url": "https://github.com/advisories/GHSA-r6q2-hw4h-h46w", "version": "6.2.1" }, { "aliases": [ "CVE-2026-111759" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-111759", "percentile": 0.48249, "score": 0.00591 }, "fix_state": "fixed", "fixed_in": [ "14.3.2" ], "id": "GHSA-r7fv-28h4-cvq7", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "markdown-it", "severity": "High", "summary": "markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes", "url": "https://github.com/advisories/GHSA-r7fv-28h4-cvq7", "version": "14.1.0" }, { "aliases": [], "ecosystem": "npm", "epss": null, "fix_state": "fixed", "fixed_in": [ "0.6.1" ], "id": "GHSA-rcw4-f5rp-g42v", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "adm-zip", "severity": "High", "summary": "adm-zip: Decompression-bomb protection (fix for CVE-2026-39244) can be bypassed by declaring uncompressed size as 0", "url": "https://github.com/advisories/GHSA-rcw4-f5rp-g42v", "version": "0.5.12" }, { "aliases": [ "CVE-2026-33228" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-33228", "percentile": 0.57797, "score": 0.00838 }, "fix_state": "fixed", "fixed_in": [ "3.4.2" ], "id": "GHSA-rf6f-7fwh-wjgh", "kev": null, "location": "actions/installer/package-lock.json", "osv_confirmed": true, "package": "flatted", "severity": "High", "summary": "Prototype Pollution via parse() in NodeJS flatted", "url": "https://github.com/advisories/GHSA-rf6f-7fwh-wjgh", "version": "3.2.7" }, { "aliases": [ "CVE-2026-69152" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-69152", "percentile": 0.51004, "score": 0.00647 }, "fix_state": "fixed", "fixed_in": [ "2.1.4" ], "id": "GHSA-rgw5-rvv9-x895", "kev": null, "location": "actions/installer/package-lock.json", "osv_confirmed": true, "package": "brace-expansion", "severity": "High", "summary": "brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation", "url": "https://github.com/advisories/GHSA-rgw5-rvv9-x895", "version": "2.0.1" }, { "aliases": [ "CVE-2026-101913" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-101913", "percentile": 0.32683, "score": 0.00386 }, "fix_state": "fixed", "fixed_in": [ "10.5.1" ], "id": "GHSA-rpw4-54j3-4h4q", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "ip-address", "severity": "Medium", "summary": "ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts", "url": "https://github.com/advisories/GHSA-rpw4-54j3-4h4q", "version": "9.0.5" }, { "aliases": [ "CVE-2026-111997" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-111997", "percentile": 0.24409, "score": 0.00315 }, "fix_state": "fixed", "fixed_in": [ "10.7.4" ], "id": "GHSA-rxp7-6hxx-x8q5", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "ip-address", "severity": "Medium", "summary": "ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process", "url": "https://github.com/advisories/GHSA-rxp7-6hxx-x8q5", "version": "9.0.5" }, { "aliases": [ "CVE-2026-59887" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-59887", "percentile": 0.40425, "score": 0.00467 }, "fix_state": "fixed", "fixed_in": [ "5.0.2" ], "id": "GHSA-v245-v573-v5vm", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "linkify-it", "severity": "High", "summary": "linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text", "url": "https://github.com/advisories/GHSA-v245-v573-v5vm", "version": "5.0.0" }, { "aliases": [ "CVE-2026-42338" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-42338", "percentile": 0.40732, "score": 0.00471 }, "fix_state": "fixed", "fixed_in": [ "10.1.1" ], "id": "GHSA-v2v4-37r5-5v8g", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "ip-address", "severity": "Medium", "summary": "ip-address has XSS in Address6 HTML-emitting methods", "url": "https://github.com/advisories/GHSA-v2v4-37r5-5v8g", "version": "9.0.5" }, { "aliases": [ "CVE-2026-63376" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-63376", "percentile": 0.52554, "score": 0.00683 }, "fix_state": "fixed", "fixed_in": [ "4.1.2" ], "id": "GHSA-v5mp-jgw5-2x6j", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "toml", "severity": "High", "summary": "toml-node: Prototype Pollution Leads to `Object.prototype` Corruption via `__proto__` Key-Path Desynchronization", "url": "https://github.com/advisories/GHSA-v5mp-jgw5-2x6j", "version": "2.3.6" }, { "aliases": [ "CVE-2025-5889" ], "ecosystem": "npm", "epss": { "cve": "CVE-2025-5889", "percentile": 0.47999, "score": 0.00586 }, "fix_state": "fixed", "fixed_in": [ "2.0.2" ], "id": "GHSA-v6h2-p8h4-qcjw", "kev": null, "location": "actions/installer/package-lock.json", "osv_confirmed": true, "package": "brace-expansion", "severity": "Low", "summary": "brace-expansion Regular Expression Denial of Service vulnerability", "url": "https://github.com/advisories/GHSA-v6h2-p8h4-qcjw", "version": "2.0.1" }, { "aliases": [ "CVE-2026-111766" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-111766", "percentile": 0.37056, "score": 0.00428 }, "fix_state": "fixed", "fixed_in": [ "14.3.3" ], "id": "GHSA-vfgh-jcmw-g37q", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "markdown-it", "severity": "Low", "summary": "markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled", "url": "https://github.com/advisories/GHSA-vfgh-jcmw-g37q", "version": "14.1.0" }, { "aliases": [ "CVE-2025-59343" ], "ecosystem": "npm", "epss": { "cve": "CVE-2025-59343", "percentile": 0.46196, "score": 0.00553 }, "fix_state": "fixed", "fixed_in": [ "2.1.4" ], "id": "GHSA-vj76-c3g6-qr5v", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "tar-fs", "severity": "High", "summary": "tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball", "url": "https://github.com/advisories/GHSA-vj76-c3g6-qr5v", "version": "2.1.3" }, { "aliases": [ "CVE-2026-53655" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-53655", "percentile": 0.04762, "score": 0.00156 }, "fix_state": "fixed", "fixed_in": [ "7.5.16" ], "id": "GHSA-vmf3-w455-68vh", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "tar", "severity": "Medium", "summary": "node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)", "url": "https://github.com/advisories/GHSA-vmf3-w455-68vh", "version": "6.2.1" }, { "aliases": [ "CVE-2026-76845" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-76845", "percentile": 0.06437, "score": 0.00171 }, "fix_state": "not-fixed", "fixed_in": [], "id": "GHSA-vwc7-r8mq-g2x9", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "adm-zip", "severity": "Medium", "summary": "adm-zip extraction follows destination symlinks, allowing arbitrary file overwrite", "url": "https://github.com/advisories/GHSA-vwc7-r8mq-g2x9", "version": "0.5.12" }, { "aliases": [ "CVE-2026-41907" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-41907", "percentile": 0.28633, "score": 0.0035 }, "fix_state": "fixed", "fixed_in": [ "11.1.1" ], "id": "GHSA-w5hq-g745-h8pq", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "uuid", "severity": "Medium", "summary": "uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided", "url": "https://github.com/advisories/GHSA-w5hq-g745-h8pq", "version": "9.0.1" }, { "aliases": [ "CVE-2026-2391" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-2391", "percentile": 0.45582, "score": 0.00542 }, "fix_state": "fixed", "fixed_in": [ "6.14.2" ], "id": "GHSA-w7fw-mjwx-w883", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "qs", "severity": "Low", "summary": "qs's arrayLimit bypass in comma parsing allows denial of service", "url": "https://github.com/advisories/GHSA-w7fw-mjwx-w883", "version": "6.12.1" }, { "aliases": [ "CVE-2026-59871" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-59871", "percentile": 0.50871, "score": 0.00644 }, "fix_state": "fixed", "fixed_in": [ "7.5.18" ], "id": "GHSA-w8wr-v893-vjvp", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "tar", "severity": "Medium", "summary": "node-tar: Process crash via PAX numeric path type confusion", "url": "https://github.com/advisories/GHSA-w8wr-v893-vjvp", "version": "6.2.1" }, { "aliases": [ "CVE-2026-102828" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-102828", "percentile": 0.30932, "score": 0.0037 }, "fix_state": "fixed", "fixed_in": [ "4.0.1" ], "id": "GHSA-x6jw-m9v5-85vh", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "simple-git", "severity": "Critical", "summary": "simple-git unsafe-operation guard does not block trailer command configuration", "url": "https://github.com/advisories/GHSA-x6jw-m9v5-85vh", "version": "3.24.0" }, { "aliases": [ "CVE-2026-39244" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-39244", "percentile": 0.57898, "score": 0.00841 }, "fix_state": "fixed", "fixed_in": [ "0.6.0" ], "id": "GHSA-xcpc-8h2w-3j85", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "adm-zip", "severity": "High", "summary": "adm-zip: Crafted ZIP file triggers 4GB memory allocation", "url": "https://github.com/advisories/GHSA-xcpc-8h2w-3j85", "version": "0.5.12" }, { "aliases": [ "CVE-2026-33940" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-33940", "percentile": 0.5377, "score": 0.00715 }, "fix_state": "fixed", "fixed_in": [ "4.7.9" ], "id": "GHSA-xhpv-hc6g-r9c6", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "handlebars", "severity": "High", "summary": "Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial", "url": "https://github.com/advisories/GHSA-xhpv-hc6g-r9c6", "version": "4.7.8" }, { "aliases": [ "CVE-2026-33941" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-33941", "percentile": 0.22305, "score": 0.00296 }, "fix_state": "fixed", "fixed_in": [ "4.7.9" ], "id": "GHSA-xjpj-3mr7-gcpf", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "handlebars", "severity": "High", "summary": "Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options", "url": "https://github.com/advisories/GHSA-xjpj-3mr7-gcpf", "version": "4.7.8" }, { "aliases": [ "CVE-2026-106444" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-106444", "percentile": 0.21629, "score": 0.0029 }, "fix_state": "fixed", "fixed_in": [ "4.7.10" ], "id": "GHSA-xw65-4hp5-5hc7", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "handlebars", "severity": "Medium", "summary": "Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates", "url": "https://github.com/advisories/GHSA-xw65-4hp5-5hc7", "version": "4.7.8" }, { "aliases": [ "CVE-2026-73086" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-73086", "percentile": 0.2234, "score": 0.00296 }, "fix_state": "fixed", "fixed_in": [ "3.3.12" ], "id": "GHSA-xwg4-73v4-xw9w", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "nanoid", "severity": "High", "summary": "nanoid: Integer Overflow or Wraparound", "url": "https://github.com/advisories/GHSA-xwg4-73v4-xw9w", "version": "3.3.7" }, { "aliases": [ "CVE-2025-13465" ], "ecosystem": "npm", "epss": { "cve": "CVE-2025-13465", "percentile": 0.78784, "score": 0.01823 }, "fix_state": "fixed", "fixed_in": [ "4.17.23" ], "id": "GHSA-xxjr-mmjv-4gpg", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "lodash", "severity": "Medium", "summary": "Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions", "url": "https://github.com/advisories/GHSA-xxjr-mmjv-4gpg", "version": "4.17.21" } ], "previous_ref": "v2.7.1", "release_changed": false, "removed": [], "resolved_vulnerabilities": [], "upgraded": [], "workflow_new": 0, "workflow_resolved": 0 }, "commit": "ea584f4502babc6f60d9bc799dbbb13c1caa9ee6", "compliance": { "overall_score": 55, "standards": { "bsi_tr03183": { "failed_checks": [ "Component Creator", "Distribution Licences", "SHA-512 Hash", "Dependency Relationship", "SBOM Creator Contact" ], "passed": 4, "score": 44, "total": 9 }, "cisa": { "failed_checks": [ "Software Producer", "Dependency Relationship", "License Information", "Component Hash", "SBOM Author" ], "passed": 5, "score": 50, "total": 10 }, "ntia": { "failed_checks": [ "Supplier Name", "Dependency Relationship" ], "passed": 5, "score": 71, "total": 7 } } }, "components": [ { "ecosystem": "github", "licenses": [], "location": ".github/workflows/codeql-analysis.yml", "name": "actions/checkout", "purl": "pkg:github/actions/checkout@v4.2.2", "version": "v4.2.2" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/depsreview.yml", "name": "actions/dependency-review-action", "purl": "pkg:github/actions/dependency-review-action@v4.5.0", "version": "v4.5.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/e2e.schedule.cli.yml", "name": "actions/download-artifact", "purl": "pkg:github/actions/download-artifact@v4.1.8", "version": "v4.1.8" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/codeql-analysis.yml", "name": "actions/setup-go", "purl": "pkg:github/actions/setup-go@v5.3.0", "version": "v5.3.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/pre-submit.actions.yml", "name": "actions/setup-node", "purl": "pkg:github/actions/setup-node@v4.1.0", "version": "v4.1.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/pre-submit.actions.yml", "name": "actions/upload-artifact", "purl": "pkg:github/actions/upload-artifact@v4.6.0", "version": "v4.6.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/pre-submit.lfs.yml", "name": "actionsdesk/lfs-warning", "purl": "pkg:github/actionsdesk/lfs-warning@v3.3", "version": "v3.3" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/codeql-analysis.yml", "name": "github/codeql-action/analyze", "purl": "pkg:github/github/codeql-action@v3.28.1#analyze", "version": "v3.28.1" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/codeql-analysis.yml", "name": "github/codeql-action/autobuild", "purl": "pkg:github/github/codeql-action@v3.28.1#autobuild", "version": "v3.28.1" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/codeql-analysis.yml", "name": "github/codeql-action/init", "purl": "pkg:github/github/codeql-action@v3.28.1#init", "version": "v3.28.1" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/scorecards.yml", "name": "github/codeql-action/upload-sarif", "purl": "pkg:github/github/codeql-action@v3.28.1#upload-sarif", "version": "v3.28.1" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/pre-submit.lint.yml", "name": "golangci/golangci-lint-action", "purl": "pkg:github/golangci/golangci-lint-action@v6.2.0", "version": "v6.2.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/scorecards.yml", "name": "ossf/scorecard-action", "purl": "pkg:github/ossf/scorecard-action@v2.4.0", "version": "v2.4.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/release.yml", "name": "slsa-framework/slsa-github-generator/.github/workflows/builder_go_slsa3.yml", "purl": "pkg:github/slsa-framework/slsa-github-generator@v2.0.0#.github/workflows/builder_go_slsa3.yml", "version": "v2.0.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/release.yml", "name": "slsa-framework/slsa-verifier/actions/installer", "purl": "pkg:github/slsa-framework/slsa-verifier@v2.6.0#actions/installer", "version": "v2.6.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/pr-title.yml", "name": "thehanimo/pr-title-checker", "purl": "pkg:github/thehanimo/pr-title-checker@v1.4.3", "version": "v1.4.3" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/asaskevich/govalidator", "purl": "pkg:golang/github.com/asaskevich/govalidator@v0.0.0-20230301143203-a9d515a09cc2", "version": "v0.0.0-20230301143203-a9d515a09cc2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/blang/semver", "purl": "pkg:golang/github.com/blang/semver@v3.5.1%2Bincompatible", "version": "v3.5.1+incompatible" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/common-nighthawk/go-figure", "purl": "pkg:golang/github.com/common-nighthawk/go-figure@v0.0.0-20210622060536-734e95fb86be", "version": "v0.0.0-20210622060536-734e95fb86be" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/containerd/stargz-snapshotter/estargz", "purl": "pkg:golang/github.com/containerd/stargz-snapshotter/estargz@v0.16.3", "version": "v0.16.3" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/cyberphone/json-canonicalization", "purl": "pkg:golang/github.com/cyberphone/json-canonicalization@v0.0.0-20231011164504-785e29786b46", "version": "v0.0.0-20231011164504-785e29786b46" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/digitorus/pkcs7", "purl": "pkg:golang/github.com/digitorus/pkcs7@v0.0.0-20230818184609-3a137a874352", "version": "v0.0.0-20230818184609-3a137a874352" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/digitorus/timestamp", "purl": "pkg:golang/github.com/digitorus/timestamp@v0.0.0-20231217203849-220c5c2851b7", "version": "v0.0.0-20231217203849-220c5c2851b7" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/docker/cli", "purl": "pkg:golang/github.com/docker/cli@v27.5.0%2Bincompatible", "version": "v27.5.0+incompatible" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/docker/distribution", "purl": "pkg:golang/github.com/docker/distribution@v2.8.3%2Bincompatible", "version": "v2.8.3+incompatible" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/docker/docker-credential-helpers", "purl": "pkg:golang/github.com/docker/docker-credential-helpers@v0.8.2", "version": "v0.8.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/docker/go", "purl": "pkg:golang/github.com/docker/go@v1.5.1-1", "version": "v1.5.1-1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/dustin/go-humanize", "purl": "pkg:golang/github.com/dustin/go-humanize@v1.0.1", "version": "v1.0.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/fsnotify/fsnotify", "purl": "pkg:golang/github.com/fsnotify/fsnotify@v1.7.0", "version": "v1.7.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-chi/chi", "purl": "pkg:golang/github.com/go-chi/chi@v4.1.2%2Bincompatible", "version": "v4.1.2+incompatible" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-jose/go-jose/v4", "purl": "pkg:golang/github.com/go-jose/go-jose/v4@v4.0.5", "version": "v4.0.5" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-logr/logr", "purl": "pkg:golang/github.com/go-logr/logr@v1.4.2", "version": "v1.4.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-logr/stdr", "purl": "pkg:golang/github.com/go-logr/stdr@v1.2.2", "version": "v1.2.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-openapi/analysis", "purl": "pkg:golang/github.com/go-openapi/analysis@v0.23.0", "version": "v0.23.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-openapi/errors", "purl": "pkg:golang/github.com/go-openapi/errors@v0.22.0", "version": "v0.22.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-openapi/jsonpointer", "purl": "pkg:golang/github.com/go-openapi/jsonpointer@v0.21.0", "version": "v0.21.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-openapi/jsonreference", "purl": "pkg:golang/github.com/go-openapi/jsonreference@v0.21.0", "version": "v0.21.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-openapi/loads", "purl": "pkg:golang/github.com/go-openapi/loads@v0.22.0", "version": "v0.22.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-openapi/runtime", "purl": "pkg:golang/github.com/go-openapi/runtime@v0.28.0", "version": "v0.28.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-openapi/spec", "purl": "pkg:golang/github.com/go-openapi/spec@v0.21.0", "version": "v0.21.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-openapi/strfmt", "purl": "pkg:golang/github.com/go-openapi/strfmt@v0.23.0", "version": "v0.23.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-openapi/swag", "purl": "pkg:golang/github.com/go-openapi/swag@v0.23.0", "version": "v0.23.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-openapi/validate", "purl": "pkg:golang/github.com/go-openapi/validate@v0.24.0", "version": "v0.24.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/golang/snappy", "purl": "pkg:golang/github.com/golang/snappy@v0.0.4", "version": "v0.0.4" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/google/certificate-transparency-go", "purl": "pkg:golang/github.com/google/certificate-transparency-go@v1.2.1", "version": "v1.2.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/google/go-cmp", "purl": "pkg:golang/github.com/google/go-cmp@v0.6.0", "version": "v0.6.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/google/go-containerregistry", "purl": "pkg:golang/github.com/google/go-containerregistry@v0.20.3", "version": "v0.20.3" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/google/trillian", "purl": "pkg:golang/github.com/google/trillian@v1.7.1", "version": "v1.7.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/google/uuid", "purl": "pkg:golang/github.com/google/uuid@v1.6.0", "version": "v1.6.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/gorilla/mux", "purl": "pkg:golang/github.com/gorilla/mux@v1.8.1", "version": "v1.8.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/hashicorp/go-cleanhttp", "purl": "pkg:golang/github.com/hashicorp/go-cleanhttp@v0.5.2", "version": "v0.5.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/hashicorp/go-retryablehttp", "purl": "pkg:golang/github.com/hashicorp/go-retryablehttp@v0.7.7", "version": "v0.7.7" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/hashicorp/hcl", "purl": "pkg:golang/github.com/hashicorp/hcl@v1.0.1-vault-5", "version": "v1.0.1-vault-5" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/in-toto/attestation", "purl": "pkg:golang/github.com/in-toto/attestation@v1.1.0", "version": "v1.1.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/in-toto/in-toto-golang", "purl": "pkg:golang/github.com/in-toto/in-toto-golang@v0.9.0", "version": "v0.9.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/inconshreveable/mousetrap", "purl": "pkg:golang/github.com/inconshreveable/mousetrap@v1.1.0", "version": "v1.1.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/jedisct1/go-minisign", "purl": "pkg:golang/github.com/jedisct1/go-minisign@v0.0.0-20230811132847-661be99b8267", "version": "v0.0.0-20230811132847-661be99b8267" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/josharian/intern", "purl": "pkg:golang/github.com/josharian/intern@v1.0.0", "version": "v1.0.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/klauspost/compress", "purl": "pkg:golang/github.com/klauspost/compress@v1.17.11", "version": "v1.17.11" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/letsencrypt/boulder", "purl": "pkg:golang/github.com/letsencrypt/boulder@v0.0.0-20240620165639-de9c06129bec", "version": "v0.0.0-20240620165639-de9c06129bec" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/magiconair/properties", "purl": "pkg:golang/github.com/magiconair/properties@v1.8.7", "version": "v1.8.7" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/mailru/easyjson", "purl": "pkg:golang/github.com/mailru/easyjson@v0.7.7", "version": "v0.7.7" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/mitchellh/go-homedir", "purl": "pkg:golang/github.com/mitchellh/go-homedir@v1.1.0", "version": "v1.1.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/mitchellh/mapstructure", "purl": "pkg:golang/github.com/mitchellh/mapstructure@v1.5.0", "version": "v1.5.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/nozzle/throttler", "purl": "pkg:golang/github.com/nozzle/throttler@v0.0.0-20180817012639-2ea982251481", "version": "v0.0.0-20180817012639-2ea982251481" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/oklog/ulid", "purl": "pkg:golang/github.com/oklog/ulid@v1.3.1", "version": "v1.3.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/opencontainers/go-digest", "purl": "pkg:golang/github.com/opencontainers/go-digest@v1.0.0", "version": "v1.0.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/opencontainers/image-spec", "purl": "pkg:golang/github.com/opencontainers/image-spec@v1.1.0", "version": "v1.1.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/opentracing/opentracing-go", "purl": "pkg:golang/github.com/opentracing/opentracing-go@v1.2.0", "version": "v1.2.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/pelletier/go-toml/v2", "purl": "pkg:golang/github.com/pelletier/go-toml/v2@v2.2.2", "version": "v2.2.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/pkg/errors", "purl": "pkg:golang/github.com/pkg/errors@v0.9.1", "version": "v0.9.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/sagikazarmark/locafero", "purl": "pkg:golang/github.com/sagikazarmark/locafero@v0.4.0", "version": "v0.4.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/sagikazarmark/slog-shim", "purl": "pkg:golang/github.com/sagikazarmark/slog-shim@v0.1.0", "version": "v0.1.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/sassoftware/relic", "purl": "pkg:golang/github.com/sassoftware/relic@v7.2.1%2Bincompatible", "version": "v7.2.1+incompatible" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/secure-systems-lab/go-securesystemslib", "purl": "pkg:golang/github.com/secure-systems-lab/go-securesystemslib@v0.9.0", "version": "v0.9.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/shibumi/go-pathspec", "purl": "pkg:golang/github.com/shibumi/go-pathspec@v1.3.0", "version": "v1.3.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/sigstore/cosign/v2", "purl": "pkg:golang/github.com/sigstore/cosign/v2@v2.4.1", "version": "v2.4.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/sigstore/fulcio", "purl": "pkg:golang/github.com/sigstore/fulcio@v1.6.5", "version": "v1.6.5" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/sigstore/protobuf-specs", "purl": "pkg:golang/github.com/sigstore/protobuf-specs@v0.3.3", "version": "v0.3.3" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/sigstore/rekor", "purl": "pkg:golang/github.com/sigstore/rekor@v1.3.8", "version": "v1.3.8" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/sigstore/sigstore", "purl": "pkg:golang/github.com/sigstore/sigstore@v1.8.12", "version": "v1.8.12" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/sigstore/sigstore-go", "purl": "pkg:golang/github.com/sigstore/sigstore-go@v0.6.2", "version": "v0.6.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/sigstore/timestamp-authority", "purl": "pkg:golang/github.com/sigstore/timestamp-authority@v1.2.2", "version": "v1.2.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/sirupsen/logrus", "purl": "pkg:golang/github.com/sirupsen/logrus@v1.9.3", "version": "v1.9.3" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/slsa-framework/slsa-github-generator", "purl": "pkg:golang/github.com/slsa-framework/slsa-github-generator@v1.10.0", "version": "v1.10.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/sourcegraph/conc", "purl": "pkg:golang/github.com/sourcegraph/conc@v0.3.0", "version": "v0.3.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/spf13/afero", "purl": "pkg:golang/github.com/spf13/afero@v1.11.0", "version": "v1.11.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/spf13/cast", "purl": "pkg:golang/github.com/spf13/cast@v1.7.0", "version": "v1.7.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/spf13/cobra", "purl": "pkg:golang/github.com/spf13/cobra@v1.8.1", "version": "v1.8.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/spf13/pflag", "purl": "pkg:golang/github.com/spf13/pflag@v1.0.5", "version": "v1.0.5" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/spf13/viper", "purl": "pkg:golang/github.com/spf13/viper@v1.19.0", "version": "v1.19.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/subosito/gotenv", "purl": "pkg:golang/github.com/subosito/gotenv@v1.6.0", "version": "v1.6.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/syndtr/goleveldb", "purl": "pkg:golang/github.com/syndtr/goleveldb@v1.0.1-0.20220721030215-126854af5e6d", "version": "v1.0.1-0.20220721030215-126854af5e6d" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/theupdateframework/go-tuf", "purl": "pkg:golang/github.com/theupdateframework/go-tuf@v0.7.0", "version": "v0.7.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/theupdateframework/go-tuf/v2", "purl": "pkg:golang/github.com/theupdateframework/go-tuf/v2@v2.0.1", "version": "v2.0.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/titanous/rocacheck", "purl": "pkg:golang/github.com/titanous/rocacheck@v0.0.0-20171023193734-afe73141d399", "version": "v0.0.0-20171023193734-afe73141d399" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/transparency-dev/merkle", "purl": "pkg:golang/github.com/transparency-dev/merkle@v0.0.2", "version": "v0.0.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/vbatts/tar-split", "purl": "pkg:golang/github.com/vbatts/tar-split@v0.11.6", "version": "v0.11.6" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.mongodb.org/mongo-driver", "purl": "pkg:golang/go.mongodb.org/mongo-driver@v1.14.0", "version": "v1.14.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.opentelemetry.io/auto/sdk", "purl": "pkg:golang/go.opentelemetry.io/auto/sdk@v1.1.0", "version": "v1.1.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.opentelemetry.io/otel", "purl": "pkg:golang/go.opentelemetry.io/otel@v1.33.0", "version": "v1.33.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.opentelemetry.io/otel/metric", "purl": "pkg:golang/go.opentelemetry.io/otel/metric@v1.33.0", "version": "v1.33.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.opentelemetry.io/otel/trace", "purl": "pkg:golang/go.opentelemetry.io/otel/trace@v1.33.0", "version": "v1.33.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.uber.org/multierr", "purl": "pkg:golang/go.uber.org/multierr@v1.11.0", "version": "v1.11.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.uber.org/zap", "purl": "pkg:golang/go.uber.org/zap@v1.27.0", "version": "v1.27.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/crypto", "purl": "pkg:golang/golang.org/x/crypto@v0.36.0", "version": "v0.36.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/exp", "purl": "pkg:golang/golang.org/x/exp@v0.0.0-20250606033433-dcc06ee1d476", "version": "v0.0.0-20250606033433-dcc06ee1d476" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/mod", "purl": "pkg:golang/golang.org/x/mod@v0.25.0", "version": "v0.25.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/net", "purl": "pkg:golang/golang.org/x/net@v0.38.0", "version": "v0.38.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/sync", "purl": "pkg:golang/golang.org/x/sync@v0.15.0", "version": "v0.15.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/sys", "purl": "pkg:golang/golang.org/x/sys@v0.31.0", "version": "v0.31.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/term", "purl": "pkg:golang/golang.org/x/term@v0.30.0", "version": "v0.30.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/text", "purl": "pkg:golang/golang.org/x/text@v0.23.0", "version": "v0.23.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "google.golang.org/genproto/googleapis/api", "purl": "pkg:golang/google.golang.org/genproto/googleapis/api@v0.0.0-20241209162323-e6fa225c2576", "version": "v0.0.0-20241209162323-e6fa225c2576" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "google.golang.org/genproto/googleapis/rpc", "purl": "pkg:golang/google.golang.org/genproto/googleapis/rpc@v0.0.0-20250102185135-69823020774d", "version": "v0.0.0-20250102185135-69823020774d" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "google.golang.org/grpc", "purl": "pkg:golang/google.golang.org/grpc@v1.69.4", "version": "v1.69.4" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "google.golang.org/protobuf", "purl": "pkg:golang/google.golang.org/protobuf@v1.36.3", "version": "v1.36.3" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "gopkg.in/ini.v1", "purl": "pkg:golang/gopkg.in/ini.v1@v1.67.0", "version": "v1.67.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "gopkg.in/yaml.v3", "purl": "pkg:golang/gopkg.in/yaml.v3@v3.0.1", "version": "v3.0.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "k8s.io/klog/v2", "purl": "pkg:golang/k8s.io/klog/v2@v2.130.1", "version": "v2.130.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "sigs.k8s.io/release-utils", "purl": "pkg:golang/sigs.k8s.io/release-utils@v0.9.0", "version": "v0.9.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "sigs.k8s.io/yaml", "purl": "pkg:golang/sigs.k8s.io/yaml@v1.4.0", "version": "v1.4.0" }, { "ecosystem": "maven", "licenses": [], "location": "experimental/maven-plugin/pom.xml", "name": "maven-core", "purl": "pkg:maven/org.apache.maven/maven-core@3.9.9", "version": "3.9.9" }, { "ecosystem": "maven", "licenses": [], "location": "experimental/maven-plugin/pom.xml", "name": "maven-plugin-annotations", "purl": "pkg:maven/org.apache.maven.plugin-tools/maven-plugin-annotations@3.15.1", "version": "3.15.1" }, { "ecosystem": "maven", "licenses": [], "location": "experimental/maven-plugin/pom.xml", "name": "maven-plugin-api", "purl": "pkg:maven/org.apache.maven/maven-plugin-api@3.9.9", "version": "3.9.9" }, { "ecosystem": "maven", "licenses": [], "location": "experimental/maven-plugin/pom.xml", "name": "maven-project", "purl": "pkg:maven/org.apache.maven/maven-project@2.2.1", "version": "2.2.1" }, { "ecosystem": "maven", "licenses": [], "location": "experimental/maven-plugin/pom.xml", "name": "mojo-executor", "purl": "pkg:maven/org.twdata.maven/mojo-executor@2.4.0", "version": "2.4.0" }, { "ecosystem": "maven", "licenses": [], "location": "experimental/maven-plugin/pom.xml", "name": "slsa-verification-plugin", "purl": "pkg:maven/io.github.slsa-framework/slsa-verification-plugin@0.0.1", "version": "0.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "@aashutoshrathi/word-wrap", "purl": "pkg:npm/%40aashutoshrathi/word-wrap@1.2.6", "version": "1.2.6" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "@actions/core", "purl": "pkg:npm/%40actions/core@1.11.1", "version": "1.11.1" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "@actions/exec", "purl": "pkg:npm/%40actions/exec@1.1.1", "version": "1.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "@actions/github", "purl": "pkg:npm/%40actions/github@6.0.1", "version": "6.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "@actions/http-client", "purl": "pkg:npm/%40actions/http-client@2.2.1", "version": "2.2.1" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "@actions/io", "purl": "pkg:npm/%40actions/io@1.1.3", "version": "1.1.3" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "@actions/tool-cache", "purl": "pkg:npm/%40actions/tool-cache@2.0.2", "version": "2.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@arcanis/slice-ansi", "purl": "pkg:npm/%40arcanis/slice-ansi@1.1.1", "version": "1.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-crypto/crc32", "purl": "pkg:npm/%40aws-crypto/crc32@3.0.0", "version": "3.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-crypto/crc32c", "purl": "pkg:npm/%40aws-crypto/crc32c@3.0.0", "version": "3.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-crypto/ie11-detection", "purl": "pkg:npm/%40aws-crypto/ie11-detection@3.0.0", "version": "3.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-crypto/sha1-browser", "purl": "pkg:npm/%40aws-crypto/sha1-browser@3.0.0", "version": "3.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-crypto/sha256-browser", "purl": "pkg:npm/%40aws-crypto/sha256-browser@3.0.0", "version": "3.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-crypto/sha256-js", "purl": "pkg:npm/%40aws-crypto/sha256-js@3.0.0", "version": "3.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-crypto/supports-web-crypto", "purl": "pkg:npm/%40aws-crypto/supports-web-crypto@3.0.0", "version": "3.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-crypto/util", "purl": "pkg:npm/%40aws-crypto/util@3.0.0", "version": "3.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/client-codecommit", "purl": "pkg:npm/%40aws-sdk/client-codecommit@3.565.0", "version": "3.565.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/client-cognito-identity", "purl": "pkg:npm/%40aws-sdk/client-cognito-identity@3.565.0", "version": "3.565.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/client-ec2", "purl": "pkg:npm/%40aws-sdk/client-ec2@3.565.0", "version": "3.565.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/client-ecr", "purl": "pkg:npm/%40aws-sdk/client-ecr@3.565.0", "version": "3.565.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/client-rds", "purl": "pkg:npm/%40aws-sdk/client-rds@3.565.0", "version": "3.565.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/client-s3", "purl": "pkg:npm/%40aws-sdk/client-s3@3.565.0", "version": "3.565.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/client-sso", "purl": "pkg:npm/%40aws-sdk/client-sso@3.556.0", "version": "3.556.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/client-sso", "purl": "pkg:npm/%40aws-sdk/client-sso@3.575.0", "version": "3.575.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/client-sso", "purl": "pkg:npm/%40aws-sdk/client-sso@3.576.0", "version": "3.576.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/client-sso-oidc", "purl": "pkg:npm/%40aws-sdk/client-sso-oidc@3.575.0", "version": "3.575.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/client-sso-oidc", "purl": "pkg:npm/%40aws-sdk/client-sso-oidc@3.576.0", "version": "3.576.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/client-sts", "purl": "pkg:npm/%40aws-sdk/client-sts@3.565.0", "version": "3.565.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/client-sts", "purl": "pkg:npm/%40aws-sdk/client-sts@3.575.0", "version": "3.575.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/client-sts", "purl": "pkg:npm/%40aws-sdk/client-sts@3.576.0", "version": "3.576.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/core", "purl": "pkg:npm/%40aws-sdk/core@3.556.0", "version": "3.556.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/core", "purl": "pkg:npm/%40aws-sdk/core@3.575.0", "version": "3.575.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/core", "purl": "pkg:npm/%40aws-sdk/core@3.576.0", "version": "3.576.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/credential-provider-cognito-identity", "purl": "pkg:npm/%40aws-sdk/credential-provider-cognito-identity@3.565.0", "version": "3.565.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/credential-provider-env", "purl": "pkg:npm/%40aws-sdk/credential-provider-env@3.535.0", "version": "3.535.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/credential-provider-env", "purl": "pkg:npm/%40aws-sdk/credential-provider-env@3.575.0", "version": "3.575.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/credential-provider-http", "purl": "pkg:npm/%40aws-sdk/credential-provider-http@3.552.0", "version": "3.552.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/credential-provider-http", "purl": "pkg:npm/%40aws-sdk/credential-provider-http@3.575.0", "version": "3.575.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/credential-provider-ini", "purl": "pkg:npm/%40aws-sdk/credential-provider-ini@3.565.0", "version": "3.565.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/credential-provider-ini", "purl": "pkg:npm/%40aws-sdk/credential-provider-ini@3.575.0", "version": "3.575.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/credential-provider-ini", "purl": "pkg:npm/%40aws-sdk/credential-provider-ini@3.576.0", "version": "3.576.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/credential-provider-node", "purl": "pkg:npm/%40aws-sdk/credential-provider-node@3.565.0", "version": "3.565.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/credential-provider-node", "purl": "pkg:npm/%40aws-sdk/credential-provider-node@3.575.0", "version": "3.575.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/credential-provider-node", "purl": "pkg:npm/%40aws-sdk/credential-provider-node@3.576.0", "version": "3.576.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/credential-provider-process", "purl": "pkg:npm/%40aws-sdk/credential-provider-process@3.535.0", "version": "3.535.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/credential-provider-process", "purl": "pkg:npm/%40aws-sdk/credential-provider-process@3.575.0", "version": "3.575.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/credential-provider-sso", "purl": "pkg:npm/%40aws-sdk/credential-provider-sso@3.565.0", "version": "3.565.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/credential-provider-sso", "purl": "pkg:npm/%40aws-sdk/credential-provider-sso@3.575.0", "version": "3.575.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/credential-provider-sso", "purl": "pkg:npm/%40aws-sdk/credential-provider-sso@3.576.0", "version": "3.576.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/credential-provider-web-identity", "purl": "pkg:npm/%40aws-sdk/credential-provider-web-identity@3.565.0", "version": "3.565.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/credential-provider-web-identity", "purl": "pkg:npm/%40aws-sdk/credential-provider-web-identity@3.575.0", "version": "3.575.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/credential-providers", "purl": "pkg:npm/%40aws-sdk/credential-providers@3.565.0", "version": "3.565.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/middleware-bucket-endpoint", "purl": "pkg:npm/%40aws-sdk/middleware-bucket-endpoint@3.535.0", "version": "3.535.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/middleware-expect-continue", "purl": "pkg:npm/%40aws-sdk/middleware-expect-continue@3.535.0", "version": "3.535.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/middleware-flexible-checksums", "purl": "pkg:npm/%40aws-sdk/middleware-flexible-checksums@3.535.0", "version": "3.535.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/middleware-host-header", "purl": "pkg:npm/%40aws-sdk/middleware-host-header@3.535.0", "version": "3.535.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/middleware-host-header", "purl": "pkg:npm/%40aws-sdk/middleware-host-header@3.575.0", "version": "3.575.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/middleware-location-constraint", "purl": "pkg:npm/%40aws-sdk/middleware-location-constraint@3.535.0", "version": "3.535.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/middleware-logger", "purl": "pkg:npm/%40aws-sdk/middleware-logger@3.535.0", "version": "3.535.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/middleware-logger", "purl": "pkg:npm/%40aws-sdk/middleware-logger@3.575.0", "version": "3.575.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/middleware-recursion-detection", "purl": "pkg:npm/%40aws-sdk/middleware-recursion-detection@3.535.0", "version": "3.535.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/middleware-recursion-detection", "purl": "pkg:npm/%40aws-sdk/middleware-recursion-detection@3.575.0", "version": "3.575.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/middleware-sdk-ec2", "purl": "pkg:npm/%40aws-sdk/middleware-sdk-ec2@3.556.0", "version": "3.556.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/middleware-sdk-rds", "purl": "pkg:npm/%40aws-sdk/middleware-sdk-rds@3.556.0", "version": "3.556.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/middleware-sdk-s3", "purl": "pkg:npm/%40aws-sdk/middleware-sdk-s3@3.556.0", "version": "3.556.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/middleware-signing", "purl": "pkg:npm/%40aws-sdk/middleware-signing@3.556.0", "version": "3.556.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/middleware-ssec", "purl": "pkg:npm/%40aws-sdk/middleware-ssec@3.537.0", "version": "3.537.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/middleware-user-agent", "purl": "pkg:npm/%40aws-sdk/middleware-user-agent@3.540.0", "version": "3.540.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/middleware-user-agent", "purl": "pkg:npm/%40aws-sdk/middleware-user-agent@3.575.0", "version": "3.575.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/region-config-resolver", "purl": "pkg:npm/%40aws-sdk/region-config-resolver@3.535.0", "version": "3.535.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/region-config-resolver", "purl": "pkg:npm/%40aws-sdk/region-config-resolver@3.575.0", "version": "3.575.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/signature-v4-multi-region", "purl": "pkg:npm/%40aws-sdk/signature-v4-multi-region@3.556.0", "version": "3.556.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/token-providers", "purl": "pkg:npm/%40aws-sdk/token-providers@3.565.0", "version": "3.565.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/token-providers", "purl": "pkg:npm/%40aws-sdk/token-providers@3.575.0", "version": "3.575.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/types", "purl": "pkg:npm/%40aws-sdk/types@3.535.0", "version": "3.535.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/types", "purl": "pkg:npm/%40aws-sdk/types@3.575.0", "version": "3.575.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/util-arn-parser", "purl": "pkg:npm/%40aws-sdk/util-arn-parser@3.535.0", "version": "3.535.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/util-endpoints", "purl": "pkg:npm/%40aws-sdk/util-endpoints@3.540.0", "version": "3.540.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/util-endpoints", "purl": "pkg:npm/%40aws-sdk/util-endpoints@3.575.0", "version": "3.575.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/util-format-url", "purl": "pkg:npm/%40aws-sdk/util-format-url@3.535.0", "version": "3.535.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/util-locate-window", "purl": "pkg:npm/%40aws-sdk/util-locate-window@3.568.0", "version": "3.568.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/util-user-agent-browser", "purl": "pkg:npm/%40aws-sdk/util-user-agent-browser@3.535.0", "version": "3.535.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/util-user-agent-browser", "purl": "pkg:npm/%40aws-sdk/util-user-agent-browser@3.575.0", "version": "3.575.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/util-user-agent-node", "purl": "pkg:npm/%40aws-sdk/util-user-agent-node@3.535.0", "version": "3.535.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/util-user-agent-node", "purl": "pkg:npm/%40aws-sdk/util-user-agent-node@3.575.0", "version": "3.575.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/util-utf8-browser", "purl": "pkg:npm/%40aws-sdk/util-utf8-browser@3.259.0", "version": "3.259.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@aws-sdk/xml-builder", "purl": "pkg:npm/%40aws-sdk/xml-builder@3.535.0", "version": "3.535.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@babel/code-frame", "purl": "pkg:npm/%40babel/code-frame@7.24.2", "version": "7.24.2" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@babel/helper-validator-identifier", "purl": "pkg:npm/%40babel/helper-validator-identifier@7.24.5", "version": "7.24.5" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@babel/highlight", "purl": "pkg:npm/%40babel/highlight@7.24.5", "version": "7.24.5" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "@babel/runtime", "purl": "pkg:npm/%40babel/runtime@7.21.0", "version": "7.21.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@babel/runtime-corejs3", "purl": "pkg:npm/%40babel/runtime-corejs3@7.24.5", "version": "7.24.5" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@breejs/later", "purl": "pkg:npm/%40breejs/later@4.2.0", "version": "4.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@cdktf/hcl2json", "purl": "pkg:npm/%40cdktf/hcl2json@0.20.7", "version": "0.20.7" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "@eslint-community/eslint-utils", "purl": "pkg:npm/%40eslint-community/eslint-utils@4.4.0", "version": "4.4.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "@eslint-community/regexpp", "purl": "pkg:npm/%40eslint-community/regexpp@4.10.0", "version": "4.10.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "@eslint/eslintrc", "purl": "pkg:npm/%40eslint/eslintrc@2.1.4", "version": "2.1.4" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "@eslint/js", "purl": "pkg:npm/%40eslint/js@8.57.0", "version": "8.57.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "@fastify/busboy", "purl": "pkg:npm/%40fastify/busboy@2.1.1", "version": "2.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "@github/browserslist-config", "purl": "pkg:npm/%40github/browserslist-config@1.0.0", "version": "1.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@gwhitney/detect-indent", "purl": "pkg:npm/%40gwhitney/detect-indent@7.0.1", "version": "7.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "@humanwhocodes/config-array", "purl": "pkg:npm/%40humanwhocodes/config-array@0.11.14", "version": "0.11.14" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "@humanwhocodes/module-importer", "purl": "pkg:npm/%40humanwhocodes/module-importer@1.0.1", "version": "1.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "@humanwhocodes/object-schema", "purl": "pkg:npm/%40humanwhocodes/object-schema@2.0.3", "version": "2.0.3" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "@isaacs/cliui", "purl": "pkg:npm/%40isaacs/cliui@8.0.2", "version": "8.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@kwsites/file-exists", "purl": "pkg:npm/%40kwsites/file-exists@1.1.1", "version": "1.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@kwsites/promise-deferred", "purl": "pkg:npm/%40kwsites/promise-deferred@1.1.1", "version": "1.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "@nodelib/fs.scandir", "purl": "pkg:npm/%40nodelib/fs.scandir@2.1.5", "version": "2.1.5" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "@nodelib/fs.stat", "purl": "pkg:npm/%40nodelib/fs.stat@2.0.5", "version": "2.0.5" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "@nodelib/fs.walk", "purl": "pkg:npm/%40nodelib/fs.walk@1.2.8", "version": "1.2.8" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@npmcli/agent", "purl": "pkg:npm/%40npmcli/agent@2.2.2", "version": "2.2.2" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@npmcli/fs", "purl": "pkg:npm/%40npmcli/fs@3.1.1", "version": "3.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "@octokit/auth-token", "purl": "pkg:npm/%40octokit/auth-token@4.0.0", "version": "4.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "@octokit/core", "purl": "pkg:npm/%40octokit/core@5.1.0", "version": "5.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@octokit/core", "purl": "pkg:npm/%40octokit/core@5.2.0", "version": "5.2.0" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "actions/installer/package-lock.json", "name": "@octokit/endpoint", "purl": "pkg:npm/%40octokit/endpoint@9.0.6", "version": "9.0.6" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "@octokit/graphql", "purl": "pkg:npm/%40octokit/graphql@7.0.2", "version": "7.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@octokit/graphql", "purl": "pkg:npm/%40octokit/graphql@7.1.0", "version": "7.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "@octokit/openapi-types", "purl": "pkg:npm/%40octokit/openapi-types@20.0.0", "version": "20.0.0" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "actions/installer/package-lock.json", "name": "@octokit/openapi-types", "purl": "pkg:npm/%40octokit/openapi-types@23.0.1", "version": "23.0.1" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "actions/installer/package-lock.json", "name": "@octokit/openapi-types", "purl": "pkg:npm/%40octokit/openapi-types@24.2.0", "version": "24.2.0" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "package-lock.json", "name": "@octokit/plugin-paginate-rest", "purl": "pkg:npm/%40octokit/plugin-paginate-rest@11.4.4-cjs.2", "version": "11.4.4-cjs.2" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "@octokit/plugin-paginate-rest", "purl": "pkg:npm/%40octokit/plugin-paginate-rest@9.2.2", "version": "9.2.2" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@octokit/plugin-request-log", "purl": "pkg:npm/%40octokit/plugin-request-log@4.0.1", "version": "4.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "@octokit/plugin-rest-endpoint-methods", "purl": "pkg:npm/%40octokit/plugin-rest-endpoint-methods@10.4.1", "version": "10.4.1" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "package-lock.json", "name": "@octokit/plugin-rest-endpoint-methods", "purl": "pkg:npm/%40octokit/plugin-rest-endpoint-methods@13.3.2-cjs.1", "version": "13.3.2-cjs.1" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "actions/installer/package-lock.json", "name": "@octokit/request", "purl": "pkg:npm/%40octokit/request@8.4.1", "version": "8.4.1" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "actions/installer/package-lock.json", "name": "@octokit/request-error", "purl": "pkg:npm/%40octokit/request-error@5.1.1", "version": "5.1.1" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "package-lock.json", "name": "@octokit/rest", "purl": "pkg:npm/%40octokit/rest@20.1.2", "version": "20.1.2" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "@octokit/types", "purl": "pkg:npm/%40octokit/types@12.6.0", "version": "12.6.0" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "actions/installer/package-lock.json", "name": "@octokit/types", "purl": "pkg:npm/%40octokit/types@13.10.0", "version": "13.10.0" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "actions/installer/package-lock.json", "name": "@octokit/types", "purl": "pkg:npm/%40octokit/types@13.8.0", "version": "13.8.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@one-ini/wasm", "purl": "pkg:npm/%40one-ini/wasm@0.1.1", "version": "0.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@opentelemetry/api", "purl": "pkg:npm/%40opentelemetry/api@1.8.0", "version": "1.8.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@opentelemetry/api-logs", "purl": "pkg:npm/%40opentelemetry/api-logs@0.51.1", "version": "0.51.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@opentelemetry/context-async-hooks", "purl": "pkg:npm/%40opentelemetry/context-async-hooks@1.24.1", "version": "1.24.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@opentelemetry/core", "purl": "pkg:npm/%40opentelemetry/core@1.24.1", "version": "1.24.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@opentelemetry/exporter-trace-otlp-http", "purl": "pkg:npm/%40opentelemetry/exporter-trace-otlp-http@0.51.1", "version": "0.51.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@opentelemetry/instrumentation", "purl": "pkg:npm/%40opentelemetry/instrumentation@0.51.1", "version": "0.51.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@opentelemetry/instrumentation-bunyan", "purl": "pkg:npm/%40opentelemetry/instrumentation-bunyan@0.38.0", "version": "0.38.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@opentelemetry/instrumentation-http", "purl": "pkg:npm/%40opentelemetry/instrumentation-http@0.51.1", "version": "0.51.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@opentelemetry/otlp-exporter-base", "purl": "pkg:npm/%40opentelemetry/otlp-exporter-base@0.51.1", "version": "0.51.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@opentelemetry/otlp-transformer", "purl": "pkg:npm/%40opentelemetry/otlp-transformer@0.51.1", "version": "0.51.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@opentelemetry/propagator-b3", "purl": "pkg:npm/%40opentelemetry/propagator-b3@1.24.1", "version": "1.24.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@opentelemetry/propagator-jaeger", "purl": "pkg:npm/%40opentelemetry/propagator-jaeger@1.24.1", "version": "1.24.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@opentelemetry/resources", "purl": "pkg:npm/%40opentelemetry/resources@1.24.1", "version": "1.24.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@opentelemetry/sdk-logs", "purl": "pkg:npm/%40opentelemetry/sdk-logs@0.51.1", "version": "0.51.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@opentelemetry/sdk-metrics", "purl": "pkg:npm/%40opentelemetry/sdk-metrics@1.24.1", "version": "1.24.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@opentelemetry/sdk-trace-base", "purl": "pkg:npm/%40opentelemetry/sdk-trace-base@1.24.1", "version": "1.24.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@opentelemetry/sdk-trace-node", "purl": "pkg:npm/%40opentelemetry/sdk-trace-node@1.24.1", "version": "1.24.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@opentelemetry/semantic-conventions", "purl": "pkg:npm/%40opentelemetry/semantic-conventions@1.24.1", "version": "1.24.1" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "@pkgjs/parseargs", "purl": "pkg:npm/%40pkgjs/parseargs@0.11.0", "version": "0.11.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "@pkgr/core", "purl": "pkg:npm/%40pkgr/core@0.1.1", "version": "0.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@pnpm/constants", "purl": "pkg:npm/%40pnpm/constants@6.1.0", "version": "6.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@pnpm/error", "purl": "pkg:npm/%40pnpm/error@4.0.0", "version": "4.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@pnpm/graceful-fs", "purl": "pkg:npm/%40pnpm/graceful-fs@2.0.0", "version": "2.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@pnpm/read-project-manifest", "purl": "pkg:npm/%40pnpm/read-project-manifest@4.1.1", "version": "4.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@pnpm/text.comments-parser", "purl": "pkg:npm/%40pnpm/text.comments-parser@1.0.0", "version": "1.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@pnpm/types", "purl": "pkg:npm/%40pnpm/types@8.9.0", "version": "8.9.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@pnpm/util.lex-comparator", "purl": "pkg:npm/%40pnpm/util.lex-comparator@1.0.0", "version": "1.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@pnpm/write-project-manifest", "purl": "pkg:npm/%40pnpm/write-project-manifest@4.1.1", "version": "4.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@qnighy/marshal", "purl": "pkg:npm/%40qnighy/marshal@0.1.3", "version": "0.1.3" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@redis/bloom", "purl": "pkg:npm/%40redis/bloom@1.2.0", "version": "1.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@redis/client", "purl": "pkg:npm/%40redis/client@1.5.14", "version": "1.5.14" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@redis/graph", "purl": "pkg:npm/%40redis/graph@1.1.1", "version": "1.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@redis/json", "purl": "pkg:npm/%40redis/json@1.0.6", "version": "1.0.6" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@redis/search", "purl": "pkg:npm/%40redis/search@1.1.6", "version": "1.1.6" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@redis/time-series", "purl": "pkg:npm/%40redis/time-series@1.0.5", "version": "1.0.5" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@renovatebot/kbpgp", "purl": "pkg:npm/%40renovatebot/kbpgp@3.0.1", "version": "3.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@renovatebot/osv-offline", "purl": "pkg:npm/%40renovatebot/osv-offline@1.5.5", "version": "1.5.5" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@renovatebot/osv-offline-db", "purl": "pkg:npm/%40renovatebot/osv-offline-db@1.6.0", "version": "1.6.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@renovatebot/pep440", "purl": "pkg:npm/%40renovatebot/pep440@3.0.20", "version": "3.0.20" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@renovatebot/ruby-semver", "purl": "pkg:npm/%40renovatebot/ruby-semver@3.0.23", "version": "3.0.23" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@seald-io/binary-search-tree", "purl": "pkg:npm/%40seald-io/binary-search-tree@1.0.3", "version": "1.0.3" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@seald-io/nedb", "purl": "pkg:npm/%40seald-io/nedb@4.0.4", "version": "4.0.4" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@sindresorhus/is", "purl": "pkg:npm/%40sindresorhus/is@4.6.0", "version": "4.6.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/abort-controller", "purl": "pkg:npm/%40smithy/abort-controller@2.2.0", "version": "2.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/abort-controller", "purl": "pkg:npm/%40smithy/abort-controller@3.0.0", "version": "3.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/chunked-blob-reader", "purl": "pkg:npm/%40smithy/chunked-blob-reader@2.2.0", "version": "2.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/chunked-blob-reader-native", "purl": "pkg:npm/%40smithy/chunked-blob-reader-native@2.2.0", "version": "2.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/config-resolver", "purl": "pkg:npm/%40smithy/config-resolver@2.2.0", "version": "2.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/config-resolver", "purl": "pkg:npm/%40smithy/config-resolver@3.0.0", "version": "3.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/core", "purl": "pkg:npm/%40smithy/core@1.4.2", "version": "1.4.2" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/core", "purl": "pkg:npm/%40smithy/core@2.0.1", "version": "2.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/credential-provider-imds", "purl": "pkg:npm/%40smithy/credential-provider-imds@2.3.0", "version": "2.3.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/credential-provider-imds", "purl": "pkg:npm/%40smithy/credential-provider-imds@3.0.0", "version": "3.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/eventstream-codec", "purl": "pkg:npm/%40smithy/eventstream-codec@2.2.0", "version": "2.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/eventstream-serde-browser", "purl": "pkg:npm/%40smithy/eventstream-serde-browser@2.2.0", "version": "2.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/eventstream-serde-config-resolver", "purl": "pkg:npm/%40smithy/eventstream-serde-config-resolver@2.2.0", "version": "2.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/eventstream-serde-node", "purl": "pkg:npm/%40smithy/eventstream-serde-node@2.2.0", "version": "2.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/eventstream-serde-universal", "purl": "pkg:npm/%40smithy/eventstream-serde-universal@2.2.0", "version": "2.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/fetch-http-handler", "purl": "pkg:npm/%40smithy/fetch-http-handler@2.5.0", "version": "2.5.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/fetch-http-handler", "purl": "pkg:npm/%40smithy/fetch-http-handler@3.0.1", "version": "3.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/hash-blob-browser", "purl": "pkg:npm/%40smithy/hash-blob-browser@2.2.0", "version": "2.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/hash-node", "purl": "pkg:npm/%40smithy/hash-node@2.2.0", "version": "2.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/hash-node", "purl": "pkg:npm/%40smithy/hash-node@3.0.0", "version": "3.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/hash-stream-node", "purl": "pkg:npm/%40smithy/hash-stream-node@2.2.0", "version": "2.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/invalid-dependency", "purl": "pkg:npm/%40smithy/invalid-dependency@2.2.0", "version": "2.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/invalid-dependency", "purl": "pkg:npm/%40smithy/invalid-dependency@3.0.0", "version": "3.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/is-array-buffer", "purl": "pkg:npm/%40smithy/is-array-buffer@2.2.0", "version": "2.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/is-array-buffer", "purl": "pkg:npm/%40smithy/is-array-buffer@3.0.0", "version": "3.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/md5-js", "purl": "pkg:npm/%40smithy/md5-js@2.2.0", "version": "2.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/middleware-content-length", "purl": "pkg:npm/%40smithy/middleware-content-length@2.2.0", "version": "2.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/middleware-content-length", "purl": "pkg:npm/%40smithy/middleware-content-length@3.0.0", "version": "3.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/middleware-endpoint", "purl": "pkg:npm/%40smithy/middleware-endpoint@2.5.1", "version": "2.5.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/middleware-endpoint", "purl": "pkg:npm/%40smithy/middleware-endpoint@3.0.0", "version": "3.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/middleware-retry", "purl": "pkg:npm/%40smithy/middleware-retry@2.3.1", "version": "2.3.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/middleware-retry", "purl": "pkg:npm/%40smithy/middleware-retry@3.0.1", "version": "3.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/middleware-serde", "purl": "pkg:npm/%40smithy/middleware-serde@2.3.0", "version": "2.3.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/middleware-serde", "purl": "pkg:npm/%40smithy/middleware-serde@3.0.0", "version": "3.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/middleware-stack", "purl": "pkg:npm/%40smithy/middleware-stack@2.2.0", "version": "2.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/middleware-stack", "purl": "pkg:npm/%40smithy/middleware-stack@3.0.0", "version": "3.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/node-config-provider", "purl": "pkg:npm/%40smithy/node-config-provider@2.3.0", "version": "2.3.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/node-config-provider", "purl": "pkg:npm/%40smithy/node-config-provider@3.0.0", "version": "3.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/node-http-handler", "purl": "pkg:npm/%40smithy/node-http-handler@2.5.0", "version": "2.5.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/node-http-handler", "purl": "pkg:npm/%40smithy/node-http-handler@3.0.0", "version": "3.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/property-provider", "purl": "pkg:npm/%40smithy/property-provider@2.2.0", "version": "2.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/property-provider", "purl": "pkg:npm/%40smithy/property-provider@3.0.0", "version": "3.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/protocol-http", "purl": "pkg:npm/%40smithy/protocol-http@3.3.0", "version": "3.3.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/protocol-http", "purl": "pkg:npm/%40smithy/protocol-http@4.0.0", "version": "4.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/querystring-builder", "purl": "pkg:npm/%40smithy/querystring-builder@2.2.0", "version": "2.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/querystring-builder", "purl": "pkg:npm/%40smithy/querystring-builder@3.0.0", "version": "3.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/querystring-parser", "purl": "pkg:npm/%40smithy/querystring-parser@2.2.0", "version": "2.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/querystring-parser", "purl": "pkg:npm/%40smithy/querystring-parser@3.0.0", "version": "3.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/service-error-classification", "purl": "pkg:npm/%40smithy/service-error-classification@2.1.5", "version": "2.1.5" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/service-error-classification", "purl": "pkg:npm/%40smithy/service-error-classification@3.0.0", "version": "3.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/shared-ini-file-loader", "purl": "pkg:npm/%40smithy/shared-ini-file-loader@2.4.0", "version": "2.4.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/shared-ini-file-loader", "purl": "pkg:npm/%40smithy/shared-ini-file-loader@3.0.0", "version": "3.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/signature-v4", "purl": "pkg:npm/%40smithy/signature-v4@2.3.0", "version": "2.3.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/signature-v4", "purl": "pkg:npm/%40smithy/signature-v4@3.0.0", "version": "3.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/smithy-client", "purl": "pkg:npm/%40smithy/smithy-client@2.5.1", "version": "2.5.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/smithy-client", "purl": "pkg:npm/%40smithy/smithy-client@3.0.1", "version": "3.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/types", "purl": "pkg:npm/%40smithy/types@2.12.0", "version": "2.12.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/types", "purl": "pkg:npm/%40smithy/types@3.0.0", "version": "3.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/url-parser", "purl": "pkg:npm/%40smithy/url-parser@2.2.0", "version": "2.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/url-parser", "purl": "pkg:npm/%40smithy/url-parser@3.0.0", "version": "3.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/util-base64", "purl": "pkg:npm/%40smithy/util-base64@2.3.0", "version": "2.3.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/util-base64", "purl": "pkg:npm/%40smithy/util-base64@3.0.0", "version": "3.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/util-body-length-browser", "purl": "pkg:npm/%40smithy/util-body-length-browser@2.2.0", "version": "2.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/util-body-length-browser", "purl": "pkg:npm/%40smithy/util-body-length-browser@3.0.0", "version": "3.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/util-body-length-node", "purl": "pkg:npm/%40smithy/util-body-length-node@2.3.0", "version": "2.3.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/util-body-length-node", "purl": "pkg:npm/%40smithy/util-body-length-node@3.0.0", "version": "3.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/util-buffer-from", "purl": "pkg:npm/%40smithy/util-buffer-from@2.2.0", "version": "2.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/util-buffer-from", "purl": "pkg:npm/%40smithy/util-buffer-from@3.0.0", "version": "3.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/util-config-provider", "purl": "pkg:npm/%40smithy/util-config-provider@2.3.0", "version": "2.3.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/util-config-provider", "purl": "pkg:npm/%40smithy/util-config-provider@3.0.0", "version": "3.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/util-defaults-mode-browser", "purl": "pkg:npm/%40smithy/util-defaults-mode-browser@2.2.1", "version": "2.2.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/util-defaults-mode-browser", "purl": "pkg:npm/%40smithy/util-defaults-mode-browser@3.0.1", "version": "3.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/util-defaults-mode-node", "purl": "pkg:npm/%40smithy/util-defaults-mode-node@2.3.1", "version": "2.3.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/util-defaults-mode-node", "purl": "pkg:npm/%40smithy/util-defaults-mode-node@3.0.1", "version": "3.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/util-endpoints", "purl": "pkg:npm/%40smithy/util-endpoints@1.2.0", "version": "1.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/util-endpoints", "purl": "pkg:npm/%40smithy/util-endpoints@2.0.0", "version": "2.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/util-hex-encoding", "purl": "pkg:npm/%40smithy/util-hex-encoding@2.2.0", "version": "2.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/util-hex-encoding", "purl": "pkg:npm/%40smithy/util-hex-encoding@3.0.0", "version": "3.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/util-middleware", "purl": "pkg:npm/%40smithy/util-middleware@2.2.0", "version": "2.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/util-middleware", "purl": "pkg:npm/%40smithy/util-middleware@3.0.0", "version": "3.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/util-retry", "purl": "pkg:npm/%40smithy/util-retry@2.2.0", "version": "2.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/util-retry", "purl": "pkg:npm/%40smithy/util-retry@3.0.0", "version": "3.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/util-stream", "purl": "pkg:npm/%40smithy/util-stream@2.2.0", "version": "2.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/util-stream", "purl": "pkg:npm/%40smithy/util-stream@3.0.1", "version": "3.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/util-uri-escape", "purl": "pkg:npm/%40smithy/util-uri-escape@2.2.0", "version": "2.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/util-uri-escape", "purl": "pkg:npm/%40smithy/util-uri-escape@3.0.0", "version": "3.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/util-utf8", "purl": "pkg:npm/%40smithy/util-utf8@2.3.0", "version": "2.3.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/util-utf8", "purl": "pkg:npm/%40smithy/util-utf8@3.0.0", "version": "3.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@smithy/util-waiter", "purl": "pkg:npm/%40smithy/util-waiter@2.2.0", "version": "2.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@szmarczak/http-timer", "purl": "pkg:npm/%40szmarczak/http-timer@4.0.6", "version": "4.0.6" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@thi.ng/api", "purl": "pkg:npm/%40thi.ng/api@7.2.0", "version": "7.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@thi.ng/arrays", "purl": "pkg:npm/%40thi.ng/arrays@1.0.3", "version": "1.0.3" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@thi.ng/checks", "purl": "pkg:npm/%40thi.ng/checks@2.9.11", "version": "2.9.11" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@thi.ng/compare", "purl": "pkg:npm/%40thi.ng/compare@1.3.34", "version": "1.3.34" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@thi.ng/equiv", "purl": "pkg:npm/%40thi.ng/equiv@1.0.45", "version": "1.0.45" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@thi.ng/errors", "purl": "pkg:npm/%40thi.ng/errors@1.3.4", "version": "1.3.4" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@thi.ng/hex", "purl": "pkg:npm/%40thi.ng/hex@1.0.4", "version": "1.0.4" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@thi.ng/random", "purl": "pkg:npm/%40thi.ng/random@2.4.8", "version": "2.4.8" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@thi.ng/zipper", "purl": "pkg:npm/%40thi.ng/zipper@1.0.3", "version": "1.0.3" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@types/bunyan", "purl": "pkg:npm/%40types/bunyan@1.8.9", "version": "1.8.9" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@types/cacheable-request", "purl": "pkg:npm/%40types/cacheable-request@6.0.3", "version": "6.0.3" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@types/emscripten", "purl": "pkg:npm/%40types/emscripten@1.39.12", "version": "1.39.12" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@types/http-cache-semantics", "purl": "pkg:npm/%40types/http-cache-semantics@4.0.4", "version": "4.0.4" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "@types/jasmine", "purl": "pkg:npm/%40types/jasmine@4.6.4", "version": "4.6.4" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "@types/json-schema", "purl": "pkg:npm/%40types/json-schema@7.0.15", "version": "7.0.15" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "@types/json5", "purl": "pkg:npm/%40types/json5@0.0.29", "version": "0.0.29" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@types/keyv", "purl": "pkg:npm/%40types/keyv@3.1.4", "version": "3.1.4" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@types/mdast", "purl": "pkg:npm/%40types/mdast@3.0.15", "version": "3.0.15" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@types/minimist", "purl": "pkg:npm/%40types/minimist@1.2.5", "version": "1.2.5" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@types/moo", "purl": "pkg:npm/%40types/moo@0.5.5", "version": "0.5.5" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "@types/node", "purl": "pkg:npm/%40types/node@18.19.33", "version": "18.19.33" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@types/node", "purl": "pkg:npm/%40types/node@20.12.12", "version": "20.12.12" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@types/normalize-package-data", "purl": "pkg:npm/%40types/normalize-package-data@2.4.4", "version": "2.4.4" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@types/responselike", "purl": "pkg:npm/%40types/responselike@1.0.3", "version": "1.0.3" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "@types/semver", "purl": "pkg:npm/%40types/semver@7.5.8", "version": "7.5.8" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@types/shimmer", "purl": "pkg:npm/%40types/shimmer@1.0.5", "version": "1.0.5" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@types/treeify", "purl": "pkg:npm/%40types/treeify@1.0.3", "version": "1.0.3" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@types/unist", "purl": "pkg:npm/%40types/unist@2.0.10", "version": "2.0.10" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@types/yauzl", "purl": "pkg:npm/%40types/yauzl@2.10.3", "version": "2.10.3" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "@typescript-eslint/eslint-plugin", "purl": "pkg:npm/%40typescript-eslint/eslint-plugin@7.5.0", "version": "7.5.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "@typescript-eslint/parser", "purl": "pkg:npm/%40typescript-eslint/parser@7.5.0", "version": "7.5.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "@typescript-eslint/scope-manager", "purl": "pkg:npm/%40typescript-eslint/scope-manager@7.5.0", "version": "7.5.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "@typescript-eslint/type-utils", "purl": "pkg:npm/%40typescript-eslint/type-utils@7.5.0", "version": "7.5.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "@typescript-eslint/types", "purl": "pkg:npm/%40typescript-eslint/types@7.5.0", "version": "7.5.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "@typescript-eslint/typescript-estree", "purl": "pkg:npm/%40typescript-eslint/typescript-estree@7.5.0", "version": "7.5.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "@typescript-eslint/utils", "purl": "pkg:npm/%40typescript-eslint/utils@7.5.0", "version": "7.5.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "@typescript-eslint/visitor-keys", "purl": "pkg:npm/%40typescript-eslint/visitor-keys@7.5.0", "version": "7.5.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "@ungap/structured-clone", "purl": "pkg:npm/%40ungap/structured-clone@1.2.0", "version": "1.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "@vercel/ncc", "purl": "pkg:npm/%40vercel/ncc@0.38.1", "version": "0.38.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@yarnpkg/core", "purl": "pkg:npm/%40yarnpkg/core@4.0.5", "version": "4.0.5" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@yarnpkg/fslib", "purl": "pkg:npm/%40yarnpkg/fslib@3.1.0", "version": "3.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@yarnpkg/libzip", "purl": "pkg:npm/%40yarnpkg/libzip@3.1.0", "version": "3.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@yarnpkg/parsers", "purl": "pkg:npm/%40yarnpkg/parsers@3.0.2", "version": "3.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "@yarnpkg/shell", "purl": "pkg:npm/%40yarnpkg/shell@4.0.2", "version": "4.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "abbrev", "purl": "pkg:npm/abbrev@2.0.0", "version": "2.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "acorn", "purl": "pkg:npm/acorn@8.11.3", "version": "8.11.3" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "acorn-import-attributes", "purl": "pkg:npm/acorn-import-attributes@1.9.5", "version": "1.9.5" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "acorn-jsx", "purl": "pkg:npm/acorn-jsx@5.3.2", "version": "5.3.2" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "adm-zip", "purl": "pkg:npm/adm-zip@0.5.12", "version": "0.5.12" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "agent-base", "purl": "pkg:npm/agent-base@7.1.1", "version": "7.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "agentkeepalive", "purl": "pkg:npm/agentkeepalive@4.5.0", "version": "4.5.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "aggregate-error", "purl": "pkg:npm/aggregate-error@3.1.0", "version": "3.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "ajv", "purl": "pkg:npm/ajv@6.12.6", "version": "6.12.6" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "ansi-red", "purl": "pkg:npm/ansi-red@0.1.1", "version": "0.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "ansi-regex", "purl": "pkg:npm/ansi-regex@5.0.1", "version": "5.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "ansi-regex", "purl": "pkg:npm/ansi-regex@6.0.1", "version": "6.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "ansi-styles", "purl": "pkg:npm/ansi-styles@3.2.1", "version": "3.2.1" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "ansi-styles", "purl": "pkg:npm/ansi-styles@4.3.0", "version": "4.3.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "ansi-styles", "purl": "pkg:npm/ansi-styles@6.2.1", "version": "6.2.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "ansi-wrap", "purl": "pkg:npm/ansi-wrap@0.1.0", "version": "0.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "argparse", "purl": "pkg:npm/argparse@1.0.10", "version": "1.0.10" }, { "ecosystem": "npm", "licenses": [ "Python-2.0" ], "location": "actions/installer/package-lock.json", "name": "argparse", "purl": "pkg:npm/argparse@2.0.1", "version": "2.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "aria-query", "purl": "pkg:npm/aria-query@5.3.0", "version": "5.3.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "array-buffer-byte-length", "purl": "pkg:npm/array-buffer-byte-length@1.0.1", "version": "1.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "array-includes", "purl": "pkg:npm/array-includes@3.1.6", "version": "3.1.6" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "array-union", "purl": "pkg:npm/array-union@2.1.0", "version": "2.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "array.prototype.flat", "purl": "pkg:npm/array.prototype.flat@1.3.0", "version": "1.3.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "array.prototype.flatmap", "purl": "pkg:npm/array.prototype.flatmap@1.3.1", "version": "1.3.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "arraybuffer.prototype.slice", "purl": "pkg:npm/arraybuffer.prototype.slice@1.0.3", "version": "1.0.3" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "arrify", "purl": "pkg:npm/arrify@1.0.1", "version": "1.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "asn1.js", "purl": "pkg:npm/asn1.js@5.4.1", "version": "5.4.1" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "ast-types-flow", "purl": "pkg:npm/ast-types-flow@0.0.7", "version": "0.0.7" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "auth-header", "purl": "pkg:npm/auth-header@1.0.0", "version": "1.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "autolinker", "purl": "pkg:npm/autolinker@4.0.0", "version": "4.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "available-typed-arrays", "purl": "pkg:npm/available-typed-arrays@1.0.5", "version": "1.0.5" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "available-typed-arrays", "purl": "pkg:npm/available-typed-arrays@1.0.7", "version": "1.0.7" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "aws4", "purl": "pkg:npm/aws4@1.12.0", "version": "1.12.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "axe-core", "purl": "pkg:npm/axe-core@4.6.3", "version": "4.6.3" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "axobject-query", "purl": "pkg:npm/axobject-query@3.1.1", "version": "3.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "azure-devops-node-api", "purl": "pkg:npm/azure-devops-node-api@13.0.0", "version": "13.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "backslash", "purl": "pkg:npm/backslash@0.2.0", "version": "0.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "bail", "purl": "pkg:npm/bail@1.0.5", "version": "1.0.5" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "balanced-match", "purl": "pkg:npm/balanced-match@1.0.2", "version": "1.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "base64-js", "purl": "pkg:npm/base64-js@1.5.1", "version": "1.5.1" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "before-after-hook", "purl": "pkg:npm/before-after-hook@2.2.3", "version": "2.2.3" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "better-sqlite3", "purl": "pkg:npm/better-sqlite3@9.6.0", "version": "9.6.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "bignumber.js", "purl": "pkg:npm/bignumber.js@9.1.2", "version": "9.1.2" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "bindings", "purl": "pkg:npm/bindings@1.5.0", "version": "1.5.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "bl", "purl": "pkg:npm/bl@4.1.0", "version": "4.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "bn", "purl": "pkg:npm/bn@1.0.5", "version": "1.0.5" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "bn.js", "purl": "pkg:npm/bn.js@4.12.0", "version": "4.12.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "boolbase", "purl": "pkg:npm/boolbase@1.0.0", "version": "1.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "boolean", "purl": "pkg:npm/boolean@3.2.0", "version": "3.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "bowser", "purl": "pkg:npm/bowser@2.11.0", "version": "2.11.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "brace-expansion", "purl": "pkg:npm/brace-expansion@1.1.11", "version": "1.1.11" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "brace-expansion", "purl": "pkg:npm/brace-expansion@2.0.1", "version": "2.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "braces", "purl": "pkg:npm/braces@3.0.3", "version": "3.0.3" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "browserslist", "purl": "pkg:npm/browserslist@4.21.3", "version": "4.21.3" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "buffer", "purl": "pkg:npm/buffer@5.7.1", "version": "5.7.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "buffer-crc32", "purl": "pkg:npm/buffer-crc32@0.2.13", "version": "0.2.13" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "buffer-equal-constant-time", "purl": "pkg:npm/buffer-equal-constant-time@1.0.1", "version": "1.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "buffer-from", "purl": "pkg:npm/buffer-from@1.1.2", "version": "1.1.2" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "bunyan", "purl": "pkg:npm/bunyan@1.8.15", "version": "1.8.15" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "bzip-deflate", "purl": "pkg:npm/bzip-deflate@1.0.0", "version": "1.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "cacache", "purl": "pkg:npm/cacache@18.0.3", "version": "18.0.3" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "cacheable-lookup", "purl": "pkg:npm/cacheable-lookup@5.0.4", "version": "5.0.4" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "cacheable-request", "purl": "pkg:npm/cacheable-request@7.0.4", "version": "7.0.4" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "call-bind", "purl": "pkg:npm/call-bind@1.0.2", "version": "1.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "call-bind", "purl": "pkg:npm/call-bind@1.0.7", "version": "1.0.7" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "callsites", "purl": "pkg:npm/callsites@3.1.0", "version": "3.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "camelcase", "purl": "pkg:npm/camelcase@5.3.1", "version": "5.3.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "camelcase-keys", "purl": "pkg:npm/camelcase-keys@6.2.2", "version": "6.2.2" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "caniuse-lite", "purl": "pkg:npm/caniuse-lite@1.0.30001387", "version": "1.0.30001387" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "chalk", "purl": "pkg:npm/chalk@2.4.2", "version": "2.4.2" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "chalk", "purl": "pkg:npm/chalk@3.0.0", "version": "3.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "chalk", "purl": "pkg:npm/chalk@4.1.2", "version": "4.1.2" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "changelog-filename-regex", "purl": "pkg:npm/changelog-filename-regex@2.0.1", "version": "2.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "character-entities", "purl": "pkg:npm/character-entities@1.2.4", "version": "1.2.4" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "character-entities-legacy", "purl": "pkg:npm/character-entities-legacy@1.1.4", "version": "1.1.4" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "character-reference-invalid", "purl": "pkg:npm/character-reference-invalid@1.1.4", "version": "1.1.4" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "chownr", "purl": "pkg:npm/chownr@1.1.4", "version": "1.1.4" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "chownr", "purl": "pkg:npm/chownr@2.0.0", "version": "2.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "ci-info", "purl": "pkg:npm/ci-info@3.9.0", "version": "3.9.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "cjs-module-lexer", "purl": "pkg:npm/cjs-module-lexer@1.3.1", "version": "1.3.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "clean-git-ref", "purl": "pkg:npm/clean-git-ref@2.0.1", "version": "2.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "clean-stack", "purl": "pkg:npm/clean-stack@2.2.0", "version": "2.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "clipanion", "purl": "pkg:npm/clipanion@4.0.0-rc.3", "version": "4.0.0-rc.3" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "clone-response", "purl": "pkg:npm/clone-response@1.0.3", "version": "1.0.3" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "cluster-key-slot", "purl": "pkg:npm/cluster-key-slot@1.1.2", "version": "1.1.2" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "coffee-script", "purl": "pkg:npm/coffee-script@1.12.7", "version": "1.12.7" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "color-convert", "purl": "pkg:npm/color-convert@1.9.3", "version": "1.9.3" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "color-convert", "purl": "pkg:npm/color-convert@2.0.1", "version": "2.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "color-name", "purl": "pkg:npm/color-name@1.1.3", "version": "1.1.3" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "color-name", "purl": "pkg:npm/color-name@1.1.4", "version": "1.1.4" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "commander", "purl": "pkg:npm/commander@11.1.0", "version": "11.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "commander", "purl": "pkg:npm/commander@12.0.0", "version": "12.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "concat-map", "purl": "pkg:npm/concat-map@0.0.1", "version": "0.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "concat-stream", "purl": "pkg:npm/concat-stream@1.6.2", "version": "1.6.2" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "conventional-commits-detector", "purl": "pkg:npm/conventional-commits-detector@1.0.3", "version": "1.0.3" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "core-js-pure", "purl": "pkg:npm/core-js-pure@3.37.1", "version": "3.37.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "core-util-is", "purl": "pkg:npm/core-util-is@1.0.3", "version": "1.0.3" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "cron-parser", "purl": "pkg:npm/cron-parser@4.9.0", "version": "4.9.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "cross-spawn", "purl": "pkg:npm/cross-spawn@7.0.3", "version": "7.0.3" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "css-select", "purl": "pkg:npm/css-select@5.1.0", "version": "5.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "css-what", "purl": "pkg:npm/css-what@6.1.0", "version": "6.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "damerau-levenshtein", "purl": "pkg:npm/damerau-levenshtein@1.0.8", "version": "1.0.8" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "dargs", "purl": "pkg:npm/dargs@7.0.0", "version": "7.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "data-view-buffer", "purl": "pkg:npm/data-view-buffer@1.0.1", "version": "1.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "data-view-byte-length", "purl": "pkg:npm/data-view-byte-length@1.0.1", "version": "1.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "data-view-byte-offset", "purl": "pkg:npm/data-view-byte-offset@1.0.0", "version": "1.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "debug", "purl": "pkg:npm/debug@2.6.9", "version": "2.6.9" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "debug", "purl": "pkg:npm/debug@3.2.7", "version": "3.2.7" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "debug", "purl": "pkg:npm/debug@4.3.4", "version": "4.3.4" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "decamelize", "purl": "pkg:npm/decamelize@1.2.0", "version": "1.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "decamelize-keys", "purl": "pkg:npm/decamelize-keys@1.1.1", "version": "1.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "decompress-response", "purl": "pkg:npm/decompress-response@6.0.0", "version": "6.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "deep-equal", "purl": "pkg:npm/deep-equal@2.2.0", "version": "2.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "deep-equal", "purl": "pkg:npm/deep-equal@2.2.3", "version": "2.2.3" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "deep-extend", "purl": "pkg:npm/deep-extend@0.6.0", "version": "0.6.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "deep-is", "purl": "pkg:npm/deep-is@0.1.4", "version": "0.1.4" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "deepmerge", "purl": "pkg:npm/deepmerge@4.3.1", "version": "4.3.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "defer-to-connect", "purl": "pkg:npm/defer-to-connect@2.0.1", "version": "2.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "define-data-property", "purl": "pkg:npm/define-data-property@1.1.4", "version": "1.1.4" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "define-properties", "purl": "pkg:npm/define-properties@1.1.4", "version": "1.1.4" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "define-properties", "purl": "pkg:npm/define-properties@1.2.1", "version": "1.2.1" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "deprecation", "purl": "pkg:npm/deprecation@2.3.1", "version": "2.3.1" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "dequal", "purl": "pkg:npm/dequal@2.0.3", "version": "2.0.3" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "detect-indent", "purl": "pkg:npm/detect-indent@6.1.0", "version": "6.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "detect-libc", "purl": "pkg:npm/detect-libc@2.0.3", "version": "2.0.3" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "detect-node", "purl": "pkg:npm/detect-node@2.1.0", "version": "2.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "diacritics-map", "purl": "pkg:npm/diacritics-map@0.1.0", "version": "0.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "diff", "purl": "pkg:npm/diff@5.2.0", "version": "5.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "dir-glob", "purl": "pkg:npm/dir-glob@3.0.1", "version": "3.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "doctrine", "purl": "pkg:npm/doctrine@2.1.0", "version": "2.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "doctrine", "purl": "pkg:npm/doctrine@3.0.0", "version": "3.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "dom-serializer", "purl": "pkg:npm/dom-serializer@2.0.0", "version": "2.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "domelementtype", "purl": "pkg:npm/domelementtype@2.3.0", "version": "2.3.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "domhandler", "purl": "pkg:npm/domhandler@5.0.3", "version": "5.0.3" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "domutils", "purl": "pkg:npm/domutils@3.1.0", "version": "3.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "dotenv", "purl": "pkg:npm/dotenv@16.4.5", "version": "16.4.5" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "dtrace-provider", "purl": "pkg:npm/dtrace-provider@0.8.8", "version": "0.8.8" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "eastasianwidth", "purl": "pkg:npm/eastasianwidth@0.2.0", "version": "0.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "ecdsa-sig-formatter", "purl": "pkg:npm/ecdsa-sig-formatter@1.0.11", "version": "1.0.11" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "editorconfig", "purl": "pkg:npm/editorconfig@2.0.0", "version": "2.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "electron-to-chromium", "purl": "pkg:npm/electron-to-chromium@1.4.238", "version": "1.4.238" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "email-addresses", "purl": "pkg:npm/email-addresses@5.0.0", "version": "5.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "emoji-regex", "purl": "pkg:npm/emoji-regex@10.3.0", "version": "10.3.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "emoji-regex", "purl": "pkg:npm/emoji-regex@8.0.0", "version": "8.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "emoji-regex", "purl": "pkg:npm/emoji-regex@9.2.2", "version": "9.2.2" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "emojibase", "purl": "pkg:npm/emojibase@15.3.0", "version": "15.3.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "emojibase-regex", "purl": "pkg:npm/emojibase-regex@15.3.0", "version": "15.3.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "encoding", "purl": "pkg:npm/encoding@0.1.13", "version": "0.1.13" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "end-of-stream", "purl": "pkg:npm/end-of-stream@1.4.4", "version": "1.4.4" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "entities", "purl": "pkg:npm/entities@4.5.0", "version": "4.5.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "env-paths", "purl": "pkg:npm/env-paths@2.2.1", "version": "2.2.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "err-code", "purl": "pkg:npm/err-code@2.0.3", "version": "2.0.3" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "error-ex", "purl": "pkg:npm/error-ex@1.3.2", "version": "1.3.2" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "es-abstract", "purl": "pkg:npm/es-abstract@1.21.1", "version": "1.21.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "es-abstract", "purl": "pkg:npm/es-abstract@1.23.3", "version": "1.23.3" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "es-define-property", "purl": "pkg:npm/es-define-property@1.0.0", "version": "1.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "es-errors", "purl": "pkg:npm/es-errors@1.3.0", "version": "1.3.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "es-get-iterator", "purl": "pkg:npm/es-get-iterator@1.1.3", "version": "1.1.3" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "es-object-atoms", "purl": "pkg:npm/es-object-atoms@1.0.0", "version": "1.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "es-set-tostringtag", "purl": "pkg:npm/es-set-tostringtag@2.0.1", "version": "2.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "es-set-tostringtag", "purl": "pkg:npm/es-set-tostringtag@2.0.3", "version": "2.0.3" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "es-shim-unscopables", "purl": "pkg:npm/es-shim-unscopables@1.0.0", "version": "1.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "es-to-primitive", "purl": "pkg:npm/es-to-primitive@1.2.1", "version": "1.2.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "es6-error", "purl": "pkg:npm/es6-error@4.1.1", "version": "4.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "escalade", "purl": "pkg:npm/escalade@3.1.1", "version": "3.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "escape-string-regexp", "purl": "pkg:npm/escape-string-regexp@1.0.5", "version": "1.0.5" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "escape-string-regexp", "purl": "pkg:npm/escape-string-regexp@4.0.0", "version": "4.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "eslint", "purl": "pkg:npm/eslint@8.57.0", "version": "8.57.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "eslint-config-prettier", "purl": "pkg:npm/eslint-config-prettier@8.5.0", "version": "8.5.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "eslint-import-resolver-node", "purl": "pkg:npm/eslint-import-resolver-node@0.3.6", "version": "0.3.6" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "eslint-module-utils", "purl": "pkg:npm/eslint-module-utils@2.7.4", "version": "2.7.4" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "eslint-plugin-escompat", "purl": "pkg:npm/eslint-plugin-escompat@3.3.3", "version": "3.3.3" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "eslint-plugin-eslint-comments", "purl": "pkg:npm/eslint-plugin-eslint-comments@3.2.0", "version": "3.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "eslint-plugin-filenames", "purl": "pkg:npm/eslint-plugin-filenames@1.3.2", "version": "1.3.2" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "eslint-plugin-github", "purl": "pkg:npm/eslint-plugin-github@4.10.2", "version": "4.10.2" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "eslint-plugin-i18n-text", "purl": "pkg:npm/eslint-plugin-i18n-text@1.0.1", "version": "1.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "eslint-plugin-import", "purl": "pkg:npm/eslint-plugin-import@2.26.0", "version": "2.26.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "eslint-plugin-jsx-a11y", "purl": "pkg:npm/eslint-plugin-jsx-a11y@6.7.1", "version": "6.7.1" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "eslint-plugin-no-only-tests", "purl": "pkg:npm/eslint-plugin-no-only-tests@3.0.0", "version": "3.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "eslint-plugin-prettier", "purl": "pkg:npm/eslint-plugin-prettier@5.1.3", "version": "5.1.3" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "eslint-rule-documentation", "purl": "pkg:npm/eslint-rule-documentation@1.0.23", "version": "1.0.23" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "eslint-scope", "purl": "pkg:npm/eslint-scope@7.2.2", "version": "7.2.2" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "eslint-visitor-keys", "purl": "pkg:npm/eslint-visitor-keys@3.4.3", "version": "3.4.3" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "espree", "purl": "pkg:npm/espree@9.6.1", "version": "9.6.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "esprima", "purl": "pkg:npm/esprima@4.0.1", "version": "4.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "esquery", "purl": "pkg:npm/esquery@1.4.2", "version": "1.4.2" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "esrecurse", "purl": "pkg:npm/esrecurse@4.3.0", "version": "4.3.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "estraverse", "purl": "pkg:npm/estraverse@5.3.0", "version": "5.3.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "esutils", "purl": "pkg:npm/esutils@2.0.3", "version": "2.0.3" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "eventemitter3", "purl": "pkg:npm/eventemitter3@4.0.7", "version": "4.0.7" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "expand-range", "purl": "pkg:npm/expand-range@1.8.2", "version": "1.8.2" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "expand-template", "purl": "pkg:npm/expand-template@2.0.3", "version": "2.0.3" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "exponential-backoff", "purl": "pkg:npm/exponential-backoff@3.1.1", "version": "3.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "extend", "purl": "pkg:npm/extend@3.0.2", "version": "3.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "extend-shallow", "purl": "pkg:npm/extend-shallow@2.0.1", "version": "2.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "extract-zip", "purl": "pkg:npm/extract-zip@2.0.1", "version": "2.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "fast-deep-equal", "purl": "pkg:npm/fast-deep-equal@3.1.3", "version": "3.1.3" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "fast-diff", "purl": "pkg:npm/fast-diff@1.2.0", "version": "1.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "fast-glob", "purl": "pkg:npm/fast-glob@3.3.2", "version": "3.3.2" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "fast-json-stable-stringify", "purl": "pkg:npm/fast-json-stable-stringify@2.1.0", "version": "2.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "fast-levenshtein", "purl": "pkg:npm/fast-levenshtein@2.0.6", "version": "2.0.6" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "fast-xml-parser", "purl": "pkg:npm/fast-xml-parser@4.2.5", "version": "4.2.5" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "fastq", "purl": "pkg:npm/fastq@1.13.0", "version": "1.13.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "fastq", "purl": "pkg:npm/fastq@1.17.1", "version": "1.17.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "fd-slicer", "purl": "pkg:npm/fd-slicer@1.1.0", "version": "1.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "file-entry-cache", "purl": "pkg:npm/file-entry-cache@6.0.1", "version": "6.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "file-uri-to-path", "purl": "pkg:npm/file-uri-to-path@1.0.0", "version": "1.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "fill-range", "purl": "pkg:npm/fill-range@2.2.4", "version": "2.2.4" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "fill-range", "purl": "pkg:npm/fill-range@7.1.1", "version": "7.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "find-packages", "purl": "pkg:npm/find-packages@10.0.4", "version": "10.0.4" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "find-up", "purl": "pkg:npm/find-up@4.1.0", "version": "4.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "find-up", "purl": "pkg:npm/find-up@5.0.0", "version": "5.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "flat-cache", "purl": "pkg:npm/flat-cache@3.0.4", "version": "3.0.4" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "flatted", "purl": "pkg:npm/flatted@3.2.7", "version": "3.2.7" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "for-each", "purl": "pkg:npm/for-each@0.3.3", "version": "0.3.3" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "for-in", "purl": "pkg:npm/for-in@1.0.2", "version": "1.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "foreground-child", "purl": "pkg:npm/foreground-child@3.1.1", "version": "3.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "fs-constants", "purl": "pkg:npm/fs-constants@1.0.0", "version": "1.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "fs-extra", "purl": "pkg:npm/fs-extra@11.2.0", "version": "11.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "fs-minipass", "purl": "pkg:npm/fs-minipass@2.1.0", "version": "2.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "fs-minipass", "purl": "pkg:npm/fs-minipass@3.0.3", "version": "3.0.3" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "fs.realpath", "purl": "pkg:npm/fs.realpath@1.0.0", "version": "1.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "function-bind", "purl": "pkg:npm/function-bind@1.1.1", "version": "1.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "function-bind", "purl": "pkg:npm/function-bind@1.1.2", "version": "1.1.2" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "function.prototype.name", "purl": "pkg:npm/function.prototype.name@1.1.5", "version": "1.1.5" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "function.prototype.name", "purl": "pkg:npm/function.prototype.name@1.1.6", "version": "1.1.6" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "functions-have-names", "purl": "pkg:npm/functions-have-names@1.2.3", "version": "1.2.3" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "gaxios", "purl": "pkg:npm/gaxios@6.5.0", "version": "6.5.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "gcp-metadata", "purl": "pkg:npm/gcp-metadata@6.1.0", "version": "6.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "generic-pool", "purl": "pkg:npm/generic-pool@3.9.0", "version": "3.9.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "get-intrinsic", "purl": "pkg:npm/get-intrinsic@1.2.0", "version": "1.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "get-intrinsic", "purl": "pkg:npm/get-intrinsic@1.2.4", "version": "1.2.4" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "get-stream", "purl": "pkg:npm/get-stream@5.2.0", "version": "5.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "get-symbol-description", "purl": "pkg:npm/get-symbol-description@1.0.0", "version": "1.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "get-symbol-description", "purl": "pkg:npm/get-symbol-description@1.0.2", "version": "1.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "git-raw-commits", "purl": "pkg:npm/git-raw-commits@2.0.11", "version": "2.0.11" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "git-up", "purl": "pkg:npm/git-up@7.0.0", "version": "7.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "git-url-parse", "purl": "pkg:npm/git-url-parse@14.0.0", "version": "14.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "github-from-package", "purl": "pkg:npm/github-from-package@0.0.0", "version": "0.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "github-url-from-git", "purl": "pkg:npm/github-url-from-git@1.5.0", "version": "1.5.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "glob", "purl": "pkg:npm/glob@10.3.12", "version": "10.3.12" }, { "ecosystem": "npm", "licenses": [ "ISC" ], "location": "package-lock.json", "name": "glob", "purl": "pkg:npm/glob@10.3.15", "version": "10.3.15" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "glob", "purl": "pkg:npm/glob@6.0.4", "version": "6.0.4" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "glob", "purl": "pkg:npm/glob@7.2.3", "version": "7.2.3" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "glob-parent", "purl": "pkg:npm/glob-parent@5.1.2", "version": "5.1.2" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "glob-parent", "purl": "pkg:npm/glob-parent@6.0.2", "version": "6.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "global-agent", "purl": "pkg:npm/global-agent@3.0.0", "version": "3.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "globals", "purl": "pkg:npm/globals@13.19.0", "version": "13.19.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "globalthis", "purl": "pkg:npm/globalthis@1.0.3", "version": "1.0.3" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "globalthis", "purl": "pkg:npm/globalthis@1.0.4", "version": "1.0.4" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "globby", "purl": "pkg:npm/globby@11.1.0", "version": "11.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "good-enough-parser", "purl": "pkg:npm/good-enough-parser@1.1.23", "version": "1.1.23" }, { "ecosystem": "npm", "licenses": [ "Apache-2.0" ], "location": "package-lock.json", "name": "google-auth-library", "purl": "pkg:npm/google-auth-library@9.10.0", "version": "9.10.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "gopd", "purl": "pkg:npm/gopd@1.0.1", "version": "1.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "got", "purl": "pkg:npm/got@11.8.6", "version": "11.8.6" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "graceful-fs", "purl": "pkg:npm/graceful-fs@4.2.11", "version": "4.2.11" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "graph-data-structure", "purl": "pkg:npm/graph-data-structure@3.5.0", "version": "3.5.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "grapheme-splitter", "purl": "pkg:npm/grapheme-splitter@1.0.4", "version": "1.0.4" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "graphemer", "purl": "pkg:npm/graphemer@1.4.0", "version": "1.4.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "gray-matter", "purl": "pkg:npm/gray-matter@2.1.1", "version": "2.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "gtoken", "purl": "pkg:npm/gtoken@7.1.0", "version": "7.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "handlebars", "purl": "pkg:npm/handlebars@4.7.8", "version": "4.7.8" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "hard-rejection", "purl": "pkg:npm/hard-rejection@2.1.0", "version": "2.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "has", "purl": "pkg:npm/has@1.0.3", "version": "1.0.3" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "has-bigints", "purl": "pkg:npm/has-bigints@1.0.2", "version": "1.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "has-flag", "purl": "pkg:npm/has-flag@3.0.0", "version": "3.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "has-flag", "purl": "pkg:npm/has-flag@4.0.0", "version": "4.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "has-property-descriptors", "purl": "pkg:npm/has-property-descriptors@1.0.0", "version": "1.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "has-property-descriptors", "purl": "pkg:npm/has-property-descriptors@1.0.2", "version": "1.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "has-proto", "purl": "pkg:npm/has-proto@1.0.1", "version": "1.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "has-proto", "purl": "pkg:npm/has-proto@1.0.3", "version": "1.0.3" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "has-symbols", "purl": "pkg:npm/has-symbols@1.0.3", "version": "1.0.3" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "has-tostringtag", "purl": "pkg:npm/has-tostringtag@1.0.0", "version": "1.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "has-tostringtag", "purl": "pkg:npm/has-tostringtag@1.0.2", "version": "1.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "hasown", "purl": "pkg:npm/hasown@2.0.2", "version": "2.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "he", "purl": "pkg:npm/he@1.2.0", "version": "1.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "hosted-git-info", "purl": "pkg:npm/hosted-git-info@2.8.9", "version": "2.8.9" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "hosted-git-info", "purl": "pkg:npm/hosted-git-info@4.1.0", "version": "4.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "http-cache-semantics", "purl": "pkg:npm/http-cache-semantics@4.1.1", "version": "4.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "http-proxy-agent", "purl": "pkg:npm/http-proxy-agent@7.0.2", "version": "7.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "http2-wrapper", "purl": "pkg:npm/http2-wrapper@1.0.3", "version": "1.0.3" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "https-proxy-agent", "purl": "pkg:npm/https-proxy-agent@7.0.4", "version": "7.0.4" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "humanize-ms", "purl": "pkg:npm/humanize-ms@1.2.1", "version": "1.2.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "iced-error", "purl": "pkg:npm/iced-error@0.0.13", "version": "0.0.13" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "iced-lock", "purl": "pkg:npm/iced-lock@1.1.0", "version": "1.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "iced-lock", "purl": "pkg:npm/iced-lock@2.0.1", "version": "2.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "iced-runtime", "purl": "pkg:npm/iced-runtime@1.0.4", "version": "1.0.4" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "iced-runtime-3", "purl": "pkg:npm/iced-runtime-3@3.0.5", "version": "3.0.5" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "iconv-lite", "purl": "pkg:npm/iconv-lite@0.6.3", "version": "0.6.3" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "ieee754", "purl": "pkg:npm/ieee754@1.2.1", "version": "1.2.1" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "ignore", "purl": "pkg:npm/ignore@5.3.1", "version": "5.3.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "immediate", "purl": "pkg:npm/immediate@3.0.6", "version": "3.0.6" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "import-fresh", "purl": "pkg:npm/import-fresh@3.3.0", "version": "3.3.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "import-in-the-middle", "purl": "pkg:npm/import-in-the-middle@1.7.4", "version": "1.7.4" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "imurmurhash", "purl": "pkg:npm/imurmurhash@0.1.4", "version": "0.1.4" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "indent-string", "purl": "pkg:npm/indent-string@4.0.0", "version": "4.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "inflight", "purl": "pkg:npm/inflight@1.0.6", "version": "1.0.6" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "inherits", "purl": "pkg:npm/inherits@2.0.4", "version": "2.0.4" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "ini", "purl": "pkg:npm/ini@1.3.8", "version": "1.3.8" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "ini", "purl": "pkg:npm/ini@4.1.2", "version": "4.1.2" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "install-artifact-from-github", "purl": "pkg:npm/install-artifact-from-github@1.3.5", "version": "1.3.5" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "internal-slot", "purl": "pkg:npm/internal-slot@1.0.5", "version": "1.0.5" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "internal-slot", "purl": "pkg:npm/internal-slot@1.0.7", "version": "1.0.7" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "ip-address", "purl": "pkg:npm/ip-address@9.0.5", "version": "9.0.5" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "is-alphabetical", "purl": "pkg:npm/is-alphabetical@1.0.4", "version": "1.0.4" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "is-alphanumerical", "purl": "pkg:npm/is-alphanumerical@1.0.4", "version": "1.0.4" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "is-arguments", "purl": "pkg:npm/is-arguments@1.1.1", "version": "1.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "is-array-buffer", "purl": "pkg:npm/is-array-buffer@3.0.1", "version": "3.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "is-array-buffer", "purl": "pkg:npm/is-array-buffer@3.0.4", "version": "3.0.4" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "is-arrayish", "purl": "pkg:npm/is-arrayish@0.2.1", "version": "0.2.1" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "is-bigint", "purl": "pkg:npm/is-bigint@1.0.4", "version": "1.0.4" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "is-boolean-object", "purl": "pkg:npm/is-boolean-object@1.1.2", "version": "1.1.2" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "is-buffer", "purl": "pkg:npm/is-buffer@1.1.6", "version": "1.1.6" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "is-buffer", "purl": "pkg:npm/is-buffer@2.0.5", "version": "2.0.5" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "is-callable", "purl": "pkg:npm/is-callable@1.2.7", "version": "1.2.7" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "is-core-module", "purl": "pkg:npm/is-core-module@2.10.0", "version": "2.10.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "is-core-module", "purl": "pkg:npm/is-core-module@2.13.1", "version": "2.13.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "is-data-view", "purl": "pkg:npm/is-data-view@1.0.1", "version": "1.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "is-date-object", "purl": "pkg:npm/is-date-object@1.0.5", "version": "1.0.5" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "is-decimal", "purl": "pkg:npm/is-decimal@1.0.4", "version": "1.0.4" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "is-extendable", "purl": "pkg:npm/is-extendable@0.1.1", "version": "0.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "is-extendable", "purl": "pkg:npm/is-extendable@1.0.1", "version": "1.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "is-extglob", "purl": "pkg:npm/is-extglob@2.1.1", "version": "2.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "is-fullwidth-code-point", "purl": "pkg:npm/is-fullwidth-code-point@3.0.0", "version": "3.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "is-generator-function", "purl": "pkg:npm/is-generator-function@1.0.10", "version": "1.0.10" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "is-glob", "purl": "pkg:npm/is-glob@4.0.3", "version": "4.0.3" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "is-hexadecimal", "purl": "pkg:npm/is-hexadecimal@1.0.4", "version": "1.0.4" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "is-lambda", "purl": "pkg:npm/is-lambda@1.0.1", "version": "1.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "is-map", "purl": "pkg:npm/is-map@2.0.2", "version": "2.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "is-map", "purl": "pkg:npm/is-map@2.0.3", "version": "2.0.3" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "is-negative-zero", "purl": "pkg:npm/is-negative-zero@2.0.2", "version": "2.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "is-negative-zero", "purl": "pkg:npm/is-negative-zero@2.0.3", "version": "2.0.3" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "is-number", "purl": "pkg:npm/is-number@2.1.0", "version": "2.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "is-number", "purl": "pkg:npm/is-number@4.0.0", "version": "4.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "is-number", "purl": "pkg:npm/is-number@7.0.0", "version": "7.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "is-number-object", "purl": "pkg:npm/is-number-object@1.0.7", "version": "1.0.7" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "is-path-inside", "purl": "pkg:npm/is-path-inside@3.0.3", "version": "3.0.3" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "is-plain-obj", "purl": "pkg:npm/is-plain-obj@1.1.0", "version": "1.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "is-plain-obj", "purl": "pkg:npm/is-plain-obj@2.1.0", "version": "2.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "is-plain-object", "purl": "pkg:npm/is-plain-object@2.0.4", "version": "2.0.4" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "is-regex", "purl": "pkg:npm/is-regex@1.1.4", "version": "1.1.4" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "is-set", "purl": "pkg:npm/is-set@2.0.2", "version": "2.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "is-set", "purl": "pkg:npm/is-set@2.0.3", "version": "2.0.3" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "is-shared-array-buffer", "purl": "pkg:npm/is-shared-array-buffer@1.0.2", "version": "1.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "is-shared-array-buffer", "purl": "pkg:npm/is-shared-array-buffer@1.0.3", "version": "1.0.3" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "is-ssh", "purl": "pkg:npm/is-ssh@1.4.0", "version": "1.4.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "is-stream", "purl": "pkg:npm/is-stream@2.0.1", "version": "2.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "is-string", "purl": "pkg:npm/is-string@1.0.7", "version": "1.0.7" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "is-symbol", "purl": "pkg:npm/is-symbol@1.0.4", "version": "1.0.4" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "is-typed-array", "purl": "pkg:npm/is-typed-array@1.1.10", "version": "1.1.10" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "is-typed-array", "purl": "pkg:npm/is-typed-array@1.1.13", "version": "1.1.13" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "is-typedarray", "purl": "pkg:npm/is-typedarray@1.0.0", "version": "1.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "is-weakmap", "purl": "pkg:npm/is-weakmap@2.0.1", "version": "2.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "is-weakmap", "purl": "pkg:npm/is-weakmap@2.0.2", "version": "2.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "is-weakref", "purl": "pkg:npm/is-weakref@1.0.2", "version": "1.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "is-weakset", "purl": "pkg:npm/is-weakset@2.0.2", "version": "2.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "is-weakset", "purl": "pkg:npm/is-weakset@2.0.3", "version": "2.0.3" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "is-windows", "purl": "pkg:npm/is-windows@1.0.2", "version": "1.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "isarray", "purl": "pkg:npm/isarray@1.0.0", "version": "1.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "isarray", "purl": "pkg:npm/isarray@2.0.5", "version": "2.0.5" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "isexe", "purl": "pkg:npm/isexe@2.0.0", "version": "2.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "isexe", "purl": "pkg:npm/isexe@3.1.1", "version": "3.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "isobject", "purl": "pkg:npm/isobject@2.1.0", "version": "2.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "isobject", "purl": "pkg:npm/isobject@3.0.1", "version": "3.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "jackspeak", "purl": "pkg:npm/jackspeak@2.3.6", "version": "2.3.6" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "jasmine", "purl": "pkg:npm/jasmine@5.1.0", "version": "5.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "jasmine-core", "purl": "pkg:npm/jasmine-core@5.1.2", "version": "5.1.2" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "js-tokens", "purl": "pkg:npm/js-tokens@4.0.0", "version": "4.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "js-yaml", "purl": "pkg:npm/js-yaml@3.14.1", "version": "3.14.1" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "actions/installer/package-lock.json", "name": "js-yaml", "purl": "pkg:npm/js-yaml@4.1.0", "version": "4.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "jsbn", "purl": "pkg:npm/jsbn@1.1.0", "version": "1.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "json-bigint", "purl": "pkg:npm/json-bigint@1.0.0", "version": "1.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "json-buffer", "purl": "pkg:npm/json-buffer@3.0.1", "version": "3.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "json-dup-key-validator", "purl": "pkg:npm/json-dup-key-validator@1.0.3", "version": "1.0.3" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "json-parse-even-better-errors", "purl": "pkg:npm/json-parse-even-better-errors@2.3.1", "version": "2.3.1" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "json-schema-traverse", "purl": "pkg:npm/json-schema-traverse@0.4.1", "version": "0.4.1" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "json-stable-stringify-without-jsonify", "purl": "pkg:npm/json-stable-stringify-without-jsonify@1.0.1", "version": "1.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "json-stringify-pretty-compact", "purl": "pkg:npm/json-stringify-pretty-compact@3.0.0", "version": "3.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "json-stringify-safe", "purl": "pkg:npm/json-stringify-safe@5.0.1", "version": "5.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "json5", "purl": "pkg:npm/json5@1.0.2", "version": "1.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "json5", "purl": "pkg:npm/json5@2.2.3", "version": "2.2.3" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "package-lock.json", "name": "jsonata", "purl": "pkg:npm/jsonata@2.0.5", "version": "2.0.5" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "jsonc-parser", "purl": "pkg:npm/jsonc-parser@3.2.1", "version": "3.2.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "jsonfile", "purl": "pkg:npm/jsonfile@6.1.0", "version": "6.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "jsx-ast-utils", "purl": "pkg:npm/jsx-ast-utils@3.3.3", "version": "3.3.3" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "jwa", "purl": "pkg:npm/jwa@2.0.0", "version": "2.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "jws", "purl": "pkg:npm/jws@4.0.0", "version": "4.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "keybase-ecurve", "purl": "pkg:npm/keybase-ecurve@1.0.1", "version": "1.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "keybase-nacl", "purl": "pkg:npm/keybase-nacl@1.1.4", "version": "1.1.4" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "keyv", "purl": "pkg:npm/keyv@4.5.4", "version": "4.5.4" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "kind-of", "purl": "pkg:npm/kind-of@3.2.2", "version": "3.2.2" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "kind-of", "purl": "pkg:npm/kind-of@6.0.3", "version": "6.0.3" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "klona", "purl": "pkg:npm/klona@2.0.6", "version": "2.0.6" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "language-subtag-registry", "purl": "pkg:npm/language-subtag-registry@0.3.22", "version": "0.3.22" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "language-tags", "purl": "pkg:npm/language-tags@1.0.5", "version": "1.0.5" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "lazy-cache", "purl": "pkg:npm/lazy-cache@2.0.2", "version": "2.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "levn", "purl": "pkg:npm/levn@0.4.1", "version": "0.4.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "lie", "purl": "pkg:npm/lie@3.1.1", "version": "3.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "lines-and-columns", "purl": "pkg:npm/lines-and-columns@1.2.4", "version": "1.2.4" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "linkify-it", "purl": "pkg:npm/linkify-it@5.0.0", "version": "5.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "list-item", "purl": "pkg:npm/list-item@1.1.1", "version": "1.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "localforage", "purl": "pkg:npm/localforage@1.10.0", "version": "1.10.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "locate-path", "purl": "pkg:npm/locate-path@5.0.0", "version": "5.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "locate-path", "purl": "pkg:npm/locate-path@6.0.0", "version": "6.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "lodash", "purl": "pkg:npm/lodash@4.17.21", "version": "4.17.21" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "lodash.camelcase", "purl": "pkg:npm/lodash.camelcase@4.3.0", "version": "4.3.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "lodash.kebabcase", "purl": "pkg:npm/lodash.kebabcase@4.1.1", "version": "4.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "lodash.merge", "purl": "pkg:npm/lodash.merge@4.6.2", "version": "4.6.2" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "lodash.snakecase", "purl": "pkg:npm/lodash.snakecase@4.1.1", "version": "4.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "lodash.upperfirst", "purl": "pkg:npm/lodash.upperfirst@4.3.1", "version": "4.3.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "longest-streak", "purl": "pkg:npm/longest-streak@2.0.4", "version": "2.0.4" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "lowercase-keys", "purl": "pkg:npm/lowercase-keys@2.0.0", "version": "2.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "lru-cache", "purl": "pkg:npm/lru-cache@10.2.0", "version": "10.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "lru-cache", "purl": "pkg:npm/lru-cache@10.2.2", "version": "10.2.2" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "lru-cache", "purl": "pkg:npm/lru-cache@6.0.0", "version": "6.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "luxon", "purl": "pkg:npm/luxon@3.4.4", "version": "3.4.4" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "make-fetch-happen", "purl": "pkg:npm/make-fetch-happen@13.0.1", "version": "13.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "map-obj", "purl": "pkg:npm/map-obj@1.0.1", "version": "1.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "map-obj", "purl": "pkg:npm/map-obj@4.3.0", "version": "4.3.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "markdown-it", "purl": "pkg:npm/markdown-it@14.1.0", "version": "14.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "markdown-link", "purl": "pkg:npm/markdown-link@0.1.1", "version": "0.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "markdown-table", "purl": "pkg:npm/markdown-table@2.0.0", "version": "2.0.0" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "package-lock.json", "name": "markdown-toc", "purl": "pkg:npm/markdown-toc@1.2.0", "version": "1.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "matcher", "purl": "pkg:npm/matcher@3.0.0", "version": "3.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "math-random", "purl": "pkg:npm/math-random@1.0.4", "version": "1.0.4" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "mdast-util-find-and-replace", "purl": "pkg:npm/mdast-util-find-and-replace@1.1.1", "version": "1.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "mdast-util-from-markdown", "purl": "pkg:npm/mdast-util-from-markdown@0.8.5", "version": "0.8.5" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "mdast-util-to-markdown", "purl": "pkg:npm/mdast-util-to-markdown@0.6.5", "version": "0.6.5" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "mdast-util-to-string", "purl": "pkg:npm/mdast-util-to-string@1.1.0", "version": "1.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "mdast-util-to-string", "purl": "pkg:npm/mdast-util-to-string@2.0.0", "version": "2.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "mdurl", "purl": "pkg:npm/mdurl@2.0.0", "version": "2.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "meow", "purl": "pkg:npm/meow@7.1.1", "version": "7.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "meow", "purl": "pkg:npm/meow@8.1.2", "version": "8.1.2" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "merge2", "purl": "pkg:npm/merge2@1.4.1", "version": "1.4.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "micromark", "purl": "pkg:npm/micromark@2.11.4", "version": "2.11.4" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "micromatch", "purl": "pkg:npm/micromatch@4.0.5", "version": "4.0.5" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "mimic-response", "purl": "pkg:npm/mimic-response@1.0.1", "version": "1.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "mimic-response", "purl": "pkg:npm/mimic-response@3.1.0", "version": "3.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "min-indent", "purl": "pkg:npm/min-indent@1.0.1", "version": "1.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "minimalistic-assert", "purl": "pkg:npm/minimalistic-assert@1.0.1", "version": "1.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "minimatch", "purl": "pkg:npm/minimatch@3.1.2", "version": "3.1.2" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "minimatch", "purl": "pkg:npm/minimatch@9.0.2", "version": "9.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "minimatch", "purl": "pkg:npm/minimatch@9.0.3", "version": "9.0.3" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "minimatch", "purl": "pkg:npm/minimatch@9.0.4", "version": "9.0.4" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "minimist", "purl": "pkg:npm/minimist@1.2.6", "version": "1.2.6" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "minimist", "purl": "pkg:npm/minimist@1.2.8", "version": "1.2.8" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "minimist-options", "purl": "pkg:npm/minimist-options@4.1.0", "version": "4.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "minipass", "purl": "pkg:npm/minipass@3.3.6", "version": "3.3.6" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "minipass", "purl": "pkg:npm/minipass@5.0.0", "version": "5.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "minipass", "purl": "pkg:npm/minipass@7.0.4", "version": "7.0.4" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "minipass", "purl": "pkg:npm/minipass@7.1.1", "version": "7.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "minipass-collect", "purl": "pkg:npm/minipass-collect@2.0.1", "version": "2.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "minipass-fetch", "purl": "pkg:npm/minipass-fetch@3.0.5", "version": "3.0.5" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "minipass-flush", "purl": "pkg:npm/minipass-flush@1.0.5", "version": "1.0.5" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "minipass-pipeline", "purl": "pkg:npm/minipass-pipeline@1.2.4", "version": "1.2.4" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "minipass-sized", "purl": "pkg:npm/minipass-sized@1.0.3", "version": "1.0.3" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "minizlib", "purl": "pkg:npm/minizlib@2.1.2", "version": "2.1.2" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "mixin-deep", "purl": "pkg:npm/mixin-deep@1.3.2", "version": "1.3.2" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "mkdirp", "purl": "pkg:npm/mkdirp@0.5.6", "version": "0.5.6" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "mkdirp", "purl": "pkg:npm/mkdirp@1.0.4", "version": "1.0.4" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "mkdirp-classic", "purl": "pkg:npm/mkdirp-classic@0.5.3", "version": "0.5.3" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "module-details-from-path", "purl": "pkg:npm/module-details-from-path@1.0.3", "version": "1.0.3" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "moment", "purl": "pkg:npm/moment@2.30.1", "version": "2.30.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "moo", "purl": "pkg:npm/moo@0.5.2", "version": "0.5.2" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "more-entropy", "purl": "pkg:npm/more-entropy@0.0.7", "version": "0.0.7" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "ms", "purl": "pkg:npm/ms@2.0.0", "version": "2.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "ms", "purl": "pkg:npm/ms@2.1.2", "version": "2.1.2" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "ms", "purl": "pkg:npm/ms@2.1.3", "version": "2.1.3" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "mv", "purl": "pkg:npm/mv@2.1.1", "version": "2.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "nan", "purl": "pkg:npm/nan@2.19.0", "version": "2.19.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "nanoid", "purl": "pkg:npm/nanoid@3.3.7", "version": "3.3.7" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "napi-build-utils", "purl": "pkg:npm/napi-build-utils@1.0.2", "version": "1.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "natural-compare", "purl": "pkg:npm/natural-compare@1.4.0", "version": "1.4.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "ncp", "purl": "pkg:npm/ncp@2.0.0", "version": "2.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "negotiator", "purl": "pkg:npm/negotiator@0.6.3", "version": "0.6.3" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "neo-async", "purl": "pkg:npm/neo-async@2.6.2", "version": "2.6.2" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "node-abi", "purl": "pkg:npm/node-abi@3.62.0", "version": "3.62.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "node-fetch", "purl": "pkg:npm/node-fetch@2.7.0", "version": "2.7.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "node-gyp", "purl": "pkg:npm/node-gyp@10.1.0", "version": "10.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "node-html-parser", "purl": "pkg:npm/node-html-parser@6.1.13", "version": "6.1.13" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "node-releases", "purl": "pkg:npm/node-releases@2.0.6", "version": "2.0.6" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "nodejs", "purl": "pkg:npm/nodejs@0.0.0", "version": "0.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "nopt", "purl": "pkg:npm/nopt@7.2.1", "version": "7.2.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "normalize-package-data", "purl": "pkg:npm/normalize-package-data@2.5.0", "version": "2.5.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "normalize-package-data", "purl": "pkg:npm/normalize-package-data@3.0.3", "version": "3.0.3" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "normalize-url", "purl": "pkg:npm/normalize-url@6.1.0", "version": "6.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "nth-check", "purl": "pkg:npm/nth-check@2.1.1", "version": "2.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "object-inspect", "purl": "pkg:npm/object-inspect@1.12.2", "version": "1.12.2" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "object-inspect", "purl": "pkg:npm/object-inspect@1.13.1", "version": "1.13.1" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "object-is", "purl": "pkg:npm/object-is@1.1.5", "version": "1.1.5" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "object-is", "purl": "pkg:npm/object-is@1.1.6", "version": "1.1.6" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "object-keys", "purl": "pkg:npm/object-keys@1.1.1", "version": "1.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "object.assign", "purl": "pkg:npm/object.assign@4.1.4", "version": "4.1.4" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "object.assign", "purl": "pkg:npm/object.assign@4.1.5", "version": "4.1.5" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "object.entries", "purl": "pkg:npm/object.entries@1.1.6", "version": "1.1.6" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "object.fromentries", "purl": "pkg:npm/object.fromentries@2.0.6", "version": "2.0.6" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "object.pick", "purl": "pkg:npm/object.pick@1.3.0", "version": "1.3.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "object.values", "purl": "pkg:npm/object.values@1.1.5", "version": "1.1.5" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "once", "purl": "pkg:npm/once@1.4.0", "version": "1.4.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "openpgp", "purl": "pkg:npm/openpgp@5.11.1", "version": "5.11.1" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "optionator", "purl": "pkg:npm/optionator@0.9.3", "version": "0.9.3" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "p-all", "purl": "pkg:npm/p-all@3.0.0", "version": "3.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "p-cancelable", "purl": "pkg:npm/p-cancelable@2.1.1", "version": "2.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "p-filter", "purl": "pkg:npm/p-filter@2.1.0", "version": "2.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "p-finally", "purl": "pkg:npm/p-finally@1.0.0", "version": "1.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "p-limit", "purl": "pkg:npm/p-limit@2.3.0", "version": "2.3.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "p-limit", "purl": "pkg:npm/p-limit@3.1.0", "version": "3.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "p-locate", "purl": "pkg:npm/p-locate@4.1.0", "version": "4.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "p-locate", "purl": "pkg:npm/p-locate@5.0.0", "version": "5.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "p-map", "purl": "pkg:npm/p-map@2.1.0", "version": "2.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "p-map", "purl": "pkg:npm/p-map@4.0.0", "version": "4.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "p-queue", "purl": "pkg:npm/p-queue@6.6.2", "version": "6.6.2" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "p-throttle", "purl": "pkg:npm/p-throttle@4.1.1", "version": "4.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "p-timeout", "purl": "pkg:npm/p-timeout@3.2.0", "version": "3.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "p-try", "purl": "pkg:npm/p-try@2.2.0", "version": "2.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "parent-module", "purl": "pkg:npm/parent-module@1.0.1", "version": "1.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "parse-entities", "purl": "pkg:npm/parse-entities@2.0.0", "version": "2.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "parse-json", "purl": "pkg:npm/parse-json@5.2.0", "version": "5.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "parse-link-header", "purl": "pkg:npm/parse-link-header@2.0.0", "version": "2.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "parse-path", "purl": "pkg:npm/parse-path@7.0.0", "version": "7.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "parse-url", "purl": "pkg:npm/parse-url@8.1.0", "version": "8.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "path-exists", "purl": "pkg:npm/path-exists@4.0.0", "version": "4.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "path-is-absolute", "purl": "pkg:npm/path-is-absolute@1.0.1", "version": "1.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "path-key", "purl": "pkg:npm/path-key@3.1.1", "version": "3.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "path-parse", "purl": "pkg:npm/path-parse@1.0.7", "version": "1.0.7" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "path-scurry", "purl": "pkg:npm/path-scurry@1.10.2", "version": "1.10.2" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "path-scurry", "purl": "pkg:npm/path-scurry@1.11.1", "version": "1.11.1" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "path-type", "purl": "pkg:npm/path-type@4.0.0", "version": "4.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "pend", "purl": "pkg:npm/pend@1.2.0", "version": "1.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "pgp-utils", "purl": "pkg:npm/pgp-utils@0.0.35", "version": "0.0.35" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "picocolors", "purl": "pkg:npm/picocolors@1.0.0", "version": "1.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "picocolors", "purl": "pkg:npm/picocolors@1.0.1", "version": "1.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "picomatch", "purl": "pkg:npm/picomatch@2.3.1", "version": "2.3.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "possible-typed-array-names", "purl": "pkg:npm/possible-typed-array-names@1.0.0", "version": "1.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "prebuild-install", "purl": "pkg:npm/prebuild-install@7.1.2", "version": "7.1.2" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "prelude-ls", "purl": "pkg:npm/prelude-ls@1.2.1", "version": "1.2.1" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "prettier", "purl": "pkg:npm/prettier@3.2.5", "version": "3.2.5" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "prettier-linter-helpers", "purl": "pkg:npm/prettier-linter-helpers@1.0.0", "version": "1.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "proc-log", "purl": "pkg:npm/proc-log@3.0.0", "version": "3.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "proc-log", "purl": "pkg:npm/proc-log@4.2.0", "version": "4.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "process-nextick-args", "purl": "pkg:npm/process-nextick-args@2.0.1", "version": "2.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "progress", "purl": "pkg:npm/progress@1.1.8", "version": "1.1.8" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "promise-retry", "purl": "pkg:npm/promise-retry@2.0.1", "version": "2.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "protocols", "purl": "pkg:npm/protocols@2.0.1", "version": "2.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "pump", "purl": "pkg:npm/pump@3.0.0", "version": "3.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "punycode", "purl": "pkg:npm/punycode@2.1.1", "version": "2.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "punycode.js", "purl": "pkg:npm/punycode.js@2.3.1", "version": "2.3.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "purepack", "purl": "pkg:npm/purepack@1.0.6", "version": "1.0.6" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "qs", "purl": "pkg:npm/qs@6.12.1", "version": "6.12.1" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "queue-microtask", "purl": "pkg:npm/queue-microtask@1.2.3", "version": "1.2.3" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "quick-lru", "purl": "pkg:npm/quick-lru@4.0.1", "version": "4.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "quick-lru", "purl": "pkg:npm/quick-lru@5.1.1", "version": "5.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "randomatic", "purl": "pkg:npm/randomatic@3.1.1", "version": "3.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "rc", "purl": "pkg:npm/rc@1.2.8", "version": "1.2.8" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "re2", "purl": "pkg:npm/re2@1.20.11", "version": "1.20.11" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "read-pkg", "purl": "pkg:npm/read-pkg@5.2.0", "version": "5.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "read-pkg-up", "purl": "pkg:npm/read-pkg-up@7.0.1", "version": "7.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "read-yaml-file", "purl": "pkg:npm/read-yaml-file@2.1.0", "version": "2.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "readable-stream", "purl": "pkg:npm/readable-stream@2.3.8", "version": "2.3.8" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "readable-stream", "purl": "pkg:npm/readable-stream@3.6.2", "version": "3.6.2" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "redent", "purl": "pkg:npm/redent@3.0.0", "version": "3.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "redis", "purl": "pkg:npm/redis@4.6.13", "version": "4.6.13" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "regenerator-runtime", "purl": "pkg:npm/regenerator-runtime@0.13.11", "version": "0.13.11" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "regenerator-runtime", "purl": "pkg:npm/regenerator-runtime@0.14.1", "version": "0.14.1" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "regexp.prototype.flags", "purl": "pkg:npm/regexp.prototype.flags@1.4.3", "version": "1.4.3" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "regexp.prototype.flags", "purl": "pkg:npm/regexp.prototype.flags@1.5.2", "version": "1.5.2" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "remark", "purl": "pkg:npm/remark@13.0.0", "version": "13.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "remark-github", "purl": "pkg:npm/remark-github@10.1.0", "version": "10.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "remark-parse", "purl": "pkg:npm/remark-parse@9.0.0", "version": "9.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "remark-stringify", "purl": "pkg:npm/remark-stringify@9.0.1", "version": "9.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "remarkable", "purl": "pkg:npm/remarkable@1.7.4", "version": "1.7.4" }, { "ecosystem": "npm", "licenses": [ "AGPL-3.0-only" ], "location": "package-lock.json", "name": "renovate", "purl": "pkg:npm/renovate@37.374.1", "version": "37.374.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "repeat-element", "purl": "pkg:npm/repeat-element@1.1.4", "version": "1.1.4" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "repeat-string", "purl": "pkg:npm/repeat-string@1.6.1", "version": "1.6.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "require-in-the-middle", "purl": "pkg:npm/require-in-the-middle@7.3.0", "version": "7.3.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "resolve", "purl": "pkg:npm/resolve@1.22.1", "version": "1.22.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "resolve", "purl": "pkg:npm/resolve@1.22.8", "version": "1.22.8" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "resolve-alpn", "purl": "pkg:npm/resolve-alpn@1.2.1", "version": "1.2.1" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "resolve-from", "purl": "pkg:npm/resolve-from@4.0.0", "version": "4.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "responselike", "purl": "pkg:npm/responselike@2.0.1", "version": "2.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "retry", "purl": "pkg:npm/retry@0.12.0", "version": "0.12.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "reusify", "purl": "pkg:npm/reusify@1.0.4", "version": "1.0.4" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "rimraf", "purl": "pkg:npm/rimraf@2.4.5", "version": "2.4.5" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "rimraf", "purl": "pkg:npm/rimraf@3.0.2", "version": "3.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "roarr", "purl": "pkg:npm/roarr@2.15.4", "version": "2.15.4" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "run-parallel", "purl": "pkg:npm/run-parallel@1.2.0", "version": "1.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "safe-array-concat", "purl": "pkg:npm/safe-array-concat@1.1.2", "version": "1.1.2" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "safe-buffer", "purl": "pkg:npm/safe-buffer@5.1.2", "version": "5.1.2" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "safe-json-stringify", "purl": "pkg:npm/safe-json-stringify@1.2.0", "version": "1.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "safe-regex-test", "purl": "pkg:npm/safe-regex-test@1.0.0", "version": "1.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "safe-regex-test", "purl": "pkg:npm/safe-regex-test@1.0.3", "version": "1.0.3" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "safe-stable-stringify", "purl": "pkg:npm/safe-stable-stringify@2.4.3", "version": "2.4.3" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "safer-buffer", "purl": "pkg:npm/safer-buffer@2.1.2", "version": "2.1.2" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "sax", "purl": "pkg:npm/sax@1.3.0", "version": "1.3.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "semver", "purl": "pkg:npm/semver@5.7.2", "version": "5.7.2" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "semver", "purl": "pkg:npm/semver@6.3.1", "version": "6.3.1" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "semver", "purl": "pkg:npm/semver@7.6.0", "version": "7.6.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "semver", "purl": "pkg:npm/semver@7.6.2", "version": "7.6.2" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "semver-compare", "purl": "pkg:npm/semver-compare@1.0.0", "version": "1.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "semver-stable", "purl": "pkg:npm/semver-stable@3.0.0", "version": "3.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "semver-utils", "purl": "pkg:npm/semver-utils@1.1.4", "version": "1.1.4" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "serialize-error", "purl": "pkg:npm/serialize-error@7.0.1", "version": "7.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "set-function-length", "purl": "pkg:npm/set-function-length@1.2.2", "version": "1.2.2" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "set-function-name", "purl": "pkg:npm/set-function-name@2.0.2", "version": "2.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "set-getter", "purl": "pkg:npm/set-getter@0.1.1", "version": "0.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "setup-slsa-verifier", "purl": "pkg:npm/setup-slsa-verifier@0.0.1", "version": "0.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "shebang-command", "purl": "pkg:npm/shebang-command@2.0.0", "version": "2.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "shebang-regex", "purl": "pkg:npm/shebang-regex@3.0.0", "version": "3.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "shimmer", "purl": "pkg:npm/shimmer@1.2.1", "version": "1.2.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "shlex", "purl": "pkg:npm/shlex@2.1.2", "version": "2.1.2" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "side-channel", "purl": "pkg:npm/side-channel@1.0.4", "version": "1.0.4" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "side-channel", "purl": "pkg:npm/side-channel@1.0.6", "version": "1.0.6" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "signal-exit", "purl": "pkg:npm/signal-exit@3.0.7", "version": "3.0.7" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "signal-exit", "purl": "pkg:npm/signal-exit@4.0.2", "version": "4.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "signal-exit", "purl": "pkg:npm/signal-exit@4.1.0", "version": "4.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "simple-concat", "purl": "pkg:npm/simple-concat@1.0.1", "version": "1.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "simple-get", "purl": "pkg:npm/simple-get@4.0.1", "version": "4.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "simple-git", "purl": "pkg:npm/simple-git@3.24.0", "version": "3.24.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "slash", "purl": "pkg:npm/slash@3.0.0", "version": "3.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "slugify", "purl": "pkg:npm/slugify@1.6.6", "version": "1.6.6" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "smart-buffer", "purl": "pkg:npm/smart-buffer@4.2.0", "version": "4.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "socks", "purl": "pkg:npm/socks@2.8.3", "version": "2.8.3" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "socks-proxy-agent", "purl": "pkg:npm/socks-proxy-agent@8.0.3", "version": "8.0.3" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "sort-keys", "purl": "pkg:npm/sort-keys@4.2.0", "version": "4.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "source-map", "purl": "pkg:npm/source-map@0.6.1", "version": "0.6.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "source-map-support", "purl": "pkg:npm/source-map-support@0.5.21", "version": "0.5.21" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "spdx-correct", "purl": "pkg:npm/spdx-correct@3.2.0", "version": "3.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "spdx-exceptions", "purl": "pkg:npm/spdx-exceptions@2.5.0", "version": "2.5.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "spdx-expression-parse", "purl": "pkg:npm/spdx-expression-parse@3.0.1", "version": "3.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "spdx-license-ids", "purl": "pkg:npm/spdx-license-ids@3.0.17", "version": "3.0.17" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "split2", "purl": "pkg:npm/split2@3.2.2", "version": "3.2.2" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "sprintf-js", "purl": "pkg:npm/sprintf-js@1.0.3", "version": "1.0.3" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "sprintf-js", "purl": "pkg:npm/sprintf-js@1.1.3", "version": "1.1.3" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "ssri", "purl": "pkg:npm/ssri@10.0.6", "version": "10.0.6" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "stop-iteration-iterator", "purl": "pkg:npm/stop-iteration-iterator@1.0.0", "version": "1.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "string-width", "purl": "pkg:npm/string-width@4.2.3", "version": "4.2.3" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "string-width", "purl": "pkg:npm/string-width@5.1.2", "version": "5.1.2" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "string.prototype.trim", "purl": "pkg:npm/string.prototype.trim@1.2.9", "version": "1.2.9" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "string.prototype.trimend", "purl": "pkg:npm/string.prototype.trimend@1.0.6", "version": "1.0.6" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "string.prototype.trimend", "purl": "pkg:npm/string.prototype.trimend@1.0.8", "version": "1.0.8" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "string.prototype.trimstart", "purl": "pkg:npm/string.prototype.trimstart@1.0.6", "version": "1.0.6" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "string.prototype.trimstart", "purl": "pkg:npm/string.prototype.trimstart@1.0.8", "version": "1.0.8" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "string_decoder", "purl": "pkg:npm/string_decoder@1.1.1", "version": "1.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "strip-ansi", "purl": "pkg:npm/strip-ansi@6.0.1", "version": "6.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "strip-ansi", "purl": "pkg:npm/strip-ansi@7.0.1", "version": "7.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "strip-ansi", "purl": "pkg:npm/strip-ansi@7.1.0", "version": "7.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "strip-bom", "purl": "pkg:npm/strip-bom@3.0.0", "version": "3.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "strip-bom", "purl": "pkg:npm/strip-bom@4.0.0", "version": "4.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "strip-color", "purl": "pkg:npm/strip-color@0.1.0", "version": "0.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "strip-comments-strings", "purl": "pkg:npm/strip-comments-strings@1.2.0", "version": "1.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "strip-indent", "purl": "pkg:npm/strip-indent@3.0.0", "version": "3.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "strip-json-comments", "purl": "pkg:npm/strip-json-comments@2.0.1", "version": "2.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "strip-json-comments", "purl": "pkg:npm/strip-json-comments@3.1.1", "version": "3.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "strnum", "purl": "pkg:npm/strnum@1.0.5", "version": "1.0.5" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "supports-color", "purl": "pkg:npm/supports-color@5.5.0", "version": "5.5.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "supports-color", "purl": "pkg:npm/supports-color@7.2.0", "version": "7.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "supports-preserve-symlinks-flag", "purl": "pkg:npm/supports-preserve-symlinks-flag@1.0.0", "version": "1.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "svg-element-attributes", "purl": "pkg:npm/svg-element-attributes@1.3.1", "version": "1.3.1" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "synckit", "purl": "pkg:npm/synckit@0.8.8", "version": "0.8.8" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "tar", "purl": "pkg:npm/tar@6.2.1", "version": "6.2.1" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "package-lock.json", "name": "tar-fs", "purl": "pkg:npm/tar-fs@2.1.3", "version": "2.1.3" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "tar-stream", "purl": "pkg:npm/tar-stream@2.2.0", "version": "2.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "text-table", "purl": "pkg:npm/text-table@0.2.0", "version": "0.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "through2", "purl": "pkg:npm/through2@2.0.5", "version": "2.0.5" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "through2", "purl": "pkg:npm/through2@4.0.2", "version": "4.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "through2-concurrent", "purl": "pkg:npm/through2-concurrent@2.0.0", "version": "2.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "tinylogic", "purl": "pkg:npm/tinylogic@2.0.0", "version": "2.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "to-object-path", "purl": "pkg:npm/to-object-path@0.3.0", "version": "0.3.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "to-regex-range", "purl": "pkg:npm/to-regex-range@5.0.1", "version": "5.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "toml", "purl": "pkg:npm/toml@2.3.6", "version": "2.3.6" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "toml-eslint-parser", "purl": "pkg:npm/toml-eslint-parser@0.9.3", "version": "0.9.3" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "tr46", "purl": "pkg:npm/tr46@0.0.3", "version": "0.0.3" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "traverse", "purl": "pkg:npm/traverse@0.6.9", "version": "0.6.9" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "treeify", "purl": "pkg:npm/treeify@1.1.0", "version": "1.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "trim-newlines", "purl": "pkg:npm/trim-newlines@3.0.1", "version": "3.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "triplesec", "purl": "pkg:npm/triplesec@4.0.3", "version": "4.0.3" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "trough", "purl": "pkg:npm/trough@1.0.5", "version": "1.0.5" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "ts-api-utils", "purl": "pkg:npm/ts-api-utils@1.3.0", "version": "1.3.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "tsconfig-paths", "purl": "pkg:npm/tsconfig-paths@3.14.1", "version": "3.14.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "tslib", "purl": "pkg:npm/tslib@1.14.1", "version": "1.14.1" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "tslib", "purl": "pkg:npm/tslib@2.6.2", "version": "2.6.2" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "tunnel", "purl": "pkg:npm/tunnel@0.0.6", "version": "0.0.6" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "tunnel-agent", "purl": "pkg:npm/tunnel-agent@0.6.0", "version": "0.6.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "tweetnacl", "purl": "pkg:npm/tweetnacl@0.13.3", "version": "0.13.3" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "tweetnacl", "purl": "pkg:npm/tweetnacl@1.0.3", "version": "1.0.3" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "typanion", "purl": "pkg:npm/typanion@3.14.0", "version": "3.14.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "type-check", "purl": "pkg:npm/type-check@0.4.0", "version": "0.4.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "type-fest", "purl": "pkg:npm/type-fest@0.13.1", "version": "0.13.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "type-fest", "purl": "pkg:npm/type-fest@0.18.1", "version": "0.18.1" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "type-fest", "purl": "pkg:npm/type-fest@0.20.2", "version": "0.20.2" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "type-fest", "purl": "pkg:npm/type-fest@0.6.0", "version": "0.6.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "type-fest", "purl": "pkg:npm/type-fest@0.8.1", "version": "0.8.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "typed-array-buffer", "purl": "pkg:npm/typed-array-buffer@1.0.2", "version": "1.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "typed-array-byte-length", "purl": "pkg:npm/typed-array-byte-length@1.0.1", "version": "1.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "typed-array-byte-offset", "purl": "pkg:npm/typed-array-byte-offset@1.0.2", "version": "1.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "typed-array-length", "purl": "pkg:npm/typed-array-length@1.0.4", "version": "1.0.4" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "typed-array-length", "purl": "pkg:npm/typed-array-length@1.0.6", "version": "1.0.6" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "typed-rest-client", "purl": "pkg:npm/typed-rest-client@1.8.11", "version": "1.8.11" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "typedarray", "purl": "pkg:npm/typedarray@0.0.6", "version": "0.0.6" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "typedarray-to-buffer", "purl": "pkg:npm/typedarray-to-buffer@3.1.5", "version": "3.1.5" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "typedarray.prototype.slice", "purl": "pkg:npm/typedarray.prototype.slice@1.0.3", "version": "1.0.3" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "typescript", "purl": "pkg:npm/typescript@5.4.3", "version": "5.4.3" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "typescript-eslint", "purl": "pkg:npm/typescript-eslint@7.5.0", "version": "7.5.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "uc.micro", "purl": "pkg:npm/uc.micro@2.1.0", "version": "2.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "uglify-js", "purl": "pkg:npm/uglify-js@3.17.4", "version": "3.17.4" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "uint64be", "purl": "pkg:npm/uint64be@1.0.1", "version": "1.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "unbox-primitive", "purl": "pkg:npm/unbox-primitive@1.0.2", "version": "1.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "underscore", "purl": "pkg:npm/underscore@1.13.6", "version": "1.13.6" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "actions/installer/package-lock.json", "name": "undici", "purl": "pkg:npm/undici@5.29.0", "version": "5.29.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "undici-types", "purl": "pkg:npm/undici-types@5.26.5", "version": "5.26.5" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "unified", "purl": "pkg:npm/unified@9.2.2", "version": "9.2.2" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "unique-filename", "purl": "pkg:npm/unique-filename@3.0.0", "version": "3.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "unique-slug", "purl": "pkg:npm/unique-slug@4.0.0", "version": "4.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "unist-util-is", "purl": "pkg:npm/unist-util-is@4.1.0", "version": "4.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "unist-util-stringify-position", "purl": "pkg:npm/unist-util-stringify-position@2.0.3", "version": "2.0.3" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "unist-util-visit", "purl": "pkg:npm/unist-util-visit@2.0.3", "version": "2.0.3" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "unist-util-visit-parents", "purl": "pkg:npm/unist-util-visit-parents@3.1.1", "version": "3.1.1" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "universal-user-agent", "purl": "pkg:npm/universal-user-agent@6.0.1", "version": "6.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "universalify", "purl": "pkg:npm/universalify@2.0.1", "version": "2.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "upath", "purl": "pkg:npm/upath@2.0.1", "version": "2.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "update-browserslist-db", "purl": "pkg:npm/update-browserslist-db@1.0.5", "version": "1.0.5" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "uri-js", "purl": "pkg:npm/uri-js@4.4.1", "version": "4.4.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "url-join", "purl": "pkg:npm/url-join@4.0.1", "version": "4.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "util", "purl": "pkg:npm/util@0.12.5", "version": "0.12.5" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "util-deprecate", "purl": "pkg:npm/util-deprecate@1.0.2", "version": "1.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "uuid", "purl": "pkg:npm/uuid@9.0.1", "version": "9.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "validate-npm-package-license", "purl": "pkg:npm/validate-npm-package-license@3.0.4", "version": "3.0.4" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "validate-npm-package-name", "purl": "pkg:npm/validate-npm-package-name@5.0.1", "version": "5.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "vfile", "purl": "pkg:npm/vfile@4.2.1", "version": "4.2.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "vfile-message", "purl": "pkg:npm/vfile-message@2.0.4", "version": "2.0.4" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "vuln-vects", "purl": "pkg:npm/vuln-vects@1.1.0", "version": "1.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "webidl-conversions", "purl": "pkg:npm/webidl-conversions@3.0.1", "version": "3.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "whatwg-url", "purl": "pkg:npm/whatwg-url@5.0.0", "version": "5.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "which", "purl": "pkg:npm/which@2.0.2", "version": "2.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "which", "purl": "pkg:npm/which@4.0.0", "version": "4.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "which-boxed-primitive", "purl": "pkg:npm/which-boxed-primitive@1.0.2", "version": "1.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "which-collection", "purl": "pkg:npm/which-collection@1.0.1", "version": "1.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "which-collection", "purl": "pkg:npm/which-collection@1.0.2", "version": "1.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "which-typed-array", "purl": "pkg:npm/which-typed-array@1.1.15", "version": "1.1.15" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "which-typed-array", "purl": "pkg:npm/which-typed-array@1.1.9", "version": "1.1.9" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "wordwrap", "purl": "pkg:npm/wordwrap@1.0.0", "version": "1.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "wrap-ansi", "purl": "pkg:npm/wrap-ansi@7.0.0", "version": "7.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "wrap-ansi", "purl": "pkg:npm/wrap-ansi@8.1.0", "version": "8.1.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "wrappy", "purl": "pkg:npm/wrappy@1.0.2", "version": "1.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "write-file-atomic", "purl": "pkg:npm/write-file-atomic@3.0.3", "version": "3.0.3" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "write-file-atomic", "purl": "pkg:npm/write-file-atomic@5.0.1", "version": "5.0.1" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "write-yaml-file", "purl": "pkg:npm/write-yaml-file@4.2.0", "version": "4.2.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "xmldoc", "purl": "pkg:npm/xmldoc@1.3.0", "version": "1.3.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "xtend", "purl": "pkg:npm/xtend@4.0.2", "version": "4.0.2" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "yallist", "purl": "pkg:npm/yallist@4.0.0", "version": "4.0.0" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "yargs-parser", "purl": "pkg:npm/yargs-parser@18.1.3", "version": "18.1.3" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "yargs-parser", "purl": "pkg:npm/yargs-parser@20.2.9", "version": "20.2.9" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "yauzl", "purl": "pkg:npm/yauzl@2.10.0", "version": "2.10.0" }, { "ecosystem": "npm", "licenses": [], "location": "actions/installer/package-lock.json", "name": "yocto-queue", "purl": "pkg:npm/yocto-queue@0.1.0", "version": "0.1.0" }, { "ecosystem": "npm", "licenses": [ "MIT" ], "location": "package-lock.json", "name": "zod", "purl": "pkg:npm/zod@3.23.8", "version": "3.23.8" }, { "ecosystem": "npm", "licenses": [], "location": "package-lock.json", "name": "zwitch", "purl": "pkg:npm/zwitch@1.0.5", "version": "1.0.5" }, { "ecosystem": "pypi", "licenses": [], "location": "requirements-lint.txt", "name": "pathspec", "purl": "pkg:pypi/pathspec@0.12.1", "version": "0.12.1" }, { "ecosystem": "pypi", "licenses": [], "location": "requirements-lint.txt", "name": "pyyaml", "purl": "pkg:pypi/pyyaml@6.0.2", "version": "6.0.2" }, { "ecosystem": "pypi", "licenses": [], "location": "requirements-lint.txt", "name": "yamllint", "purl": "pkg:pypi/yamllint@1.35.1", "version": "1.35.1" }, { "ecosystem": "unknown", "licenses": [], "location": ".github/workflows/e2e.schedule.installer.yml", "name": "./actions/installer", "purl": "", "version": "UNKNOWN" } ], "description": "Verify SLSA provenance for supply chain security", "errors": [], "go_binary": { "asset": "slsa-verifier-linux-amd64", "binary": "slsa-verifier-linux-amd64", "db": "https://vuln.go.dev", "db_last_modified": "2026-10-27T21:16:18Z", "findings": [ { "aliases": [ "CVE-2025-22870", "GHSA-qxp5-gwg8-xv66" ], "epss": { "cve": "CVE-2025-22870", "percentile": 0.36779, "score": 0.00425 }, "fixed_version": "v1.23.7", "id": "GO-2025-3503", "kev": null, "level": "symbol", "module": "stdlib", "summary": "HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net", "version": "v1.23.5" }, { "aliases": [ "CVE-2025-22871" ], "epss": { "cve": "CVE-2025-22871", "percentile": 0.57935, "score": 0.00842 }, "fixed_version": "v1.23.8", "id": "GO-2025-3563", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Request smuggling due to acceptance of invalid chunked data in net/http", "version": "v1.23.5" }, { "aliases": [ "CVE-2025-4673" ], "epss": { "cve": "CVE-2025-4673", "percentile": 0.51827, "score": 0.00666 }, "fixed_version": "v1.23.10", "id": "GO-2025-3751", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Sensitive headers not cleared on cross-origin redirect in net/http", "version": "v1.23.5" }, { "aliases": [ "CVE-2025-47906", "CVE-2025-47906" ], "epss": { "cve": "CVE-2025-47906", "percentile": 0.46025, "score": 0.0055 }, "fixed_version": "v1.23.12", "id": "GO-2025-3956", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Unexpected paths returned from LookPath in os/exec", "version": "v1.23.5" }, { "aliases": [ "CVE-2025-61725", "CVE-2025-61725" ], "epss": { "cve": "CVE-2025-61725", "percentile": 0.51041, "score": 0.00647 }, "fixed_version": "v1.24.8", "id": "GO-2025-4006", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Excessive CPU consumption in ParseAddress in net/mail", "version": "v1.23.5" }, { "aliases": [ "CVE-2025-58187", "CVE-2025-58187" ], "epss": { "cve": "CVE-2025-58187", "percentile": 0.34877, "score": 0.00406 }, "fixed_version": "v1.24.9", "id": "GO-2025-4007", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Quadratic complexity when checking name constraints in crypto/x509", "version": "v1.23.5" }, { "aliases": [ "CVE-2025-58189", "CVE-2025-58189" ], "epss": { "cve": "CVE-2025-58189", "percentile": 0.40494, "score": 0.00468 }, "fixed_version": "v1.24.8", "id": "GO-2025-4008", "kev": null, "level": "symbol", "module": "stdlib", "summary": "ALPN negotiation error contains attacker controlled information in crypto/tls", "version": "v1.23.5" }, { "aliases": [ "CVE-2025-61723", "CVE-2025-61723" ], "epss": { "cve": "CVE-2025-61723", "percentile": 0.51648, "score": 0.00661 }, "fixed_version": "v1.24.8", "id": "GO-2025-4009", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Quadratic complexity when parsing some invalid inputs in encoding/pem", "version": "v1.23.5" }, { "aliases": [ "CVE-2025-47912", "CVE-2025-47912" ], "epss": { "cve": "CVE-2025-47912", "percentile": 0.40493, "score": 0.00468 }, "fixed_version": "v1.24.8", "id": "GO-2025-4010", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Insufficient validation of bracketed IPv6 hostnames in net/url", "version": "v1.23.5" }, { "aliases": [ "CVE-2025-58185", "CVE-2025-58185" ], "epss": { "cve": "CVE-2025-58185", "percentile": 0.46363, "score": 0.00556 }, "fixed_version": "v1.24.8", "id": "GO-2025-4011", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Parsing DER payload can cause memory exhaustion in encoding/asn1", "version": "v1.23.5" }, { "aliases": [ "CVE-2025-58186", "CVE-2025-58186" ], "epss": { "cve": "CVE-2025-58186", "percentile": 0.46913, "score": 0.00565 }, "fixed_version": "v1.24.8", "id": "GO-2025-4012", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Lack of limit when parsing cookies can cause memory exhaustion in net/http", "version": "v1.23.5" }, { "aliases": [ "CVE-2025-58188", "CVE-2025-58188" ], "epss": { "cve": "CVE-2025-58188", "percentile": 0.32165, "score": 0.00381 }, "fixed_version": "v1.24.8", "id": "GO-2025-4013", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Panic when validating certificates with DSA public keys in crypto/x509", "version": "v1.23.5" }, { "aliases": [ "CVE-2025-61724", "CVE-2025-61724" ], "epss": { "cve": "CVE-2025-61724", "percentile": 0.46363, "score": 0.00556 }, "fixed_version": "v1.24.8", "id": "GO-2025-4015", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Excessive CPU consumption in Reader.ReadResponse in net/textproto", "version": "v1.23.5" }, { "aliases": [ "CVE-2025-61729", "CVE-2025-61729" ], "epss": { "cve": "CVE-2025-61729", "percentile": 0.39638, "score": 0.00457 }, "fixed_version": "v1.24.11", "id": "GO-2025-4155", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Excessive resource consumption when printing error string for host certificate validation in crypto/x509", "version": "v1.23.5" }, { "aliases": [ "CVE-2025-61727" ], "epss": { "cve": "CVE-2025-61727", "percentile": 0.20933, "score": 0.00284 }, "fixed_version": "v1.24.11", "id": "GO-2025-4175", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509", "version": "v1.23.5" }, { "aliases": [ "CVE-2025-68121" ], "epss": { "cve": "CVE-2025-68121", "percentile": 0.59731, "score": 0.00902 }, "fixed_version": "v1.24.13", "id": "GO-2026-4337", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Unexpected session resumption in crypto/tls", "version": "v1.23.5" }, { "aliases": [ "CVE-2025-61730", "CVE-2025-61730" ], "epss": { "cve": "CVE-2025-61730", "percentile": 0.25445, "score": 0.00324 }, "fixed_version": "v1.24.12", "id": "GO-2026-4340", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Handshake messages may be processed at the incorrect encryption level in crypto/tls", "version": "v1.23.5" }, { "aliases": [ "CVE-2025-61726", "CVE-2025-61726" ], "epss": { "cve": "CVE-2025-61726", "percentile": 0.83237, "score": 0.02292 }, "fixed_version": "v1.24.12", "id": "GO-2026-4341", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Memory exhaustion in query parameter parsing in net/url", "version": "v1.23.5" }, { "aliases": [ "CVE-2026-25679" ], "epss": { "cve": "CVE-2026-25679", "percentile": 0.57493, "score": 0.00827 }, "fixed_version": "v1.25.8", "id": "GO-2026-4601", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Incorrect parsing of IPv6 host literals in net/url", "version": "v1.23.5" }, { "aliases": [ "CVE-2026-27139" ], "epss": { "cve": "CVE-2026-27139", "percentile": 0.12457, "score": 0.00219 }, "fixed_version": "v1.25.8", "id": "GO-2026-4602", "kev": null, "level": "symbol", "module": "stdlib", "summary": "FileInfo can escape from a Root in os", "version": "v1.23.5" }, { "aliases": [ "CVE-2026-27142" ], "epss": { "cve": "CVE-2026-27142", "percentile": 0.31368, "score": 0.00374 }, "fixed_version": "v1.25.8", "id": "GO-2026-4603", "kev": null, "level": "symbol", "module": "stdlib", "summary": "URLs in meta content attribute actions are not escaped in html/template", "version": "v1.23.5" }, { "aliases": [ "CVE-2026-32289" ], "epss": { "cve": "CVE-2026-32289", "percentile": 0.21611, "score": 0.0029 }, "fixed_version": "v1.25.9", "id": "GO-2026-4865", "kev": null, "level": "symbol", "module": "stdlib", "summary": "JsBraceDepth Context Tracking Bugs (XSS) in html/template", "version": "v1.23.5" }, { "aliases": [ "CVE-2026-32283" ], "epss": { "cve": "CVE-2026-32283", "percentile": 0.49799, "score": 0.00621 }, "fixed_version": "v1.25.9", "id": "GO-2026-4870", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls", "version": "v1.23.5" }, { "aliases": [ "CVE-2026-33814" ], "epss": { "cve": "CVE-2026-33814", "percentile": 0.57885, "score": 0.0084 }, "fixed_version": "v1.25.10", "id": "GO-2026-4918", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net", "version": "v1.23.5" }, { "aliases": [ "CVE-2026-32281" ], "epss": { "cve": "CVE-2026-32281", "percentile": 0.2925, "score": 0.00355 }, "fixed_version": "v1.25.9", "id": "GO-2026-4946", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Inefficient policy validation in crypto/x509", "version": "v1.23.5" }, { "aliases": [ "CVE-2026-32280" ], "epss": { "cve": "CVE-2026-32280", "percentile": 0.49458, "score": 0.00615 }, "fixed_version": "v1.25.9", "id": "GO-2026-4947", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Unexpected work during chain building in crypto/x509", "version": "v1.23.5" }, { "aliases": [ "CVE-2026-39836" ], "epss": { "cve": "CVE-2026-39836", "percentile": 0.50332, "score": 0.00633 }, "fixed_version": "v1.25.10", "id": "GO-2026-4971", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Panic in Dial and LookupPort when handling NUL byte on Windows in net", "version": "v1.23.5" }, { "aliases": [ "CVE-2026-42499" ], "epss": { "cve": "CVE-2026-42499", "percentile": 0.56521, "score": 0.00798 }, "fixed_version": "v1.25.10", "id": "GO-2026-4977", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Quadratic string concatenation in consumePhrase in net/mail", "version": "v1.23.5" }, { "aliases": [ "CVE-2026-39826" ], "epss": { "cve": "CVE-2026-39826", "percentile": 0.31066, "score": 0.00371 }, "fixed_version": "v1.25.10", "id": "GO-2026-4980", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Escaper bypass leads to XSS in html/template", "version": "v1.23.5" }, { "aliases": [ "CVE-2026-33811" ], "epss": { "cve": "CVE-2026-33811", "percentile": 0.58975, "score": 0.00875 }, "fixed_version": "v1.25.10", "id": "GO-2026-4981", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Crash when handling long CNAME response in net", "version": "v1.23.5" }, { "aliases": [ "CVE-2026-39823" ], "epss": { "cve": "CVE-2026-39823", "percentile": 0.24388, "score": 0.00314 }, "fixed_version": "v1.25.10", "id": "GO-2026-4982", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Bypass of meta content URL escaping causes XSS in html/template", "version": "v1.23.5" }, { "aliases": [ "CVE-2026-39820" ], "epss": { "cve": "CVE-2026-39820", "percentile": 0.56059, "score": 0.00784 }, "fixed_version": "v1.25.10", "id": "GO-2026-4986", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Quadratic string concatentation in consumeComment in net/mail", "version": "v1.23.5" }, { "aliases": [ "CVE-2026-39821" ], "epss": { "cve": "CVE-2026-39821", "percentile": 0.78915, "score": 0.01834 }, "fixed_version": "v1.25.13", "id": "GO-2026-5026", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna", "version": "v1.23.5" }, { "aliases": [ "CVE-2026-27145" ], "epss": { "cve": "CVE-2026-27145", "percentile": 0.48256, "score": 0.00591 }, "fixed_version": "v1.25.11", "id": "GO-2026-5037", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Inefficient candidate hostname parsing in crypto/x509", "version": "v1.23.5" }, { "aliases": [ "CVE-2026-42507" ], "epss": { "cve": "CVE-2026-42507", "percentile": 0.30985, "score": 0.0037 }, "fixed_version": "v1.25.11", "id": "GO-2026-5039", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Arbitrary inputs are included in errors without any escaping in net/textproto", "version": "v1.23.5" }, { "aliases": [ "CVE-2026-42505" ], "epss": { "cve": "CVE-2026-42505", "percentile": 0.32254, "score": 0.00382 }, "fixed_version": "v1.25.12", "id": "GO-2026-5856", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Invoking Encrypted Client Hello privacy leak in crypto/tls", "version": "v1.23.5" }, { "aliases": [ "CVE-2026-33818" ], "epss": { "cve": "CVE-2026-33818", "percentile": 0.47077, "score": 0.00568 }, "fixed_version": "v1.25.13", "id": "GO-2026-5972", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Enforce maximum recursion depth in encoding/asn1", "version": "v1.23.5" }, { "aliases": [ "CVE-2026-56859" ], "epss": { "cve": "CVE-2026-56859", "percentile": 0.47076, "score": 0.00568 }, "fixed_version": "v1.25.13", "id": "GO-2026-6088", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Add recursion depth guard during decode in encoding/xml", "version": "v1.23.5" }, { "aliases": [ "CVE-2026-56862" ], "epss": { "cve": "CVE-2026-56862", "percentile": 0.47076, "score": 0.00568 }, "fixed_version": "v1.25.13", "id": "GO-2026-6090", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Limit handshake messages we are willing to accept post-handshake in crypto/tls", "version": "v1.23.5" }, { "aliases": [ "CVE-2026-56858" ], "epss": { "cve": "CVE-2026-56858", "percentile": 0.23831, "score": 0.0031 }, "fixed_version": "v1.25.13", "id": "GO-2026-6091", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Fix Javascript regexp context tracking in html/template", "version": "v1.23.5" }, { "aliases": [ "CVE-2026-56860" ], "epss": { "cve": "CVE-2026-56860", "percentile": 0.46041, "score": 0.0055 }, "fixed_version": "v1.25.13", "id": "GO-2026-6218", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Avoid quadratic complexity in resolvePath in net/url", "version": "v1.23.5" }, { "aliases": [ "CVE-2026-94448" ], "epss": { "cve": "CVE-2026-94448", "percentile": 0.21475, "score": 0.00289 }, "fixed_version": "v1.26.9", "id": "GO-2026-6599", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Reset context tracking on consecutive template expressions in html/template", "version": "v1.23.5" }, { "aliases": [ "CVE-2026-97030" ], "epss": { "cve": "CVE-2026-97030", "percentile": 0.21475, "score": 0.00289 }, "fixed_version": "v1.26.9", "id": "GO-2026-6600", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Recognize yield as regexp preceder keyword in html/template", "version": "v1.23.5" }, { "aliases": [ "CVE-2026-78659" ], "epss": { "cve": "CVE-2026-78659", "percentile": 0.50082, "score": 0.00627 }, "fixed_version": "v1.26.9", "id": "GO-2026-6603", "kev": null, "level": "symbol", "module": "stdlib", "summary": "HTTP/2 server memory exhaustion due to Trailer headers in net/http", "version": "v1.23.5" }, { "aliases": [ "CVE-2026-56866" ], "epss": { "cve": "CVE-2026-56866", "percentile": 0.40968, "score": 0.00473 }, "fixed_version": "v1.26.9", "id": "GO-2026-6605", "kev": null, "level": "symbol", "module": "stdlib", "summary": "HTTP/1 client connection desynchronization after CONNECT rejection in net/http", "version": "v1.23.5" }, { "aliases": [ "CVE-2026-97031" ], "epss": { "cve": "CVE-2026-97031", "percentile": 0.44095, "score": 0.00519 }, "fixed_version": "v1.26.9", "id": "GO-2026-6607", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Reject malformed ECH outer extension references in crypto/tls", "version": "v1.23.5" }, { "aliases": [ "CVE-2026-94440" ], "epss": { "cve": "CVE-2026-94440", "percentile": 0.4362, "score": 0.00511 }, "fixed_version": "v1.26.9", "id": "GO-2026-6608", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart", "version": "v1.23.5" }, { "aliases": [ "CVE-2026-78660" ], "epss": { "cve": "CVE-2026-78660", "percentile": 0.36838, "score": 0.00425 }, "fixed_version": "v1.26.9", "id": "GO-2026-6610", "kev": null, "level": "symbol", "module": "stdlib", "summary": "HTTP/2 transport accepts malformed framing-related headers in net/http", "version": "v1.23.5" }, { "aliases": [ "CVE-2026-78669" ], "epss": { "cve": "CVE-2026-78669", "percentile": 0.49426, "score": 0.00614 }, "fixed_version": "v1.26.9", "id": "GO-2026-6611", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Excessive CPU consumption from repeated initial window changes in net/http", "version": "v1.23.5" }, { "aliases": [ "CVE-2026-78663" ], "epss": { "cve": "CVE-2026-78663", "percentile": 0.49813, "score": 0.00622 }, "fixed_version": "v1.26.9", "id": "GO-2026-6612", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Double flow control refund on HTTP/2 server streams in net/http", "version": "v1.23.5" }, { "aliases": [ "CVE-2026-94439" ], "epss": { "cve": "CVE-2026-94439", "percentile": 0.35772, "score": 0.00414 }, "fixed_version": "v1.26.9", "id": "GO-2026-6613", "kev": null, "level": "symbol", "module": "stdlib", "summary": "HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http", "version": "v1.23.5" }, { "aliases": [ "CVE-2026-97032" ], "epss": { "cve": "CVE-2026-97032", "percentile": 0.42154, "score": 0.0049 }, "fixed_version": "v1.26.9", "id": "GO-2026-6617", "kev": null, "level": "symbol", "module": "stdlib", "summary": "HTTP/2 server crash due to HPACK encoder race in net/http", "version": "v1.23.5" }, { "aliases": [ "CVE-2026-111943" ], "epss": { "cve": "CVE-2026-111943", "percentile": 0.33793, "score": 0.00396 }, "fixed_version": "v1.26.10", "id": "GO-2026-6809", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Distrust compromised intermediate certificates in crypto/x509", "version": "v1.23.5" }, { "aliases": [ "GHSA-mqqf-5wvp-8fh8" ], "epss": null, "fixed_version": "", "id": "GO-2026-4316", "kev": null, "level": "symbol", "module": "github.com/go-chi/chi", "summary": "Open redirect vulnerability in the RedirectSlashes middleware in github.com/go-chi/chi", "version": "v4.1.2+incompatible" }, { "aliases": [ "CVE-2026-34986", "GHSA-78h2-9frx-2jm8" ], "epss": { "cve": "CVE-2026-34986", "percentile": 0.51213, "score": 0.00651 }, "fixed_version": "v4.1.4", "id": "GO-2026-4945", "kev": null, "level": "symbol", "module": "github.com/go-jose/go-jose/v4", "summary": "Go JOSE Panics in JWE decryption in github.com/go-jose/go-jose", "version": "v4.0.5" }, { "aliases": [ "CVE-2026-22703", "GHSA-whqx-f9j3-ch6m" ], "epss": { "cve": "CVE-2026-22703", "percentile": 0.01102, "score": 0.00106 }, "fixed_version": "v2.6.2", "id": "GO-2026-4309", "kev": null, "level": "symbol", "module": "github.com/sigstore/cosign/v2", "summary": "Cosign verification accepts any valid Rekor entry under certain conditions in github.com/sigstore/cosign", "version": "v2.4.1" }, { "aliases": [ "CVE-2026-24122", "GHSA-wfqv-66vq-46rm" ], "epss": { "cve": "CVE-2026-24122", "percentile": 0.11979, "score": 0.00215 }, "fixed_version": "", "id": "GO-2026-4529", "kev": null, "level": "symbol", "module": "github.com/sigstore/cosign/v2", "summary": "Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigstore/cosign", "version": "v2.4.1" }, { "aliases": [ "CVE-2026-39395", "GHSA-w6c6-c85g-mmv6" ], "epss": { "cve": "CVE-2026-39395", "percentile": 0.15235, "score": 0.00241 }, "fixed_version": "v2.6.3", "id": "GO-2026-5694", "kev": null, "level": "symbol", "module": "github.com/sigstore/cosign/v2", "summary": "Cosign's verify-blob-attestation reports false positive when payload parsing fails in github.com/sigstore/cosign", "version": "v2.4.1" }, { "aliases": [ "CVE-2026-23831", "GHSA-273p-m2cw-6833" ], "epss": { "cve": "CVE-2026-23831", "percentile": 0.36887, "score": 0.00426 }, "fixed_version": "v1.5.0", "id": "GO-2026-4354", "kev": null, "level": "symbol", "module": "github.com/sigstore/rekor", "summary": "Rekor's COSE v0.0.1 entry type nil pointer dereference in Canonicalize via empty Message in github.com/sigstore/rekor", "version": "v1.3.8" }, { "aliases": [ "CVE-2026-24117", "GHSA-4c4x-jm2x-pf9j" ], "epss": { "cve": "CVE-2026-24117", "percentile": 0.30183, "score": 0.00363 }, "fixed_version": "v1.5.0", "id": "GO-2026-4355", "kev": null, "level": "symbol", "module": "github.com/sigstore/rekor", "summary": "Rekor affected by Server-Side Request Forgery (SSRF) via provided public key URL in github.com/sigstore/rekor", "version": "v1.3.8" }, { "aliases": [ "CVE-2026-48702", "GHSA-47q9-m4ww-924m" ], "epss": { "cve": "CVE-2026-48702", "percentile": 0.39891, "score": 0.0046 }, "fixed_version": "v1.5.2", "id": "GO-2026-5778", "kev": null, "level": "symbol", "module": "github.com/sigstore/rekor", "summary": "Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic in github.com/sigstore/rekor", "version": "v1.3.8" }, { "aliases": [ "CVE-2026-24137", "GHSA-fcv2-xgw5-pqxf" ], "epss": { "cve": "CVE-2026-24137", "percentile": 0.332, "score": 0.0039 }, "fixed_version": "v1.10.4", "id": "GO-2026-4358", "kev": null, "level": "symbol", "module": "github.com/sigstore/sigstore", "summary": "Sigstore legacy TUF client allows for arbitrary file writes with target cache path traversal in github.com/sigstore/sigstore", "version": "v1.8.12" }, { "aliases": [ "CVE-2026-49834", "GHSA-9vcr-p3rj-q5q6" ], "epss": { "cve": "CVE-2026-49834", "percentile": 0.07665, "score": 0.00181 }, "fixed_version": "v1.2.0", "id": "GO-2026-5952", "kev": null, "level": "symbol", "module": "github.com/sigstore/sigstore-go", "summary": "sigstore-go has a multi-log threshold bypass via single compromised log in github.com/sigstore/sigstore-go", "version": "v0.6.2" }, { "aliases": [ "CVE-2026-54787", "GHSA-wqqc-jjcq-vfxm" ], "epss": { "cve": "CVE-2026-54787", "percentile": 0.02863, "score": 0.00134 }, "fixed_version": "v1.2.1", "id": "GO-2026-6162", "kev": null, "level": "symbol", "module": "github.com/sigstore/sigstore-go", "summary": "sigstore-go fails to check signature timestamps against a signing key's validity period in github.com/sigstore/sigstore-go", "version": "v0.6.2" }, { "aliases": [ "CVE-2025-66564", "GHSA-4qg8-fj49-pxjh" ], "epss": { "cve": "CVE-2025-66564", "percentile": 0.38496, "score": 0.00443 }, "fixed_version": "", "id": "GO-2025-4192", "kev": null, "level": "symbol", "module": "github.com/sigstore/timestamp-authority", "summary": "Sigstore Timestamp Authority allocates excessive memory during request parsing in github.com/sigstore/timestamp-authority", "version": "v1.2.2" }, { "aliases": [ "CVE-2026-39984", "GHSA-xm5m-wgh2-rrg3" ], "epss": { "cve": "CVE-2026-39984", "percentile": 0.00795, "score": 0.00099 }, "fixed_version": "", "id": "GO-2026-5763", "kev": null, "level": "symbol", "module": "github.com/sigstore/timestamp-authority", "summary": "Sigstore Timestamp Authority has Improper Certificate Validation in verifier in github.com/sigstore/timestamp-authority", "version": "v1.2.2" }, { "aliases": [ "CVE-2026-49835", "GHSA-9c54-x2g4-v92j" ], "epss": { "cve": "CVE-2026-49835", "percentile": 0.54767, "score": 0.00744 }, "fixed_version": "", "id": "GO-2026-5851", "kev": null, "level": "symbol", "module": "github.com/sigstore/timestamp-authority", "summary": "Sigstore Timestamp Authority has OOM due to unbounded metric label cardinality in github.com/sigstore/timestamp-authority", "version": "v1.2.2" }, { "aliases": [ "CVE-2026-23991", "GHSA-846p-jg2w-w324" ], "epss": { "cve": "CVE-2026-23991", "percentile": 0.47771, "score": 0.00581 }, "fixed_version": "", "id": "GO-2026-4348", "kev": null, "level": "symbol", "module": "github.com/theupdateframework/go-tuf", "summary": "Client DoS via malformed server response in github.com/theupdateframework/go-tuf", "version": "v0.7.0" }, { "aliases": [ "CVE-2026-23992", "GHSA-fphv-w9fq-2525" ], "epss": { "cve": "CVE-2026-23992", "percentile": 0.11894, "score": 0.00215 }, "fixed_version": "", "id": "GO-2026-4349", "kev": null, "level": "symbol", "module": "github.com/theupdateframework/go-tuf", "summary": "Improper validattion of configured threshold for delegations in github.com/theupdateframework/go-tuf", "version": "v0.7.0" }, { "aliases": [ "CVE-2026-24686", "GHSA-jqc5-w2xx-5vq4" ], "epss": { "cve": "CVE-2026-24686", "percentile": 0.14046, "score": 0.00231 }, "fixed_version": "", "id": "GO-2026-4377", "kev": null, "level": "symbol", "module": "github.com/theupdateframework/go-tuf", "summary": "Path traversal in TAP 4 multirepo client allows arbitrary file write via repo names in github.com/theupdateframework/go-tuf", "version": "v0.7.0" }, { "aliases": [ "CVE-2026-46597" ], "epss": { "cve": "CVE-2026-46597", "percentile": 0.40897, "score": 0.00473 }, "fixed_version": "v0.52.0", "id": "GO-2026-5013", "kev": null, "level": "symbol", "module": "golang.org/x/crypto", "summary": "Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh", "version": "v0.36.0" }, { "aliases": [ "CVE-2026-39829" ], "epss": { "cve": "CVE-2026-39829", "percentile": 0.40433, "score": 0.00467 }, "fixed_version": "v0.52.0", "id": "GO-2026-5018", "kev": null, "level": "symbol", "module": "golang.org/x/crypto", "summary": "Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh", "version": "v0.36.0" }, { "aliases": [ "CVE-2026-39831" ], "epss": { "cve": "CVE-2026-39831", "percentile": 0.41307, "score": 0.00478 }, "fixed_version": "v0.52.0", "id": "GO-2026-5019", "kev": null, "level": "symbol", "module": "golang.org/x/crypto", "summary": "Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh", "version": "v0.36.0" }, { "aliases": [ "CVE-2026-39834" ], "epss": { "cve": "CVE-2026-39834", "percentile": 0.48587, "score": 0.00597 }, "fixed_version": "v0.52.0", "id": "GO-2026-5020", "kev": null, "level": "symbol", "module": "golang.org/x/crypto", "summary": "Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh", "version": "v0.36.0" }, { "aliases": [], "epss": null, "fixed_version": "", "id": "GO-2026-5932", "kev": null, "level": "symbol", "module": "golang.org/x/crypto", "summary": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "version": "v0.36.0" }, { "aliases": [ "CVE-2026-33186", "GHSA-p77j-4mvh-x3m3" ], "epss": { "cve": "CVE-2026-33186", "percentile": 0.75569, "score": 0.01584 }, "fixed_version": "v1.79.3", "id": "GO-2026-4762", "kev": null, "level": "symbol", "module": "google.golang.org/grpc", "summary": "Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc", "version": "v1.69.4" }, { "aliases": [ "GHSA-hrxh-6v49-42gf" ], "epss": null, "fixed_version": "v1.82.1", "id": "GO-2026-6061", "kev": null, "level": "symbol", "module": "google.golang.org/grpc", "summary": "Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc", "version": "v1.69.4" }, { "aliases": [ "CVE-2026-84304", "GHSA-vp52-pcj8-j9qc" ], "epss": { "cve": "CVE-2026-84304", "percentile": 0.49152, "score": 0.00609 }, "fixed_version": "v1.83.1", "id": "GO-2026-6348", "kev": null, "level": "symbol", "module": "google.golang.org/grpc", "summary": "Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc", "version": "v1.69.4" }, { "aliases": [ "CVE-2026-84445", "GHSA-2v4p-qf9q-27wj" ], "epss": { "cve": "CVE-2026-84445", "percentile": 0.5072, "score": 0.00641 }, "fixed_version": "v1.82.2", "id": "GO-2026-6443", "kev": null, "level": "symbol", "module": "google.golang.org/grpc", "summary": "Server panic via missing authority or Host headers in google.golang.org/grpc", "version": "v1.69.4" }, { "aliases": [ "CVE-2025-58183", "CVE-2025-58183" ], "epss": { "cve": "CVE-2025-58183", "percentile": 0.38512, "score": 0.00443 }, "fixed_version": "v1.24.8", "id": "GO-2025-4014", "kev": null, "level": "package", "module": "stdlib", "summary": "Unbounded allocation when parsing GNU sparse map in archive/tar", "version": "v1.23.5" }, { "aliases": [ "CVE-2025-22873" ], "epss": { "cve": "CVE-2025-22873", "percentile": 0.1423, "score": 0.00233 }, "fixed_version": "v1.23.9", "id": "GO-2026-4403", "kev": null, "level": "package", "module": "stdlib", "summary": "Improper access to parent directory of root in os", "version": "v1.23.5" }, { "aliases": [ "CVE-2026-32282" ], "epss": { "cve": "CVE-2026-32282", "percentile": 0.21771, "score": 0.00292 }, "fixed_version": "v1.25.9", "id": "GO-2026-4864", "kev": null, "level": "package", "module": "stdlib", "summary": "TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix", "version": "v1.23.5" }, { "aliases": [ "CVE-2026-32288" ], "epss": { "cve": "CVE-2026-32288", "percentile": 0.21609, "score": 0.0029 }, "fixed_version": "v1.25.9", "id": "GO-2026-4869", "kev": null, "level": "package", "module": "stdlib", "summary": "Unbounded allocation for old GNU sparse in archive/tar", "version": "v1.23.5" }, { "aliases": [ "CVE-2026-39822" ], "epss": { "cve": "CVE-2026-39822", "percentile": 0.14177, "score": 0.00232 }, "fixed_version": "v1.25.12", "id": "GO-2026-4970", "kev": null, "level": "package", "module": "stdlib", "summary": "Root escape via symlink plus trailing slash in os", "version": "v1.23.5" }, { "aliases": [ "CVE-2026-39825" ], "epss": { "cve": "CVE-2026-39825", "percentile": 0.33182, "score": 0.0039 }, "fixed_version": "v1.25.10", "id": "GO-2026-4976", "kev": null, "level": "package", "module": "stdlib", "summary": "ReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputil", "version": "v1.23.5" }, { "aliases": [ "CVE-2026-42504" ], "epss": { "cve": "CVE-2026-42504", "percentile": 0.46636, "score": 0.0056 }, "fixed_version": "v1.25.11", "id": "GO-2026-5038", "kev": null, "level": "package", "module": "stdlib", "summary": "Quadratic complexity in WordDecoder.DecodeHeader in mime", "version": "v1.23.5" }, { "aliases": [ "CVE-2026-56853" ], "epss": { "cve": "CVE-2026-56853", "percentile": 0.47076, "score": 0.00568 }, "fixed_version": "v1.25.13", "id": "GO-2026-6089", "kev": null, "level": "package", "module": "stdlib", "summary": "Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http", "version": "v1.23.5" }, { "aliases": [ "CVE-2026-78667" ], "epss": { "cve": "CVE-2026-78667", "percentile": 0.41455, "score": 0.0048 }, "fixed_version": "v1.26.9", "id": "GO-2026-6609", "kev": null, "level": "package", "module": "stdlib", "summary": "Lack of limit on size of parsed Range headers in net/http", "version": "v1.23.5" }, { "aliases": [ "CVE-2025-58181", "GHSA-j5w8-q4qc-rx2x" ], "epss": { "cve": "CVE-2025-58181", "percentile": 0.4853, "score": 0.00597 }, "fixed_version": "v0.45.0", "id": "GO-2025-4134", "kev": null, "level": "package", "module": "golang.org/x/crypto", "summary": "Unbounded memory consumption in golang.org/x/crypto/ssh", "version": "v0.36.0" }, { "aliases": [ "CVE-2026-39828" ], "epss": { "cve": "CVE-2026-39828", "percentile": 0.3079, "score": 0.00369 }, "fixed_version": "v0.52.0", "id": "GO-2026-5014", "kev": null, "level": "package", "module": "golang.org/x/crypto", "summary": "Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh", "version": "v0.36.0" }, { "aliases": [ "CVE-2026-39835" ], "epss": { "cve": "CVE-2026-39835", "percentile": 0.43087, "score": 0.00504 }, "fixed_version": "v0.52.0", "id": "GO-2026-5015", "kev": null, "level": "package", "module": "golang.org/x/crypto", "summary": "Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh", "version": "v0.36.0" }, { "aliases": [ "CVE-2026-39827" ], "epss": { "cve": "CVE-2026-39827", "percentile": 0.20461, "score": 0.00279 }, "fixed_version": "v0.52.0", "id": "GO-2026-5016", "kev": null, "level": "package", "module": "golang.org/x/crypto", "summary": "Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh", "version": "v0.36.0" }, { "aliases": [ "CVE-2026-39830" ], "epss": { "cve": "CVE-2026-39830", "percentile": 0.52538, "score": 0.00683 }, "fixed_version": "v0.52.0", "id": "GO-2026-5017", "kev": null, "level": "package", "module": "golang.org/x/crypto", "summary": "Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh", "version": "v0.36.0" }, { "aliases": [ "CVE-2026-46595" ], "epss": { "cve": "CVE-2026-46595", "percentile": 0.4641, "score": 0.00556 }, "fixed_version": "v0.52.0", "id": "GO-2026-5023", "kev": null, "level": "package", "module": "golang.org/x/crypto", "summary": "Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh", "version": "v0.36.0" }, { "aliases": [ "CVE-2026-56854" ], "epss": { "cve": "CVE-2026-56854", "percentile": 0.38024, "score": 0.00437 }, "fixed_version": "v0.55.0", "id": "GO-2026-6303", "kev": null, "level": "package", "module": "golang.org/x/crypto", "summary": "Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh", "version": "v0.36.0" }, { "aliases": [ "CVE-2026-78662" ], "epss": { "cve": "CVE-2026-78662", "percentile": 0.37388, "score": 0.00431 }, "fixed_version": "v0.56.0", "id": "GO-2026-6354", "kev": null, "level": "package", "module": "golang.org/x/crypto", "summary": "Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh", "version": "v0.36.0" }, { "aliases": [ "CVE-2026-56855" ], "epss": { "cve": "CVE-2026-56855", "percentile": 0.42867, "score": 0.005 }, "fixed_version": "v0.56.0", "id": "GO-2026-6355", "kev": null, "level": "package", "module": "golang.org/x/crypto", "summary": "Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh", "version": "v0.36.0" }, { "aliases": [ "CVE-2026-56852" ], "epss": { "cve": "CVE-2026-56852", "percentile": 0.41057, "score": 0.00475 }, "fixed_version": "v0.39.0", "id": "GO-2026-5970", "kev": null, "level": "package", "module": "golang.org/x/text", "summary": "Infinite loop on invalid input in golang.org/x/text", "version": "v0.23.0" }, { "aliases": [ "CVE-2025-47907" ], "epss": { "cve": "CVE-2025-47907", "percentile": 0.34914, "score": 0.00406 }, "fixed_version": "v1.23.12", "id": "GO-2025-3849", "kev": null, "level": "module", "module": "stdlib", "summary": "Incorrect results returned from Rows.Scan in database/sql", "version": "v1.23.5" }, { "aliases": [ "CVE-2025-61728", "CVE-2025-61728" ], "epss": { "cve": "CVE-2025-61728", "percentile": 0.54549, "score": 0.00738 }, "fixed_version": "v1.24.12", "id": "GO-2026-4342", "kev": null, "level": "module", "module": "stdlib", "summary": "Excessive CPU consumption when building archive index in archive/zip", "version": "v1.23.5" }, { "aliases": [ "CVE-2025-15558", "GHSA-p436-gjf2-799p" ], "epss": { "cve": "CVE-2025-15558", "percentile": 0.45988, "score": 0.00549 }, "fixed_version": "v29.2.0+incompatible", "id": "GO-2026-4610", "kev": null, "level": "module", "module": "github.com/docker/cli", "summary": "Docker CLI Plugins: Uncontrolled Search Path Element Leads to Local Privilege Escalation on Windows in github.com/docker/cli", "version": "v27.5.0+incompatible" }, { "aliases": [ "GHSA-pmwq-pjrm-6p5r" ], "epss": null, "fixed_version": "v0.11.0", "id": "GO-2026-5547", "kev": null, "level": "module", "module": "github.com/in-toto/in-toto-golang", "summary": "in-toto-golang and in-toto-python have inconsistent negation behavior in github.com/in-toto/in-toto-golang", "version": "v0.9.0" }, { "aliases": [ "GHSA-259r-337f-4rfw" ], "epss": null, "fixed_version": "v1.18.7", "id": "GO-2026-5841", "kev": null, "level": "module", "module": "github.com/klauspost/compress", "summary": "OOB read in github.com/klauspost/compress/s2", "version": "v1.17.11" }, { "aliases": [ "CVE-2025-66506", "GHSA-f83f-xpx7-ffpw" ], "epss": { "cve": "CVE-2025-66506", "percentile": 0.11374, "score": 0.00211 }, "fixed_version": "v1.8.3", "id": "GO-2025-4193", "kev": null, "level": "module", "module": "github.com/sigstore/fulcio", "summary": "Fulcio allocates excessive memory during token parsing in github.com/sigstore/fulcio", "version": "v1.6.5" }, { "aliases": [ "CVE-2026-22772", "GHSA-59jp-pj84-45mr" ], "epss": { "cve": "CVE-2026-22772", "percentile": 0.14082, "score": 0.00232 }, "fixed_version": "v1.8.5", "id": "GO-2026-4311", "kev": null, "level": "module", "module": "github.com/sigstore/fulcio", "summary": "Fulcio is vulnerable to Server-Side Request Forgery (SSRF) via MetaIssuer Regex Bypass in github.com/sigstore/fulcio", "version": "v1.6.5" }, { "aliases": [ "CVE-2026-49478", "GHSA-f5mr-q85p-6hh6" ], "epss": { "cve": "CVE-2026-49478", "percentile": 0.20717, "score": 0.00282 }, "fixed_version": "v1.8.6", "id": "GO-2026-5853", "kev": null, "level": "module", "module": "github.com/sigstore/fulcio", "summary": "Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage in github.com/sigstore/fulcio", "version": "v1.6.5" }, { "aliases": [ "CVE-2026-2303", "GHSA-cp6g-7hqx-qxhp" ], "epss": { "cve": "CVE-2026-2303", "percentile": 0.24814, "score": 0.00318 }, "fixed_version": "v1.17.7", "id": "GO-2026-5327", "kev": null, "level": "module", "module": "go.mongodb.org/mongo-driver", "summary": "Mongo-go-driver: Heap Out-of-Bounds Read in GSSAPI Error Handling in go.mongodb.org/mongo-driver", "version": "v1.14.0" }, { "aliases": [ "CVE-2025-47913" ], "epss": { "cve": "CVE-2025-47913", "percentile": 0.51909, "score": 0.00668 }, "fixed_version": "v0.43.0", "id": "GO-2025-4116", "kev": null, "level": "module", "module": "golang.org/x/crypto", "summary": "Potential denial of service in golang.org/x/crypto/ssh/agent", "version": "v0.36.0" }, { "aliases": [ "CVE-2025-47914", "GHSA-f6x5-jh6r-wrfv" ], "epss": { "cve": "CVE-2025-47914", "percentile": 0.45818, "score": 0.00546 }, "fixed_version": "v0.45.0", "id": "GO-2025-4135", "kev": null, "level": "module", "module": "golang.org/x/crypto", "summary": "Malformed constraint may cause denial of service in golang.org/x/crypto/ssh/agent", "version": "v0.36.0" }, { "aliases": [ "CVE-2026-39833", "GHSA-jppx-rxg9-jmrx" ], "epss": { "cve": "CVE-2026-39833", "percentile": 0.40584, "score": 0.00469 }, "fixed_version": "v0.52.0", "id": "GO-2026-5005", "kev": null, "level": "module", "module": "golang.org/x/crypto", "summary": "Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent", "version": "v0.36.0" }, { "aliases": [ "CVE-2026-39832", "GHSA-f5wc-c3c7-36mc" ], "epss": { "cve": "CVE-2026-39832", "percentile": 0.52541, "score": 0.00683 }, "fixed_version": "v0.52.0", "id": "GO-2026-5006", "kev": null, "level": "module", "module": "golang.org/x/crypto", "summary": "Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent", "version": "v0.36.0" }, { "aliases": [ "CVE-2026-42508", "GHSA-5cgq-3rg8-m6cv" ], "epss": { "cve": "CVE-2026-42508", "percentile": 0.94092, "score": 0.0691 }, "fixed_version": "v0.52.0", "id": "GO-2026-5021", "kev": null, "level": "module", "module": "golang.org/x/crypto", "summary": "Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts", "version": "v0.36.0" }, { "aliases": [ "CVE-2026-46598" ], "epss": { "cve": "CVE-2026-46598", "percentile": 0.35509, "score": 0.00412 }, "fixed_version": "v0.52.0", "id": "GO-2026-5033", "kev": null, "level": "module", "module": "golang.org/x/crypto", "summary": "Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent", "version": "v0.36.0" }, { "aliases": [ "CVE-2026-56865" ], "epss": { "cve": "CVE-2026-56865", "percentile": 0.02533, "score": 0.00129 }, "fixed_version": "v0.40.0", "id": "GO-2026-6179", "kev": null, "level": "module", "module": "golang.org/x/mod", "summary": "Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog", "version": "v0.25.0" }, { "aliases": [ "CVE-2026-56864" ], "epss": { "cve": "CVE-2026-56864", "percentile": 0.22506, "score": 0.00298 }, "fixed_version": "v0.40.0", "id": "GO-2026-6180", "kev": null, "level": "module", "module": "golang.org/x/mod", "summary": "Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb", "version": "v0.25.0" }, { "aliases": [ "CVE-2025-47911" ], "epss": { "cve": "CVE-2025-47911", "percentile": 0.46695, "score": 0.00561 }, "fixed_version": "v0.45.0", "id": "GO-2026-4440", "kev": null, "level": "module", "module": "golang.org/x/net", "summary": "Quadratic parsing complexity in golang.org/x/net/html", "version": "v0.38.0" }, { "aliases": [ "CVE-2025-58190" ], "epss": { "cve": "CVE-2025-58190", "percentile": 0.45427, "score": 0.0054 }, "fixed_version": "v0.45.0", "id": "GO-2026-4441", "kev": null, "level": "module", "module": "golang.org/x/net", "summary": "Infinite parsing loop in golang.org/x/net", "version": "v0.38.0" }, { "aliases": [ "CVE-2026-42506" ], "epss": { "cve": "CVE-2026-42506", "percentile": 0.14566, "score": 0.00235 }, "fixed_version": "v0.55.0", "id": "GO-2026-5025", "kev": null, "level": "module", "module": "golang.org/x/net", "summary": "Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html", "version": "v0.38.0" }, { "aliases": [ "CVE-2026-42502" ], "epss": { "cve": "CVE-2026-42502", "percentile": 0.12982, "score": 0.00223 }, "fixed_version": "v0.55.0", "id": "GO-2026-5027", "kev": null, "level": "module", "module": "golang.org/x/net", "summary": "Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html", "version": "v0.38.0" }, { "aliases": [ "CVE-2026-25680" ], "epss": { "cve": "CVE-2026-25680", "percentile": 0.25766, "score": 0.00326 }, "fixed_version": "v0.55.0", "id": "GO-2026-5028", "kev": null, "level": "module", "module": "golang.org/x/net", "summary": "Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html", "version": "v0.38.0" }, { "aliases": [ "CVE-2026-25681" ], "epss": { "cve": "CVE-2026-25681", "percentile": 0.12983, "score": 0.00223 }, "fixed_version": "v0.55.0", "id": "GO-2026-5029", "kev": null, "level": "module", "module": "golang.org/x/net", "summary": "Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html", "version": "v0.38.0" }, { "aliases": [ "CVE-2026-27136" ], "epss": { "cve": "CVE-2026-27136", "percentile": 0.12983, "score": 0.00223 }, "fixed_version": "v0.55.0", "id": "GO-2026-5030", "kev": null, "level": "module", "module": "golang.org/x/net", "summary": "Invoking duplicate attributes can cause XSS in golang.org/x/net/html", "version": "v0.38.0" }, { "aliases": [ "CVE-2026-46600" ], "epss": { "cve": "CVE-2026-46600", "percentile": 0.45991, "score": 0.00549 }, "fixed_version": "v0.56.0", "id": "GO-2026-5942", "kev": null, "level": "module", "module": "golang.org/x/net", "summary": "Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage", "version": "v0.38.0" }, { "aliases": [ "CVE-2026-78661" ], "epss": { "cve": "CVE-2026-78661", "percentile": 0.08063, "score": 0.00185 }, "fixed_version": "v0.62.0", "id": "GO-2026-6860", "kev": null, "level": "module", "module": "golang.org/x/net", "summary": "Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net", "version": "v0.38.0" }, { "aliases": [ "CVE-2026-97045" ], "epss": { "cve": "CVE-2026-97045", "percentile": 0.10117, "score": 0.00202 }, "fixed_version": "v0.62.0", "id": "GO-2026-6866", "kev": null, "level": "module", "module": "golang.org/x/net", "summary": "Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net", "version": "v0.38.0" }, { "aliases": [ "CVE-2026-56851" ], "epss": { "cve": "CVE-2026-56851", "percentile": 0.40313, "score": 0.00466 }, "fixed_version": "v0.41.0", "id": "GO-2026-6629", "kev": null, "level": "module", "module": "golang.org/x/text", "summary": "Panic parsing crafted input in x/text/secure/precis in golang.org/x/text", "version": "v0.23.0" }, { "aliases": [ "CVE-2026-84303", "GHSA-qc2q-p7wx-3px3" ], "epss": { "cve": "CVE-2026-84303", "percentile": 0.23991, "score": 0.00311 }, "fixed_version": "v1.83.1", "id": "GO-2026-6441", "kev": null, "level": "module", "module": "google.golang.org/grpc", "summary": "Bypass of xDS RBAC HTTP filter header matching in google.golang.org/grpc", "version": "v1.69.4" } ], "go_version": "go1.23.5", "main_module": "github.com/slsa-framework/slsa-verifier/v2" }, "id": "slsa-framework__slsa-verifier", "manifests": [ ".github/workflows/codeql-analysis.yml", ".github/workflows/depsreview.yml", ".github/workflows/e2e.schedule.cli.yml", ".github/workflows/e2e.schedule.installer.yml", ".github/workflows/pr-title.yml", ".github/workflows/pre-submit.actions.yml", ".github/workflows/pre-submit.cli.yml", ".github/workflows/pre-submit.e2e.yml", ".github/workflows/pre-submit.lfs.yml", ".github/workflows/pre-submit.lint.yml", ".github/workflows/pre-submit.references.yml", ".github/workflows/release.yml", ".github/workflows/scorecards.yml", ".github/workflows/update-actions-dist-post-commit.yml", "actions/installer/action.yml", "actions/installer/package-lock.json", "actions/installer/package.json", "experimental/maven-plugin/pom.xml", "go.mod", "go.sum", "package-lock.json", "package.json", "requirements-lint.txt" ], "name": "slsa-verifier", "osv": { "advisories": 289, "available": true, "confirmed": 253, "osv_only": [ { "ecosystem": "Maven", "ids": [ "CVE-2026-102554", "GHSA-xxph-c9ww-hj94" ], "package": "com.google.guava:guava", "score": "8.2", "severity": "High", "version": "33.2.1-jre" }, { "ecosystem": "Maven", "ids": [ "CVE-2025-67030", "GHSA-6fmv-xxpf-w3cw" ], "package": "org.codehaus.plexus:plexus-utils", "score": "", "severity": "Unknown", "version": "3.5.1" }, { "ecosystem": "npm", "ids": [ "CVE-2026-114142", "GHSA-h895-cgqg-jf52" ], "package": "toml", "score": "8.8", "severity": "High", "version": "2.3.6" } ], "warning": null }, "ref": "v2.7.1", "ref_kind": "release", "release_integrity": { "asset": "slsa-verifier-linux-amd64", "assets": 12, "build_provenance": "verified", "checksums_published": false, "digest_matches_github": true, "immutable_release": null, "methods": [ { "error": "", "method": "slsa-verifier", "status": "verified" } ], "provenance_published": true, "sbom_published": false, "signature": null, "signatures_published": false, "signer": null, "verdict": "verified" }, "released_at": "2025-06-27T15:41:51Z", "repository": "slsa-framework/slsa-verifier", "sbomlyze_diff": { "added": 838, "changed": 2, "drift": { "integrity_drift": 0, "metadata_drift": 0, "version_drift": 2 }, "findings": [ "Attack surface: +1155 packages (574.6%)", "1 version downgrades detected: semver 6.3.1\u21925.7.2", "1 version upgrades (1 major) among 201 shared packages", "Core system packages stable: golang (106), github (36) unchanged", "License shift: copyleft +1, permissive +15" ], "html": "sbomlyze-diff.html", "removed": 0 }, "scanned_at": "2026-11-02T03:08:08+00:00", "scorecard": null, "scorecard_note": "the OpenSSF public dataset entry is 66 days old (limit 30); the Scorecard CLI fallback was skipped because this shard's weekly budget was used", "vulnerabilities": [ { "aliases": [ "CVE-2026-25896" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-25896", "percentile": 0.44685, "score": 0.00527 }, "fix_state": "fixed", "fixed_in": [ "4.5.4" ], "id": "GHSA-m7jm-9gc2-mpf2", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "fast-xml-parser", "severity": "Critical", "summary": "fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names", "url": "https://github.com/advisories/GHSA-m7jm-9gc2-mpf2", "version": "4.2.5" }, { "aliases": [ "CVE-2026-42508" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-42508", "percentile": 0.94092, "score": 0.0691 }, "fix_state": "fixed", "fixed_in": [ "0.52.0" ], "id": "GHSA-5cgq-3rg8-m6cv", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "Critical", "summary": "golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status", "url": "https://github.com/advisories/GHSA-5cgq-3rg8-m6cv", "version": "v0.36.0" }, { "aliases": [ "CVE-2026-39831" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-39831", "percentile": 0.41307, "score": 0.00478 }, "fix_state": "fixed", "fixed_in": [ "0.52.0" ], "id": "GHSA-89gr-r52h-f8rx", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "Critical", "summary": "golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed", "url": "https://github.com/advisories/GHSA-89gr-r52h-f8rx", "version": "v0.36.0" }, { "aliases": [ "CVE-2026-39832" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-39832", "percentile": 0.52541, "score": 0.00683 }, "fix_state": "fixed", "fixed_in": [ "0.52.0" ], "id": "GHSA-f5wc-c3c7-36mc", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "Critical", "summary": "golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys", "url": "https://github.com/advisories/GHSA-f5wc-c3c7-36mc", "version": "v0.36.0" }, { "aliases": [ "CVE-2026-39833" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-39833", "percentile": 0.40584, "score": 0.00469 }, "fix_state": "fixed", "fixed_in": [ "0.52.0" ], "id": "GHSA-jppx-rxg9-jmrx", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "Critical", "summary": "golang.org/x/crypto doesn't enforce invoking key constraints", "url": "https://github.com/advisories/GHSA-jppx-rxg9-jmrx", "version": "v0.36.0" }, { "aliases": [ "CVE-2026-39834" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-39834", "percentile": 0.48587, "score": 0.00597 }, "fix_state": "fixed", "fixed_in": [ "0.52.0" ], "id": "GHSA-rm3j-f69w-wqmq", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "Critical", "summary": "golang.org/x/crypto vulnerable to infinite loop on large channel writes", "url": "https://github.com/advisories/GHSA-rm3j-f69w-wqmq", "version": "v0.36.0" }, { "aliases": [ "CVE-2026-39830" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-39830", "percentile": 0.52538, "score": 0.00683 }, "fix_state": "fixed", "fixed_in": [ "0.52.0" ], "id": "GHSA-vgwf-h737-ff37", "in_binary": "package in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "Critical", "summary": "golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses", "url": "https://github.com/advisories/GHSA-vgwf-h737-ff37", "version": "v0.36.0" }, { "aliases": [ "CVE-2026-46595" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-46595", "percentile": 0.4641, "score": 0.00556 }, "fix_state": "fixed", "fixed_in": [ "0.52.0" ], "id": "GHSA-x527-x647-q7gg", "in_binary": "package in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "Critical", "summary": "golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement", "url": "https://github.com/advisories/GHSA-x527-x647-q7gg", "version": "v0.36.0" }, { "aliases": [ "CVE-2026-78663" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-78663", "percentile": 0.49813, "score": 0.00622 }, "fix_state": "fixed", "fixed_in": [ "0.60.0" ], "id": "GO-2026-6612", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "Critical", "summary": "The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configure", "url": "https://go.dev/cl/847187", "version": "v0.38.0" }, { "aliases": [ "CVE-2026-33186" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-33186", "percentile": 0.75569, "score": 0.01584 }, "fix_state": "fixed", "fixed_in": [ "1.79.3" ], "id": "GHSA-p77j-4mvh-x3m3", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "google.golang.org/grpc", "severity": "Critical", "summary": "gRPC-Go has an authorization bypass via missing leading slash in :path", "url": "https://github.com/advisories/GHSA-p77j-4mvh-x3m3", "version": "v1.69.4" }, { "aliases": [ "CVE-2026-33937" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-33937", "percentile": 0.79759, "score": 0.01907 }, "fix_state": "fixed", "fixed_in": [ "4.7.9" ], "id": "GHSA-2w6w-674q-4c4q", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "handlebars", "severity": "Critical", "summary": "Handlebars.js has JavaScript Injection via AST Type Confusion", "url": "https://github.com/advisories/GHSA-2w6w-674q-4c4q", "version": "4.7.8" }, { "aliases": [ "CVE-2026-106446" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-106446", "percentile": 0.56143, "score": 0.00786 }, "fix_state": "fixed", "fixed_in": [ "4.7.10" ], "id": "GHSA-8r5x-fm3f-whwj", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "handlebars", "severity": "Critical", "summary": "Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)", "url": "https://github.com/advisories/GHSA-8r5x-fm3f-whwj", "version": "4.7.8" }, { "aliases": [ "CVE-2026-106445" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-106445", "percentile": 0.48158, "score": 0.00589 }, "fix_state": "fixed", "fixed_in": [ "4.7.10" ], "id": "GHSA-p8wg-vrv2-v86f", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "handlebars", "severity": "Critical", "summary": "Handlebars: JavaScript Injection via Own Property Check Bypass", "url": "https://github.com/advisories/GHSA-p8wg-vrv2-v86f", "version": "4.7.8" }, { "aliases": [ "CVE-2026-77414" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-77414", "percentile": 0.47186, "score": 0.0057 }, "fix_state": "fixed", "fixed_in": [ "2.2.1" ], "id": "GHSA-2943-5xfg-gq5f", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "jsonata", "severity": "Critical", "summary": "JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions", "url": "https://github.com/advisories/GHSA-2943-5xfg-gq5f", "version": "2.0.5" }, { "aliases": [ "CVE-2026-77415" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-77415", "percentile": 0.59438, "score": 0.00892 }, "fix_state": "fixed", "fixed_in": [ "2.2.1" ], "id": "GHSA-66mm-25pp-rfff", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "jsonata", "severity": "Critical", "summary": "JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions", "url": "https://github.com/advisories/GHSA-66mm-25pp-rfff", "version": "2.0.5" }, { "aliases": [ "CVE-2026-77413" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-77413", "percentile": 0.53898, "score": 0.00719 }, "fix_state": "fixed", "fixed_in": [ "2.2.0" ], "id": "GHSA-8gq3-vp5j-2grp", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "jsonata", "severity": "Critical", "summary": "JSONata: Arbitrary Code Execution via crafted JSONata expressions", "url": "https://github.com/advisories/GHSA-8gq3-vp5j-2grp", "version": "2.0.5" }, { "aliases": [ "CVE-2026-28292" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-28292", "percentile": 0.71474, "score": 0.01348 }, "fix_state": "fixed", "fixed_in": [ "3.32.3" ], "id": "GHSA-r275-fr43-pm7q", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "simple-git", "severity": "Critical", "summary": "simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key enables RCE", "url": "https://github.com/advisories/GHSA-r275-fr43-pm7q", "version": "3.24.0" }, { "aliases": [ "CVE-2026-102828" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-102828", "percentile": 0.30932, "score": 0.0037 }, "fix_state": "fixed", "fixed_in": [ "4.0.1" ], "id": "GHSA-x6jw-m9v5-85vh", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "simple-git", "severity": "Critical", "summary": "simple-git unsafe-operation guard does not block trailer command configuration", "url": "https://github.com/advisories/GHSA-x6jw-m9v5-85vh", "version": "3.24.0" }, { "aliases": [ "CVE-2026-59873" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-59873", "percentile": 0.47807, "score": 0.00582 }, "fix_state": "fixed", "fixed_in": [ "7.5.19" ], "id": "GHSA-23hp-3jrh-7fpw", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "tar", "severity": "Critical", "summary": "node-tar: Decompression/parse DoS via unlimited input", "url": "https://github.com/advisories/GHSA-23hp-3jrh-7fpw", "version": "6.2.1" }, { "aliases": [ "CVE-2026-19481" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-19481", "percentile": 0.42376, "score": 0.00493 }, "fix_state": "fixed", "fixed_in": [ "3.2.1" ], "id": "GHSA-x8mw-p69m-v3mx", "kev": null, "location": "actions/installer/package-lock.json", "osv_confirmed": true, "package": "@fastify/busboy", "severity": "High", "summary": "@fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header", "url": "https://github.com/advisories/GHSA-x8mw-p69m-v3mx", "version": "2.1.1" }, { "aliases": [ "CVE-2026-59892" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-59892", "percentile": 0.46464, "score": 0.00557 }, "fix_state": "fixed", "fixed_in": [ "2.9.0" ], "id": "GHSA-45rx-2jwx-cxfr", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "@opentelemetry/propagator-jaeger", "severity": "High", "summary": "OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header", "url": "https://github.com/advisories/GHSA-45rx-2jwx-cxfr", "version": "1.24.1" }, { "aliases": [ "CVE-2026-77301" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-77301", "percentile": 0.49181, "score": 0.00609 }, "fix_state": "fixed", "fixed_in": [ "0.6.1" ], "id": "GHSA-7q85-xj36-vmfc", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "adm-zip", "severity": "High", "summary": "adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)", "url": "https://github.com/advisories/GHSA-7q85-xj36-vmfc", "version": "0.5.12" }, { "aliases": [], "ecosystem": "npm", "epss": null, "fix_state": "fixed", "fixed_in": [ "0.6.1" ], "id": "GHSA-8238-w5pm-2374", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "adm-zip", "severity": "High", "summary": "adm-zip: Unhandled error event in async DEFLATE decompression crashes Node.js process (DoS)", "url": "https://github.com/advisories/GHSA-8238-w5pm-2374", "version": "0.5.12" }, { "aliases": [ "CVE-2026-102282" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-102282", "percentile": 0.09814, "score": 0.00199 }, "fix_state": "fixed", "fixed_in": [ "0.6.1" ], "id": "GHSA-j5f4-cc29-5x44", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "adm-zip", "severity": "High", "summary": "adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation", "url": "https://github.com/advisories/GHSA-j5f4-cc29-5x44", "version": "0.5.12" }, { "aliases": [], "ecosystem": "npm", "epss": null, "fix_state": "fixed", "fixed_in": [ "0.6.1" ], "id": "GHSA-rcw4-f5rp-g42v", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "adm-zip", "severity": "High", "summary": "adm-zip: Decompression-bomb protection (fix for CVE-2026-39244) can be bypassed by declaring uncompressed size as 0", "url": "https://github.com/advisories/GHSA-rcw4-f5rp-g42v", "version": "0.5.12" }, { "aliases": [ "CVE-2026-39244" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-39244", "percentile": 0.57898, "score": 0.00841 }, "fix_state": "fixed", "fixed_in": [ "0.6.0" ], "id": "GHSA-xcpc-8h2w-3j85", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "adm-zip", "severity": "High", "summary": "adm-zip: Crafted ZIP file triggers 4GB memory allocation", "url": "https://github.com/advisories/GHSA-xcpc-8h2w-3j85", "version": "0.5.12" }, { "aliases": [ "CVE-2026-13149" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-13149", "percentile": 0.3024, "score": 0.00364 }, "fix_state": "fixed", "fixed_in": [ "1.1.16" ], "id": "GHSA-3jxr-9vmj-r5cp", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "brace-expansion", "severity": "High", "summary": "brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups", "url": "https://github.com/advisories/GHSA-3jxr-9vmj-r5cp", "version": "1.1.11" }, { "aliases": [ "CVE-2026-13149" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-13149", "percentile": 0.3024, "score": 0.00364 }, "fix_state": "fixed", "fixed_in": [ "2.1.2" ], "id": "GHSA-3jxr-9vmj-r5cp", "kev": null, "location": "actions/installer/package-lock.json", "osv_confirmed": true, "package": "brace-expansion", "severity": "High", "summary": "brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups", "url": "https://github.com/advisories/GHSA-3jxr-9vmj-r5cp", "version": "2.0.1" }, { "aliases": [ "CVE-2026-102276" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-102276", "percentile": 0.39514, "score": 0.00455 }, "fix_state": "fixed", "fixed_in": [ "1.1.19" ], "id": "GHSA-6j4f-fj2g-mc7p", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "brace-expansion", "severity": "High", "summary": "brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion", "url": "https://github.com/advisories/GHSA-6j4f-fj2g-mc7p", "version": "1.1.11" }, { "aliases": [ "CVE-2026-102276" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-102276", "percentile": 0.39514, "score": 0.00455 }, "fix_state": "fixed", "fixed_in": [ "2.1.5" ], "id": "GHSA-6j4f-fj2g-mc7p", "kev": null, "location": "actions/installer/package-lock.json", "osv_confirmed": true, "package": "brace-expansion", "severity": "High", "summary": "brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion", "url": "https://github.com/advisories/GHSA-6j4f-fj2g-mc7p", "version": "2.0.1" }, { "aliases": [ "CVE-2026-14257" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-14257", "percentile": 0.50816, "score": 0.00643 }, "fix_state": "fixed", "fixed_in": [ "1.1.17" ], "id": "GHSA-mh99-v99m-4gvg", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "brace-expansion", "severity": "High", "summary": "brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash", "url": "https://github.com/advisories/GHSA-mh99-v99m-4gvg", "version": "1.1.11" }, { "aliases": [ "CVE-2026-14257" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-14257", "percentile": 0.50816, "score": 0.00643 }, "fix_state": "fixed", "fixed_in": [ "2.1.3" ], "id": "GHSA-mh99-v99m-4gvg", "kev": null, "location": "actions/installer/package-lock.json", "osv_confirmed": true, "package": "brace-expansion", "severity": "High", "summary": "brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash", "url": "https://github.com/advisories/GHSA-mh99-v99m-4gvg", "version": "2.0.1" }, { "aliases": [ "CVE-2026-102278" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-102278", "percentile": 0.42209, "score": 0.00491 }, "fix_state": "fixed", "fixed_in": [ "1.1.20" ], "id": "GHSA-qhr7-859c-m2p7", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "brace-expansion", "severity": "High", "summary": "brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion", "url": "https://github.com/advisories/GHSA-qhr7-859c-m2p7", "version": "1.1.11" }, { "aliases": [ "CVE-2026-102278" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-102278", "percentile": 0.42209, "score": 0.00491 }, "fix_state": "fixed", "fixed_in": [ "2.1.6" ], "id": "GHSA-qhr7-859c-m2p7", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "brace-expansion", "severity": "High", "summary": "brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion", "url": "https://github.com/advisories/GHSA-qhr7-859c-m2p7", "version": "2.0.1" }, { "aliases": [ "CVE-2026-69152" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-69152", "percentile": 0.51004, "score": 0.00647 }, "fix_state": "fixed", "fixed_in": [ "1.1.18" ], "id": "GHSA-rgw5-rvv9-x895", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "brace-expansion", "severity": "High", "summary": "brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation", "url": "https://github.com/advisories/GHSA-rgw5-rvv9-x895", "version": "1.1.11" }, { "aliases": [ "CVE-2026-69152" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-69152", "percentile": 0.51004, "score": 0.00647 }, "fix_state": "fixed", "fixed_in": [ "2.1.4" ], "id": "GHSA-rgw5-rvv9-x895", "kev": null, "location": "actions/installer/package-lock.json", "osv_confirmed": true, "package": "brace-expansion", "severity": "High", "summary": "brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation", "url": "https://github.com/advisories/GHSA-rgw5-rvv9-x895", "version": "2.0.1" }, { "aliases": [ "CVE-2026-73088" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-73088", "percentile": 0.51498, "score": 0.00658 }, "fix_state": "fixed", "fixed_in": [ "4.28.7" ], "id": "GHSA-73wf-gq98-2v4g", "kev": null, "location": "actions/installer/package-lock.json", "osv_confirmed": true, "package": "browserslist", "severity": "High", "summary": "Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)", "url": "https://github.com/advisories/GHSA-73wf-gq98-2v4g", "version": "4.21.3" }, { "aliases": [ "CVE-2026-73089" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-73089", "percentile": 0.51386, "score": 0.00655 }, "fix_state": "fixed", "fixed_in": [ "4.28.7" ], "id": "GHSA-c83g-rgw3-j3cx", "kev": null, "location": "actions/installer/package-lock.json", "osv_confirmed": true, "package": "browserslist", "severity": "High", "summary": "Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM", "url": "https://github.com/advisories/GHSA-c83g-rgw3-j3cx", "version": "4.21.3" }, { "aliases": [ "CVE-2024-21538" ], "ecosystem": "npm", "epss": { "cve": "CVE-2024-21538", "percentile": 0.58749, "score": 0.00868 }, "fix_state": "fixed", "fixed_in": [ "7.0.5" ], "id": "GHSA-3xgq-45jj-v275", "kev": null, "location": "actions/installer/package-lock.json", "osv_confirmed": true, "package": "cross-spawn", "severity": "High", "summary": "Regular Expression Denial of Service (ReDoS) in cross-spawn", "url": "https://github.com/advisories/GHSA-3xgq-45jj-v275", "version": "7.0.3" }, { "aliases": [ "CVE-2026-19693" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-19693", "percentile": 0.39341, "score": 0.00453 }, "fix_state": "not-fixed", "fixed_in": [], "id": "GHSA-7pqw-9j4j-h8q3", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "extract-zip", "severity": "High", "summary": "extract-zip allows arbitrary file writes through symlink archive entries", "url": "https://github.com/advisories/GHSA-7pqw-9j4j-h8q3", "version": "2.0.1" }, { "aliases": [ "CVE-2026-56876" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-56876", "percentile": 0.44568, "score": 0.00526 }, "fix_state": "not-fixed", "fixed_in": [], "id": "GHSA-jmr9-qjv8-65gv", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "extract-zip", "severity": "High", "summary": "extract-zip unvalidated symlink path traversal", "url": "https://github.com/advisories/GHSA-jmr9-qjv8-65gv", "version": "2.0.1" }, { "aliases": [ "CVE-2026-33036" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-33036", "percentile": 0.4867, "score": 0.00599 }, "fix_state": "fixed", "fixed_in": [ "4.5.5" ], "id": "GHSA-8gc5-j5rx-235r", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "fast-xml-parser", "severity": "High", "summary": "fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278)", "url": "https://github.com/advisories/GHSA-8gc5-j5rx-235r", "version": "4.2.5" }, { "aliases": [ "CVE-2026-26278" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-26278", "percentile": 0.60869, "score": 0.00937 }, "fix_state": "fixed", "fixed_in": [ "4.5.4" ], "id": "GHSA-jmr7-xgp7-cmfj", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "fast-xml-parser", "severity": "High", "summary": "fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)", "url": "https://github.com/advisories/GHSA-jmr7-xgp7-cmfj", "version": "4.2.5" }, { "aliases": [ "CVE-2026-32141" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-32141", "percentile": 0.57853, "score": 0.00839 }, "fix_state": "fixed", "fixed_in": [ "3.4.0" ], "id": "GHSA-25h7-pfq9-p65f", "kev": null, "location": "actions/installer/package-lock.json", "osv_confirmed": true, "package": "flatted", "severity": "High", "summary": "flatted vulnerable to unbounded recursion DoS in parse() revive phase", "url": "https://github.com/advisories/GHSA-25h7-pfq9-p65f", "version": "3.2.7" }, { "aliases": [ "CVE-2026-33228" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-33228", "percentile": 0.57797, "score": 0.00838 }, "fix_state": "fixed", "fixed_in": [ "3.4.2" ], "id": "GHSA-rf6f-7fwh-wjgh", "kev": null, "location": "actions/installer/package-lock.json", "osv_confirmed": true, "package": "flatted", "severity": "High", "summary": "Prototype Pollution via parse() in NodeJS flatted", "url": "https://github.com/advisories/GHSA-rf6f-7fwh-wjgh", "version": "3.2.7" }, { "aliases": [ "CVE-2025-15558" ], "ecosystem": "golang", "epss": { "cve": "CVE-2025-15558", "percentile": 0.45988, "score": 0.00549 }, "fix_state": "fixed", "fixed_in": [ "29.2.0" ], "id": "GHSA-p436-gjf2-799p", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/docker/cli", "severity": "High", "summary": "Docker CLI Plugins: Uncontrolled Search Path Element Leads to Local Privilege Escalation on Windows", "url": "https://github.com/advisories/GHSA-p436-gjf2-799p", "version": "v27.5.0+incompatible" }, { "aliases": [ "CVE-2026-34986" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-34986", "percentile": 0.51213, "score": 0.00651 }, "fix_state": "fixed", "fixed_in": [ "4.1.4" ], "id": "GHSA-78h2-9frx-2jm8", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/go-jose/go-jose/v4", "severity": "High", "summary": "Go JOSE Panics in JWE decryption", "url": "https://github.com/advisories/GHSA-78h2-9frx-2jm8", "version": "v4.0.5" }, { "aliases": [ "CVE-2026-116587" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-116587", "percentile": 0.3048, "score": 0.00366 }, "fix_state": "fixed", "fixed_in": [ "4.1.6" ], "id": "GHSA-mgcc-cww5-fp2q", "in_binary": "vulnerable code not in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/go-jose/go-jose/v4", "severity": "High", "summary": "Go JOSE: DoS when parsing JWKs that contain RSA keys", "url": "https://github.com/advisories/GHSA-mgcc-cww5-fp2q", "version": "v4.0.5" }, { "aliases": [ "CVE-2026-63209" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-63209", "percentile": 0.47329, "score": 0.00572 }, "fix_state": "fixed", "fixed_in": [ "1.18.7" ], "id": "GHSA-259r-337f-4rfw", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/klauspost/compress", "severity": "High", "summary": "Compress/s2: Integer Overflow or Wraparound and Out-of-bounds Write in compress", "url": "https://github.com/advisories/GHSA-259r-337f-4rfw", "version": "v1.17.11" }, { "aliases": [ "CVE-2026-49478" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-49478", "percentile": 0.20717, "score": 0.00282 }, "fix_state": "fixed", "fixed_in": [ "1.8.6" ], "id": "GHSA-f5mr-q85p-6hh6", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/sigstore/fulcio", "severity": "High", "summary": "Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage", "url": "https://github.com/advisories/GHSA-f5mr-q85p-6hh6", "version": "v1.6.5" }, { "aliases": [ "CVE-2025-66506" ], "ecosystem": "golang", "epss": { "cve": "CVE-2025-66506", "percentile": 0.11374, "score": 0.00211 }, "fix_state": "fixed", "fixed_in": [ "1.8.3" ], "id": "GHSA-f83f-xpx7-ffpw", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/sigstore/fulcio", "severity": "High", "summary": "Fulcio allocates excessive memory during token parsing", "url": "https://github.com/advisories/GHSA-f83f-xpx7-ffpw", "version": "v1.6.5" }, { "aliases": [ "CVE-2026-48702" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-48702", "percentile": 0.39891, "score": 0.0046 }, "fix_state": "fixed", "fixed_in": [ "1.5.2" ], "id": "GHSA-47q9-m4ww-924m", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/sigstore/rekor", "severity": "High", "summary": "Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic", "url": "https://github.com/advisories/GHSA-47q9-m4ww-924m", "version": "v1.3.8" }, { "aliases": [ "CVE-2025-66564" ], "ecosystem": "golang", "epss": { "cve": "CVE-2025-66564", "percentile": 0.38496, "score": 0.00443 }, "fix_state": "fixed", "fixed_in": [ "2.0.3" ], "id": "GHSA-4qg8-fj49-pxjh", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/sigstore/timestamp-authority", "severity": "High", "summary": "Sigstore Timestamp Authority allocates excessive memory during request parsing", "url": "https://github.com/advisories/GHSA-4qg8-fj49-pxjh", "version": "v1.2.2" }, { "aliases": [ "CVE-2025-64756" ], "ecosystem": "npm", "epss": { "cve": "CVE-2025-64756", "percentile": 0.87717, "score": 0.0309 }, "fix_state": "fixed", "fixed_in": [ "10.5.0" ], "id": "GHSA-5j98-mcp5-4vw2", "kev": null, "location": "actions/installer/package-lock.json", "osv_confirmed": true, "package": "glob", "severity": "High", "summary": "glob CLI: Command injection via -c/--cmd executes matches with shell:true", "url": "https://github.com/advisories/GHSA-5j98-mcp5-4vw2", "version": "10.3.12" }, { "aliases": [ "CVE-2025-64756" ], "ecosystem": "npm", "epss": { "cve": "CVE-2025-64756", "percentile": 0.87717, "score": 0.0309 }, "fix_state": "fixed", "fixed_in": [ "10.5.0" ], "id": "GHSA-5j98-mcp5-4vw2", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "glob", "severity": "High", "summary": "glob CLI: Command injection via -c/--cmd executes matches with shell:true", "url": "https://github.com/advisories/GHSA-5j98-mcp5-4vw2", "version": "10.3.15" }, { "aliases": [ "CVE-2026-46597" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-46597", "percentile": 0.40897, "score": 0.00473 }, "fix_state": "fixed", "fixed_in": [ "0.52.0" ], "id": "GHSA-q4h4-gmj2-qvw2", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "High", "summary": "golang.org/x/crypto: Invoking byte arithmetic causes underflow and panic", "url": "https://github.com/advisories/GHSA-q4h4-gmj2-qvw2", "version": "v0.36.0" }, { "aliases": [ "CVE-2026-39829" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-39829", "percentile": 0.40433, "score": 0.00467 }, "fix_state": "fixed", "fixed_in": [ "0.52.0" ], "id": "GHSA-w879-237q-wc7r", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "High", "summary": "golang.org/x/crypto: Invoking pathological RSA/DSA parameters may cause DoS", "url": "https://github.com/advisories/GHSA-w879-237q-wc7r", "version": "v0.36.0" }, { "aliases": [ "CVE-2025-47913" ], "ecosystem": "golang", "epss": { "cve": "CVE-2025-47913", "percentile": 0.51909, "score": 0.00668 }, "fix_state": "fixed", "fixed_in": [ "0.43.0" ], "id": "GO-2025-4116", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "High", "summary": "SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process.", "url": "https://go.dev/cl/700295", "version": "v0.36.0" }, { "aliases": [ "CVE-2026-56854" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-56854", "percentile": 0.38024, "score": 0.00437 }, "fix_state": "fixed", "fixed_in": [ "0.55.0" ], "id": "GO-2026-6303", "in_binary": "package in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "High", "summary": "The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthC", "url": "https://go.dev/issue/80213", "version": "v0.36.0" }, { "aliases": [ "CVE-2026-78662" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-78662", "percentile": 0.37388, "score": 0.00431 }, "fix_state": "fixed", "fixed_in": [ "0.56.0" ], "id": "GO-2026-6354", "in_binary": "package in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "High", "summary": "Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket", "url": "https://go.dev/issue/81316", "version": "v0.36.0" }, { "aliases": [ "CVE-2026-56855" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-56855", "percentile": 0.42867, "score": 0.005 }, "fix_state": "fixed", "fixed_in": [ "0.56.0" ], "id": "GO-2026-6355", "in_binary": "package in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "High", "summary": "Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection d", "url": "https://go.dev/issue/81317", "version": "v0.36.0" }, { "aliases": [ "CVE-2026-56865" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-56865", "percentile": 0.02533, "score": 0.00129 }, "fix_state": "fixed", "fixed_in": [ "0.40.0" ], "id": "GO-2026-6179", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/mod", "severity": "High", "summary": "A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that canno", "url": "https://go.dev/issue/80744", "version": "v0.25.0" }, { "aliases": [ "CVE-2026-56864" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-56864", "percentile": 0.22506, "score": 0.00298 }, "fix_state": "fixed", "fixed_in": [ "0.40.0" ], "id": "GO-2026-6180", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/mod", "severity": "High", "summary": "A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you", "url": "https://go.dev/issue/80745", "version": "v0.25.0" }, { "aliases": [ "CVE-2026-33814" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-33814", "percentile": 0.57885, "score": 0.0084 }, "fix_state": "fixed", "fixed_in": [ "0.53.0" ], "id": "GO-2026-4918", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "High", "summary": "When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.", "url": "https://go.dev/cl/761581", "version": "v0.38.0" }, { "aliases": [ "CVE-2026-39821" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-39821", "percentile": 0.78915, "score": 0.01834 }, "fix_state": "fixed", "fixed_in": [ "0.55.0" ], "id": "GO-2026-5026", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "High", "summary": "The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna pac", "url": "https://go.dev/cl/767220", "version": "v0.38.0" }, { "aliases": [ "CVE-2026-46600" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-46600", "percentile": 0.45991, "score": 0.00549 }, "fix_state": "fixed", "fixed_in": [ "0.56.0" ], "id": "GO-2026-5942", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "High", "summary": "Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.", "url": "https://go.dev/cl/786345", "version": "v0.38.0" }, { "aliases": [ "CVE-2026-78659" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-78659", "percentile": 0.50082, "score": 0.00627 }, "fix_state": "fixed", "fixed_in": [ "0.60.0" ], "id": "GO-2026-6603", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "High", "summary": "When \"Trailer\" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a \"", "url": "https://go.dev/cl/847185", "version": "v0.38.0" }, { "aliases": [ "CVE-2026-78660" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-78660", "percentile": 0.36838, "score": 0.00425 }, "fix_state": "fixed", "fixed_in": [ "0.60.0" ], "id": "GO-2026-6610", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "High", "summary": "Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a re", "url": "https://go.dev/cl/835145", "version": "v0.38.0" }, { "aliases": [ "CVE-2026-78669" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-78669", "percentile": 0.49426, "score": 0.00614 }, "fix_state": "fixed", "fixed_in": [ "0.60.0" ], "id": "GO-2026-6611", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "High", "summary": "A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.", "url": "https://go.dev/cl/847186", "version": "v0.38.0" }, { "aliases": [ "CVE-2026-97032" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-97032", "percentile": 0.42154, "score": 0.0049 }, "fix_state": "fixed", "fixed_in": [ "0.60.0" ], "id": "GO-2026-6617", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "High", "summary": "HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the ot", "url": "https://go.dev/cl/847188", "version": "v0.38.0" }, { "aliases": [ "CVE-2026-56852" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-56852", "percentile": 0.41057, "score": 0.00475 }, "fix_state": "fixed", "fixed_in": [ "0.39.0" ], "id": "GO-2026-5970", "in_binary": "package in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/text", "severity": "High", "summary": "A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.", "url": "https://go.dev/issue/80142", "version": "v0.23.0" }, { "aliases": [ "CVE-2026-56851" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-56851", "percentile": 0.40313, "score": 0.00466 }, "fix_state": "fixed", "fixed_in": [ "0.41.0" ], "id": "GO-2026-6629", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/text", "severity": "High", "summary": "The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.", "url": "https://go.dev/cl/793360", "version": "v0.23.0" }, { "aliases": [ "CVE-2026-84445" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-84445", "percentile": 0.5072, "score": 0.00641 }, "fix_state": "fixed", "fixed_in": [ "1.82.2" ], "id": "GHSA-2v4p-qf9q-27wj", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "google.golang.org/grpc", "severity": "High", "summary": "gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers", "url": "https://github.com/advisories/GHSA-2v4p-qf9q-27wj", "version": "v1.69.4" }, { "aliases": [], "ecosystem": "golang", "epss": null, "fix_state": "fixed", "fixed_in": [ "1.82.1" ], "id": "GHSA-hrxh-6v49-42gf", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "google.golang.org/grpc", "severity": "High", "summary": "gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities", "url": "https://github.com/advisories/GHSA-hrxh-6v49-42gf", "version": "v1.69.4" }, { "aliases": [ "CVE-2026-84304" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-84304", "percentile": 0.49152, "score": 0.00609 }, "fix_state": "fixed", "fixed_in": [ "1.83.1" ], "id": "GHSA-vp52-pcj8-j9qc", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "google.golang.org/grpc", "severity": "High", "summary": "gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation", "url": "https://github.com/advisories/GHSA-vp52-pcj8-j9qc", "version": "v1.69.4" }, { "aliases": [ "CVE-2026-33938" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-33938", "percentile": 0.53978, "score": 0.00721 }, "fix_state": "fixed", "fixed_in": [ "4.7.9" ], "id": "GHSA-3mfm-83xf-c92r", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "handlebars", "severity": "High", "summary": "Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block", "url": "https://github.com/advisories/GHSA-3mfm-83xf-c92r", "version": "4.7.8" }, { "aliases": [ "CVE-2026-33939" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-33939", "percentile": 0.50065, "score": 0.00627 }, "fix_state": "fixed", "fixed_in": [ "4.7.9" ], "id": "GHSA-9cx6-37pm-9jff", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "handlebars", "severity": "High", "summary": "Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation", "url": "https://github.com/advisories/GHSA-9cx6-37pm-9jff", "version": "4.7.8" }, { "aliases": [ "CVE-2026-33940" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-33940", "percentile": 0.5377, "score": 0.00715 }, "fix_state": "fixed", "fixed_in": [ "4.7.9" ], "id": "GHSA-xhpv-hc6g-r9c6", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "handlebars", "severity": "High", "summary": "Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial", "url": "https://github.com/advisories/GHSA-xhpv-hc6g-r9c6", "version": "4.7.8" }, { "aliases": [ "CVE-2026-33941" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-33941", "percentile": 0.22305, "score": 0.00296 }, "fix_state": "fixed", "fixed_in": [ "4.7.9" ], "id": "GHSA-xjpj-3mr7-gcpf", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "handlebars", "severity": "High", "summary": "Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options", "url": "https://github.com/advisories/GHSA-xjpj-3mr7-gcpf", "version": "4.7.8" }, { "aliases": [ "CVE-2026-69192" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-69192", "percentile": 0.40267, "score": 0.00465 }, "fix_state": "fixed", "fixed_in": [ "10.3.1" ], "id": "GHSA-mwp4-54f8-5fhr", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "ip-address", "severity": "High", "summary": "ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass", "url": "https://github.com/advisories/GHSA-mwp4-54f8-5fhr", "version": "9.0.5" }, { "aliases": [ "CVE-2026-84375" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-84375", "percentile": 0.45503, "score": 0.00541 }, "fix_state": "fixed", "fixed_in": [ "3.15.2" ], "id": "GHSA-2883-xcg3-v3hh", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "js-yaml", "severity": "High", "summary": "js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources", "url": "https://github.com/advisories/GHSA-2883-xcg3-v3hh", "version": "3.14.1" }, { "aliases": [ "CVE-2026-84375" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-84375", "percentile": 0.45503, "score": 0.00541 }, "fix_state": "fixed", "fixed_in": [ "4.3.2" ], "id": "GHSA-2883-xcg3-v3hh", "kev": null, "location": "actions/installer/package-lock.json", "osv_confirmed": true, "package": "js-yaml", "severity": "High", "summary": "js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources", "url": "https://github.com/advisories/GHSA-2883-xcg3-v3hh", "version": "4.1.0" }, { "aliases": [ "CVE-2026-59869" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-59869", "percentile": 0.47992, "score": 0.00585 }, "fix_state": "fixed", "fixed_in": [ "3.15.0" ], "id": "GHSA-52cp-r559-cp3m", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "js-yaml", "severity": "High", "summary": "js-yaml: YAML merge-key chains can force quadratic CPU consumption", "url": "https://github.com/advisories/GHSA-52cp-r559-cp3m", "version": "3.14.1" }, { "aliases": [ "CVE-2026-59869" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-59869", "percentile": 0.47992, "score": 0.00585 }, "fix_state": "fixed", "fixed_in": [ "4.3.0" ], "id": "GHSA-52cp-r559-cp3m", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "js-yaml", "severity": "High", "summary": "js-yaml: YAML merge-key chains can force quadratic CPU consumption", "url": "https://github.com/advisories/GHSA-52cp-r559-cp3m", "version": "4.1.0" }, { "aliases": [], "ecosystem": "npm", "epss": null, "fix_state": "fixed", "fixed_in": [ "3.15.1" ], "id": "GHSA-5p4m-2wfm-xmqj", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "js-yaml", "severity": "High", "summary": "JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) \u2014 CVE-2026-59870 fix not backported", "url": "https://github.com/advisories/GHSA-5p4m-2wfm-xmqj", "version": "3.14.1" }, { "aliases": [], "ecosystem": "npm", "epss": null, "fix_state": "fixed", "fixed_in": [ "4.3.1" ], "id": "GHSA-5p4m-2wfm-xmqj", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "js-yaml", "severity": "High", "summary": "JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) \u2014 CVE-2026-59870 fix not backported", "url": "https://github.com/advisories/GHSA-5p4m-2wfm-xmqj", "version": "4.1.0" }, { "aliases": [ "CVE-2026-52746" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-52746", "percentile": 0.52771, "score": 0.00689 }, "fix_state": "fixed", "fixed_in": [ "2.2.0" ], "id": "GHSA-86vw-mfpg-wwv9", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "jsonata", "severity": "High", "summary": "jsonata: Malicious inputs to \"$toMillis\" function can cause resource exhaustion", "url": "https://github.com/advisories/GHSA-86vw-mfpg-wwv9", "version": "2.0.5" }, { "aliases": [ "CVE-2025-65945" ], "ecosystem": "npm", "epss": { "cve": "CVE-2025-65945", "percentile": 0.11984, "score": 0.00215 }, "fix_state": "fixed", "fixed_in": [ "4.0.1" ], "id": "GHSA-869p-cjfg-cm3x", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "jws", "severity": "High", "summary": "auth0/node-jws Improperly Verifies HMAC Signature", "url": "https://github.com/advisories/GHSA-869p-cjfg-cm3x", "version": "4.0.0" }, { "aliases": [ "CVE-2026-48801" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-48801", "percentile": 0.3357, "score": 0.00394 }, "fix_state": "fixed", "fixed_in": [ "5.0.1" ], "id": "GHSA-22p9-wv53-3rq4", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "linkify-it", "severity": "High", "summary": "LinkifyIt#match scan loop has quadratic algorithmic complexity", "url": "https://github.com/advisories/GHSA-22p9-wv53-3rq4", "version": "5.0.0" }, { "aliases": [ "CVE-2026-59887" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-59887", "percentile": 0.40425, "score": 0.00467 }, "fix_state": "fixed", "fixed_in": [ "5.0.2" ], "id": "GHSA-v245-v573-v5vm", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "linkify-it", "severity": "High", "summary": "linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text", "url": "https://github.com/advisories/GHSA-v245-v573-v5vm", "version": "5.0.0" }, { "aliases": [ "CVE-2026-4800" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-4800", "percentile": 0.86507, "score": 0.02808 }, "fix_state": "fixed", "fixed_in": [ "4.18.0" ], "id": "GHSA-r5fr-rjxr-66jc", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "lodash", "severity": "High", "summary": "lodash vulnerable to Code Injection via `_.template` imports key names", "url": "https://github.com/advisories/GHSA-r5fr-rjxr-66jc", "version": "4.17.21" }, { "aliases": [ "CVE-2026-111758" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-111758", "percentile": 0.46036, "score": 0.0055 }, "fix_state": "fixed", "fixed_in": [ "14.3.3" ], "id": "GHSA-gfr2-rv44-r23c", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "markdown-it", "severity": "High", "summary": "markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)", "url": "https://github.com/advisories/GHSA-gfr2-rv44-r23c", "version": "14.1.0" }, { "aliases": [ "CVE-2026-111759" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-111759", "percentile": 0.48249, "score": 0.00591 }, "fix_state": "fixed", "fixed_in": [ "14.3.2" ], "id": "GHSA-r7fv-28h4-cvq7", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "markdown-it", "severity": "High", "summary": "markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes", "url": "https://github.com/advisories/GHSA-r7fv-28h4-cvq7", "version": "14.1.0" }, { "aliases": [ "CVE-2026-27904" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-27904", "percentile": 0.44525, "score": 0.00525 }, "fix_state": "fixed", "fixed_in": [ "3.1.4" ], "id": "GHSA-23c5-xmqv-rm74", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "minimatch", "severity": "High", "summary": "minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions", "url": "https://github.com/advisories/GHSA-23c5-xmqv-rm74", "version": "3.1.2" }, { "aliases": [ "CVE-2026-27904" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-27904", "percentile": 0.44525, "score": 0.00525 }, "fix_state": "fixed", "fixed_in": [ "9.0.7" ], "id": "GHSA-23c5-xmqv-rm74", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "minimatch", "severity": "High", "summary": "minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions", "url": "https://github.com/advisories/GHSA-23c5-xmqv-rm74", "version": "9.0.2" }, { "aliases": [ "CVE-2026-27904" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-27904", "percentile": 0.44525, "score": 0.00525 }, "fix_state": "fixed", "fixed_in": [ "9.0.7" ], "id": "GHSA-23c5-xmqv-rm74", "kev": null, "location": "actions/installer/package-lock.json", "osv_confirmed": true, "package": "minimatch", "severity": "High", "summary": "minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions", "url": "https://github.com/advisories/GHSA-23c5-xmqv-rm74", "version": "9.0.3" }, { "aliases": [ "CVE-2026-27904" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-27904", "percentile": 0.44525, "score": 0.00525 }, "fix_state": "fixed", "fixed_in": [ "9.0.7" ], "id": "GHSA-23c5-xmqv-rm74", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "minimatch", "severity": "High", "summary": "minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions", "url": "https://github.com/advisories/GHSA-23c5-xmqv-rm74", "version": "9.0.4" }, { "aliases": [ "CVE-2026-26996" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-26996", "percentile": 0.47571, "score": 0.00577 }, "fix_state": "fixed", "fixed_in": [ "3.1.3" ], "id": "GHSA-3ppc-4f35-3m26", "kev": null, "location": "actions/installer/package-lock.json", "osv_confirmed": true, "package": "minimatch", "severity": "High", "summary": "minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern", "url": "https://github.com/advisories/GHSA-3ppc-4f35-3m26", "version": "3.1.2" }, { "aliases": [ "CVE-2026-26996" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-26996", "percentile": 0.47571, "score": 0.00577 }, "fix_state": "fixed", "fixed_in": [ "9.0.6" ], "id": "GHSA-3ppc-4f35-3m26", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "minimatch", "severity": "High", "summary": "minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern", "url": "https://github.com/advisories/GHSA-3ppc-4f35-3m26", "version": "9.0.2" }, { "aliases": [ "CVE-2026-26996" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-26996", "percentile": 0.47571, "score": 0.00577 }, "fix_state": "fixed", "fixed_in": [ "9.0.6" ], "id": "GHSA-3ppc-4f35-3m26", "kev": null, "location": "actions/installer/package-lock.json", "osv_confirmed": true, "package": "minimatch", "severity": "High", "summary": "minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern", "url": "https://github.com/advisories/GHSA-3ppc-4f35-3m26", "version": "9.0.3" }, { "aliases": [ "CVE-2026-26996" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-26996", "percentile": 0.47571, "score": 0.00577 }, "fix_state": "fixed", "fixed_in": [ "9.0.6" ], "id": "GHSA-3ppc-4f35-3m26", "kev": null, "location": "actions/installer/package-lock.json", "osv_confirmed": true, "package": "minimatch", "severity": "High", "summary": "minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern", "url": "https://github.com/advisories/GHSA-3ppc-4f35-3m26", "version": "9.0.4" }, { "aliases": [ "CVE-2026-27903" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-27903", "percentile": 0.4749, "score": 0.00576 }, "fix_state": "fixed", "fixed_in": [ "3.1.3" ], "id": "GHSA-7r86-cg39-jmmj", "kev": null, "location": "actions/installer/package-lock.json", "osv_confirmed": true, "package": "minimatch", "severity": "High", "summary": "minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments", "url": "https://github.com/advisories/GHSA-7r86-cg39-jmmj", "version": "3.1.2" }, { "aliases": [ "CVE-2026-27903" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-27903", "percentile": 0.4749, "score": 0.00576 }, "fix_state": "fixed", "fixed_in": [ "9.0.7" ], "id": "GHSA-7r86-cg39-jmmj", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "minimatch", "severity": "High", "summary": "minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments", "url": "https://github.com/advisories/GHSA-7r86-cg39-jmmj", "version": "9.0.2" }, { "aliases": [ "CVE-2026-27903" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-27903", "percentile": 0.4749, "score": 0.00576 }, "fix_state": "fixed", "fixed_in": [ "9.0.7" ], "id": "GHSA-7r86-cg39-jmmj", "kev": null, "location": "actions/installer/package-lock.json", "osv_confirmed": true, "package": "minimatch", "severity": "High", "summary": "minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments", "url": "https://github.com/advisories/GHSA-7r86-cg39-jmmj", "version": "9.0.3" }, { "aliases": [ "CVE-2026-27903" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-27903", "percentile": 0.4749, "score": 0.00576 }, "fix_state": "fixed", "fixed_in": [ "9.0.7" ], "id": "GHSA-7r86-cg39-jmmj", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "minimatch", "severity": "High", "summary": "minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments", "url": "https://github.com/advisories/GHSA-7r86-cg39-jmmj", "version": "9.0.4" }, { "aliases": [ "CVE-2026-67214" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-67214", "percentile": 0.26147, "score": 0.0033 }, "fix_state": "fixed", "fixed_in": [ "3.3.16" ], "id": "GHSA-28wg-ghj8-5hjv", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "nanoid", "severity": "High", "summary": "nanoid: non-secure generators can loop indefinitely with negative size", "url": "https://github.com/advisories/GHSA-28wg-ghj8-5hjv", "version": "3.3.7" }, { "aliases": [ "CVE-2026-67213" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-67213", "percentile": 0.26279, "score": 0.00331 }, "fix_state": "fixed", "fixed_in": [ "3.3.18" ], "id": "GHSA-2v37-7h3g-55p8", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "nanoid", "severity": "High", "summary": "nanoid: custom generators can loop indefinitely when size is zero", "url": "https://github.com/advisories/GHSA-2v37-7h3g-55p8", "version": "3.3.7" }, { "aliases": [ "CVE-2026-73086" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-73086", "percentile": 0.2234, "score": 0.00296 }, "fix_state": "fixed", "fixed_in": [ "3.3.12" ], "id": "GHSA-xwg4-73v4-xw9w", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "nanoid", "severity": "High", "summary": "nanoid: Integer Overflow or Wraparound", "url": "https://github.com/advisories/GHSA-xwg4-73v4-xw9w", "version": "3.3.7" }, { "aliases": [ "CVE-2025-47934" ], "ecosystem": "npm", "epss": { "cve": "CVE-2025-47934", "percentile": 0.50936, "score": 0.00645 }, "fix_state": "fixed", "fixed_in": [ "5.11.3" ], "id": "GHSA-8qff-qr5q-5pr8", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "openpgp", "severity": "High", "summary": "OpenPGP.js's message signature verification can be spoofed", "url": "https://github.com/advisories/GHSA-8qff-qr5q-5pr8", "version": "5.11.1" }, { "aliases": [ "CVE-2026-33671" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-33671", "percentile": 0.36317, "score": 0.0042 }, "fix_state": "fixed", "fixed_in": [ "2.3.2" ], "id": "GHSA-c2c7-rcm5-vvqj", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "picomatch", "severity": "High", "summary": "Picomatch has a ReDoS vulnerability via extglob quantifiers", "url": "https://github.com/advisories/GHSA-c2c7-rcm5-vvqj", "version": "2.3.1" }, { "aliases": [ "CVE-2026-102827" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-102827", "percentile": 0.47538, "score": 0.00576 }, "fix_state": "fixed", "fixed_in": [ "4.0.0" ], "id": "GHSA-858h-whjf-mvg5", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "simple-git", "severity": "High", "summary": "simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)", "url": "https://github.com/advisories/GHSA-858h-whjf-mvg5", "version": "3.24.0" }, { "aliases": [ "CVE-2026-102826" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-102826", "percentile": 0.40183, "score": 0.00464 }, "fix_state": "fixed", "fixed_in": [ "4.0.0" ], "id": "GHSA-g4wm-2vf7-vfgr", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "simple-git", "severity": "High", "summary": "simple-git allows command execution through unblocked Git configuration includes", "url": "https://github.com/advisories/GHSA-g4wm-2vf7-vfgr", "version": "3.24.0" }, { "aliases": [ "CVE-2026-6951" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-6951", "percentile": 0.59045, "score": 0.00877 }, "fix_state": "fixed", "fixed_in": [ "3.36.0" ], "id": "GHSA-hffm-xvc3-vprc", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "simple-git", "severity": "High", "summary": "simple-git is vulnerable to Remote Code Execution", "url": "https://github.com/advisories/GHSA-hffm-xvc3-vprc", "version": "3.24.0" }, { "aliases": [ "CVE-2026-28291" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-28291", "percentile": 0.5559, "score": 0.00768 }, "fix_state": "fixed", "fixed_in": [ "3.32.0" ], "id": "GHSA-jcxm-m3jx-f287", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "simple-git", "severity": "High", "summary": "simple-git Affected by Command Execution via Option-Parsing Bypass", "url": "https://github.com/advisories/GHSA-jcxm-m3jx-f287", "version": "3.24.0" }, { "aliases": [ "CVE-2026-24842" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-24842", "percentile": 0.49102, "score": 0.00608 }, "fix_state": "fixed", "fixed_in": [ "7.5.7" ], "id": "GHSA-34x7-hfp2-rc4v", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "tar", "severity": "High", "summary": "node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal", "url": "https://github.com/advisories/GHSA-34x7-hfp2-rc4v", "version": "6.2.1" }, { "aliases": [ "CVE-2026-26960" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-26960", "percentile": 0.2599, "score": 0.00328 }, "fix_state": "fixed", "fixed_in": [ "7.5.8" ], "id": "GHSA-83g3-92jg-28cx", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "tar", "severity": "High", "summary": "Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction", "url": "https://github.com/advisories/GHSA-83g3-92jg-28cx", "version": "6.2.1" }, { "aliases": [ "CVE-2026-23745" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-23745", "percentile": 0.31588, "score": 0.00376 }, "fix_state": "fixed", "fixed_in": [ "7.5.3" ], "id": "GHSA-8qq5-rm4j-mr97", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "tar", "severity": "High", "summary": "node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization", "url": "https://github.com/advisories/GHSA-8qq5-rm4j-mr97", "version": "6.2.1" }, { "aliases": [ "CVE-2026-59874" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-59874", "percentile": 0.37686, "score": 0.00434 }, "fix_state": "fixed", "fixed_in": [ "7.5.18" ], "id": "GHSA-8x88-c5mf-7j5w", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "tar", "severity": "High", "summary": "node-tar: Negative tar entry size causes infinite loop in archive replace", "url": "https://github.com/advisories/GHSA-8x88-c5mf-7j5w", "version": "6.2.1" }, { "aliases": [ "CVE-2026-31802" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-31802", "percentile": 0.19054, "score": 0.00269 }, "fix_state": "fixed", "fixed_in": [ "7.5.11" ], "id": "GHSA-9ppj-qmqm-q256", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "tar", "severity": "High", "summary": "node-tar Symlink Path Traversal via Drive-Relative Linkpath", "url": "https://github.com/advisories/GHSA-9ppj-qmqm-q256", "version": "6.2.1" }, { "aliases": [ "CVE-2026-29786" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-29786", "percentile": 0.40344, "score": 0.00466 }, "fix_state": "fixed", "fixed_in": [ "7.5.10" ], "id": "GHSA-qffp-2rhf-9h96", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "tar", "severity": "High", "summary": "tar has Hardlink Path Traversal via Drive-Relative Linkpath", "url": "https://github.com/advisories/GHSA-qffp-2rhf-9h96", "version": "6.2.1" }, { "aliases": [ "CVE-2026-73566" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-73566", "percentile": 0.44902, "score": 0.00531 }, "fix_state": "fixed", "fixed_in": [ "7.5.21" ], "id": "GHSA-r292-9mhp-454m", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "tar", "severity": "High", "summary": "node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection", "url": "https://github.com/advisories/GHSA-r292-9mhp-454m", "version": "6.2.1" }, { "aliases": [ "CVE-2026-23950" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-23950", "percentile": 0.18342, "score": 0.00264 }, "fix_state": "fixed", "fixed_in": [ "7.5.4" ], "id": "GHSA-r6q2-hw4h-h46w", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "tar", "severity": "High", "summary": "Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS", "url": "https://github.com/advisories/GHSA-r6q2-hw4h-h46w", "version": "6.2.1" }, { "aliases": [ "CVE-2025-59343" ], "ecosystem": "npm", "epss": { "cve": "CVE-2025-59343", "percentile": 0.46196, "score": 0.00553 }, "fix_state": "fixed", "fixed_in": [ "2.1.4" ], "id": "GHSA-vj76-c3g6-qr5v", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "tar-fs", "severity": "High", "summary": "tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball", "url": "https://github.com/advisories/GHSA-vj76-c3g6-qr5v", "version": "2.1.3" }, { "aliases": [ "CVE-2026-114141" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-114141", "percentile": 0.40891, "score": 0.00473 }, "fix_state": "fixed", "fixed_in": [ "5.0.1" ], "id": "GHSA-4qx8-w7c3-pj3p", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "toml", "severity": "High", "summary": "toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()", "url": "https://github.com/advisories/GHSA-4qx8-w7c3-pj3p", "version": "2.3.6" }, { "aliases": [ "CVE-2026-77465" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-77465", "percentile": 0.49169, "score": 0.00609 }, "fix_state": "fixed", "fixed_in": [ "4.2.0" ], "id": "GHSA-82x6-q7mm-w9cf", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "toml", "severity": "High", "summary": "toml-node: Uncontrolled Recursion", "url": "https://github.com/advisories/GHSA-82x6-q7mm-w9cf", "version": "2.3.6" }, { "aliases": [ "CVE-2026-114143" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-114143", "percentile": 0.4089, "score": 0.00473 }, "fix_state": "fixed", "fixed_in": [ "5.0.1" ], "id": "GHSA-9j65-hcg3-gc64", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "toml", "severity": "High", "summary": "toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()", "url": "https://github.com/advisories/GHSA-9j65-hcg3-gc64", "version": "2.3.6" }, { "aliases": [ "CVE-2026-114144" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-114144", "percentile": 0.38278, "score": 0.0044 }, "fix_state": "fixed", "fixed_in": [ "5.0.1" ], "id": "GHSA-9qmh-m7c6-f92p", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "toml", "severity": "High", "summary": "toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()", "url": "https://github.com/advisories/GHSA-9qmh-m7c6-f92p", "version": "2.3.6" }, { "aliases": [ "CVE-2026-63376" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-63376", "percentile": 0.52554, "score": 0.00683 }, "fix_state": "fixed", "fixed_in": [ "4.1.2" ], "id": "GHSA-v5mp-jgw5-2x6j", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "toml", "severity": "High", "summary": "toml-node: Prototype Pollution Leads to `Object.prototype` Corruption via `__proto__` Key-Path Desynchronization", "url": "https://github.com/advisories/GHSA-v5mp-jgw5-2x6j", "version": "2.3.6" }, { "aliases": [ "CVE-2026-27601" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-27601", "percentile": 0.64629, "score": 0.01063 }, "fix_state": "fixed", "fixed_in": [ "1.13.8" ], "id": "GHSA-qpx9-hpmf-5gmw", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "underscore", "severity": "High", "summary": "Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack", "url": "https://github.com/advisories/GHSA-qpx9-hpmf-5gmw", "version": "1.13.6" }, { "aliases": [ "CVE-2026-109383" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-109383", "percentile": 0.08019, "score": 0.00184 }, "fix_state": "fixed", "fixed_in": [ "6.29.1" ], "id": "GHSA-2m5v-pch6-74hx", "kev": null, "location": "actions/installer/package-lock.json", "osv_confirmed": true, "package": "undici", "severity": "High", "summary": "undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent", "url": "https://github.com/advisories/GHSA-2m5v-pch6-74hx", "version": "5.29.0" }, { "aliases": [ "CVE-2026-87018" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-87018", "percentile": 0.08361, "score": 0.00187 }, "fix_state": "fixed", "fixed_in": [ "6.29.1" ], "id": "GHSA-qrxm-fqhp-jwvm", "kev": null, "location": "actions/installer/package-lock.json", "osv_confirmed": true, "package": "undici", "severity": "High", "summary": "undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation", "url": "https://github.com/advisories/GHSA-qrxm-fqhp-jwvm", "version": "5.29.0" }, { "aliases": [ "CVE-2026-2229" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-2229", "percentile": 0.59972, "score": 0.00909 }, "fix_state": "fixed", "fixed_in": [ "6.24.0" ], "id": "GHSA-v9p9-hfj2-hcw8", "kev": null, "location": "actions/installer/package-lock.json", "osv_confirmed": true, "package": "undici", "severity": "High", "summary": "Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation", "url": "https://github.com/advisories/GHSA-v9p9-hfj2-hcw8", "version": "5.29.0" }, { "aliases": [ "CVE-2026-1526" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-1526", "percentile": 0.681, "score": 0.01196 }, "fix_state": "fixed", "fixed_in": [ "6.24.0" ], "id": "GHSA-vrm6-8vpv-qv8q", "kev": null, "location": "actions/installer/package-lock.json", "osv_confirmed": true, "package": "undici", "severity": "High", "summary": "Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression", "url": "https://github.com/advisories/GHSA-vrm6-8vpv-qv8q", "version": "5.29.0" }, { "aliases": [ "CVE-2026-12151" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-12151", "percentile": 0.56236, "score": 0.00789 }, "fix_state": "fixed", "fixed_in": [ "6.27.0" ], "id": "GHSA-vxpw-j846-p89q", "kev": null, "location": "actions/installer/package-lock.json", "osv_confirmed": true, "package": "undici", "severity": "High", "summary": "undici WebSocket client vulnerable to denial of service via fragment count bypass", "url": "https://github.com/advisories/GHSA-vxpw-j846-p89q", "version": "5.29.0" }, { "aliases": [ "CVE-2023-54404" ], "ecosystem": "npm", "epss": null, "fix_state": "fixed", "fixed_in": [ "4.6.6" ], "id": "GHSA-mrhx-c7xc-m3w5", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "zod", "severity": "High", "summary": "Zod can exhaust memory while validating oversized constrained collections", "url": "https://github.com/advisories/GHSA-mrhx-c7xc-m3w5", "version": "3.23.8" }, { "aliases": [ "CVE-2025-27789" ], "ecosystem": "npm", "epss": { "cve": "CVE-2025-27789", "percentile": 0.46829, "score": 0.00563 }, "fix_state": "fixed", "fixed_in": [ "7.26.10" ], "id": "GHSA-968p-4wvh-cqc8", "kev": null, "location": "actions/installer/package-lock.json", "osv_confirmed": true, "package": "@babel/runtime", "severity": "Medium", "summary": "Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups", "url": "https://github.com/advisories/GHSA-968p-4wvh-cqc8", "version": "7.21.0" }, { "aliases": [ "CVE-2025-27789" ], "ecosystem": "npm", "epss": { "cve": "CVE-2025-27789", "percentile": 0.46829, "score": 0.00563 }, "fix_state": "fixed", "fixed_in": [ "7.26.10" ], "id": "GHSA-968p-4wvh-cqc8", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "@babel/runtime-corejs3", "severity": "Medium", "summary": "Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups", "url": "https://github.com/advisories/GHSA-968p-4wvh-cqc8", "version": "7.24.5" }, { "aliases": [ "CVE-2026-74866" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-74866", "percentile": 0.25722, "score": 0.00326 }, "fix_state": "fixed", "fixed_in": [ "3.2.2" ], "id": "GHSA-gxm5-99cw-xjw9", "kev": null, "location": "actions/installer/package-lock.json", "osv_confirmed": true, "package": "@fastify/busboy", "severity": "Medium", "summary": "@fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name", "url": "https://github.com/advisories/GHSA-gxm5-99cw-xjw9", "version": "2.1.1" }, { "aliases": [ "CVE-2026-54285" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-54285", "percentile": 0.34479, "score": 0.00402 }, "fix_state": "fixed", "fixed_in": [ "2.8.0" ], "id": "GHSA-8988-4f7v-96qf", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "@opentelemetry/core", "severity": "Medium", "summary": "OpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagation", "url": "https://github.com/advisories/GHSA-8988-4f7v-96qf", "version": "1.24.1" }, { "aliases": [], "ecosystem": "npm", "epss": null, "fix_state": "fixed", "fixed_in": [ "0.6.1" ], "id": "GHSA-c6fg-446q-cg94", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "adm-zip", "severity": "Medium", "summary": "adm-zip: getDataAsync() bypasses the maxOutputLength size guard enforced by the synchronous getData() path", "url": "https://github.com/advisories/GHSA-c6fg-446q-cg94", "version": "0.5.12" }, { "aliases": [], "ecosystem": "npm", "epss": null, "fix_state": "fixed", "fixed_in": [ "0.6.1" ], "id": "GHSA-p634-w6r4-rjp2", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "adm-zip", "severity": "Medium", "summary": "adm-zip: Duplicate ZIP entry names: getEntry() and extractAllTo() resolve to different content", "url": "https://github.com/advisories/GHSA-p634-w6r4-rjp2", "version": "0.5.12" }, { "aliases": [ "CVE-2026-76845" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-76845", "percentile": 0.06437, "score": 0.00171 }, "fix_state": "not-fixed", "fixed_in": [], "id": "GHSA-vwc7-r8mq-g2x9", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "adm-zip", "severity": "Medium", "summary": "adm-zip extraction follows destination symlinks, allowing arbitrary file overwrite", "url": "https://github.com/advisories/GHSA-vwc7-r8mq-g2x9", "version": "0.5.12" }, { "aliases": [ "CVE-2025-69873" ], "ecosystem": "npm", "epss": { "cve": "CVE-2025-69873", "percentile": 0.45842, "score": 0.00547 }, "fix_state": "fixed", "fixed_in": [ "6.14.0" ], "id": "GHSA-2g4f-4pwh-qvx6", "kev": null, "location": "actions/installer/package-lock.json", "osv_confirmed": true, "package": "ajv", "severity": "Medium", "summary": "ajv has ReDoS when using `$data` option", "url": "https://github.com/advisories/GHSA-2g4f-4pwh-qvx6", "version": "6.12.6" }, { "aliases": [ "CVE-2026-2739" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-2739", "percentile": 0.44892, "score": 0.00531 }, "fix_state": "fixed", "fixed_in": [ "4.12.3" ], "id": "GHSA-378v-28hj-76wf", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "bn.js", "severity": "Medium", "summary": "bn.js affected by an infinite loop", "url": "https://github.com/advisories/GHSA-378v-28hj-76wf", "version": "4.12.0" }, { "aliases": [ "CVE-2026-33750" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-33750", "percentile": 0.38904, "score": 0.00447 }, "fix_state": "fixed", "fixed_in": [ "1.1.13" ], "id": "GHSA-f886-m6hf-6m8v", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "brace-expansion", "severity": "Medium", "summary": "brace-expansion: Zero-step sequence causes process hang and memory exhaustion", "url": "https://github.com/advisories/GHSA-f886-m6hf-6m8v", "version": "1.1.11" }, { "aliases": [ "CVE-2026-33750" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-33750", "percentile": 0.38904, "score": 0.00447 }, "fix_state": "fixed", "fixed_in": [ "2.0.3" ], "id": "GHSA-f886-m6hf-6m8v", "kev": null, "location": "actions/installer/package-lock.json", "osv_confirmed": true, "package": "brace-expansion", "severity": "Medium", "summary": "brace-expansion: Zero-step sequence causes process hang and memory exhaustion", "url": "https://github.com/advisories/GHSA-f886-m6hf-6m8v", "version": "2.0.1" }, { "aliases": [ "CVE-2026-102277" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-102277", "percentile": 0.37116, "score": 0.00428 }, "fix_state": "fixed", "fixed_in": [ "1.1.21" ], "id": "GHSA-q2hr-2g5m-vwhr", "kev": null, "location": "actions/installer/package-lock.json", "osv_confirmed": true, "package": "brace-expansion", "severity": "Medium", "summary": "brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service", "url": "https://github.com/advisories/GHSA-q2hr-2g5m-vwhr", "version": "1.1.11" }, { "aliases": [ "CVE-2026-102277" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-102277", "percentile": 0.37116, "score": 0.00428 }, "fix_state": "fixed", "fixed_in": [ "2.1.7" ], "id": "GHSA-q2hr-2g5m-vwhr", "kev": null, "location": "actions/installer/package-lock.json", "osv_confirmed": true, "package": "brace-expansion", "severity": "Medium", "summary": "brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service", "url": "https://github.com/advisories/GHSA-q2hr-2g5m-vwhr", "version": "2.0.1" }, { "aliases": [ "CVE-2026-41650" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-41650", "percentile": 0.14933, "score": 0.00238 }, "fix_state": "fixed", "fixed_in": [ "5.7.0" ], "id": "GHSA-gh4j-gqv2-49f6", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "fast-xml-parser", "severity": "Medium", "summary": "fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters", "url": "https://github.com/advisories/GHSA-gh4j-gqv2-49f6", "version": "4.2.5" }, { "aliases": [ "CVE-2026-33349" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-33349", "percentile": 0.40434, "score": 0.00467 }, "fix_state": "fixed", "fixed_in": [ "4.5.5" ], "id": "GHSA-jp2q-39xq-3w4g", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "fast-xml-parser", "severity": "Medium", "summary": "Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in fast-xml-parser", "url": "https://github.com/advisories/GHSA-jp2q-39xq-3w4g", "version": "4.2.5" }, { "aliases": [ "CVE-2026-85747" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-85747", "percentile": 0.12276, "score": 0.00218 }, "fix_state": "not-fixed", "fixed_in": [], "id": "GHSA-685w-q87j-wqw3", "in_binary": "vulnerable code not in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/docker/distribution", "severity": "Medium", "summary": "Distribution: Client `manifests.Get()` does not verify returned content against requested digest", "url": "https://github.com/advisories/GHSA-685w-q87j-wqw3", "version": "v2.8.3+incompatible" }, { "aliases": [ "CVE-2026-116585" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-116585", "percentile": 0.18368, "score": 0.00264 }, "fix_state": "fixed", "fixed_in": [ "4.1.5" ], "id": "GHSA-4w3g-jfj2-cw2q", "in_binary": "vulnerable code not in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/go-jose/go-jose/v4", "severity": "Medium", "summary": "Go JOSE: Panic during CBC-HMAC processing", "url": "https://github.com/advisories/GHSA-4w3g-jfj2-cw2q", "version": "v4.0.5" }, { "aliases": [ "CVE-2026-116586" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-116586", "percentile": 0.21769, "score": 0.00292 }, "fix_state": "fixed", "fixed_in": [ "4.1.5" ], "id": "GHSA-vvm8-gf78-28g4", "in_binary": "vulnerable code not in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/go-jose/go-jose/v4", "severity": "Medium", "summary": "Go JOSE: Panics in JSON parsing", "url": "https://github.com/advisories/GHSA-vvm8-gf78-28g4", "version": "v4.0.5" }, { "aliases": [], "ecosystem": "golang", "epss": null, "fix_state": "fixed", "fixed_in": [ "0.11.0" ], "id": "GHSA-pmwq-pjrm-6p5r", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/in-toto/in-toto-golang", "severity": "Medium", "summary": "in-toto-golang and in-toto-python have inconsistent negation behavior", "url": "https://github.com/advisories/GHSA-pmwq-pjrm-6p5r", "version": "v0.9.0" }, { "aliases": [ "CVE-2026-22703" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-22703", "percentile": 0.01102, "score": 0.00106 }, "fix_state": "fixed", "fixed_in": [ "2.6.2" ], "id": "GHSA-whqx-f9j3-ch6m", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/sigstore/cosign/v2", "severity": "Medium", "summary": "Cosign verification accepts any valid Rekor entry under certain conditions", "url": "https://github.com/advisories/GHSA-whqx-f9j3-ch6m", "version": "v2.4.1" }, { "aliases": [ "CVE-2026-39395", "GHSA-w6c6-c85g-mmv6" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-39395", "percentile": 0.15235, "score": 0.00241 }, "fix_state": "fixed", "fixed_in": [ "2.6.3" ], "id": "GO-2026-5694", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/sigstore/cosign/v2", "severity": "Medium", "summary": "Cosign's verify-blob-attestation reports false positive when payload parsing fails in github.com/sigstore/cosign", "url": "https://github.com/sigstore/cosign/security/advisories/GHSA-w6c6-c85g-mmv6", "version": "v2.4.1" }, { "aliases": [ "CVE-2026-22772" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-22772", "percentile": 0.14082, "score": 0.00232 }, "fix_state": "fixed", "fixed_in": [ "1.8.5" ], "id": "GHSA-59jp-pj84-45mr", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/sigstore/fulcio", "severity": "Medium", "summary": "Fulcio is vulnerable to Server-Side Request Forgery (SSRF) via MetaIssuer Regex Bypass", "url": "https://github.com/advisories/GHSA-59jp-pj84-45mr", "version": "v1.6.5" }, { "aliases": [ "CVE-2026-23831" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-23831", "percentile": 0.36887, "score": 0.00426 }, "fix_state": "fixed", "fixed_in": [ "1.5.0" ], "id": "GHSA-273p-m2cw-6833", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/sigstore/rekor", "severity": "Medium", "summary": "Rekor's COSE v0.0.1 entry type nil pointer dereference in Canonicalize via empty Message", "url": "https://github.com/advisories/GHSA-273p-m2cw-6833", "version": "v1.3.8" }, { "aliases": [ "CVE-2026-24117" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-24117", "percentile": 0.30183, "score": 0.00363 }, "fix_state": "fixed", "fixed_in": [ "1.5.0" ], "id": "GHSA-4c4x-jm2x-pf9j", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/sigstore/rekor", "severity": "Medium", "summary": "Rekor affected by Server-Side Request Forgery (SSRF) via provided public key URL", "url": "https://github.com/advisories/GHSA-4c4x-jm2x-pf9j", "version": "v1.3.8" }, { "aliases": [ "CVE-2026-24137" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-24137", "percentile": 0.332, "score": 0.0039 }, "fix_state": "fixed", "fixed_in": [ "1.10.4" ], "id": "GHSA-fcv2-xgw5-pqxf", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/sigstore/sigstore", "severity": "Medium", "summary": "sigstore legacy TUF client allows for arbitrary file writes with target cache path traversal", "url": "https://github.com/advisories/GHSA-fcv2-xgw5-pqxf", "version": "v1.8.12" }, { "aliases": [ "CVE-2026-49834" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-49834", "percentile": 0.07665, "score": 0.00181 }, "fix_state": "fixed", "fixed_in": [ "1.2.0" ], "id": "GHSA-9vcr-p3rj-q5q6", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/sigstore/sigstore-go", "severity": "Medium", "summary": "sigstore-go has a multi-log threshold bypass via single compromised log", "url": "https://github.com/advisories/GHSA-9vcr-p3rj-q5q6", "version": "v0.6.2" }, { "aliases": [ "CVE-2026-49835" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-49835", "percentile": 0.54767, "score": 0.00744 }, "fix_state": "not-fixed", "fixed_in": [], "id": "GHSA-9c54-x2g4-v92j", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/sigstore/timestamp-authority", "severity": "Medium", "summary": "Sigstore Timestamp Authority has OOM due to unbounded metric label cardinality", "url": "https://github.com/advisories/GHSA-9c54-x2g4-v92j", "version": "v1.2.2" }, { "aliases": [ "CVE-2026-39984", "GHSA-xm5m-wgh2-rrg3" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-39984", "percentile": 0.00795, "score": 0.00099 }, "fix_state": "unknown", "fixed_in": [], "id": "GO-2026-5763", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/sigstore/timestamp-authority", "severity": "Medium", "summary": "Sigstore Timestamp Authority has Improper Certificate Validation in verifier in github.com/sigstore/timestamp-authority", "url": "https://github.com/sigstore/timestamp-authority/security/advisories/GHSA-xm5m-wgh2-rrg3", "version": "v1.2.2" }, { "aliases": [ "CVE-2026-23991" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-23991", "percentile": 0.47771, "score": 0.00581 }, "fix_state": "fixed", "fixed_in": [ "2.3.1" ], "id": "GHSA-846p-jg2w-w324", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/theupdateframework/go-tuf/v2", "severity": "Medium", "summary": "go-tuf affected by client DoS via malformed server response", "url": "https://github.com/advisories/GHSA-846p-jg2w-w324", "version": "v2.0.1" }, { "aliases": [ "CVE-2026-23992" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-23992", "percentile": 0.11894, "score": 0.00215 }, "fix_state": "fixed", "fixed_in": [ "2.3.1" ], "id": "GHSA-fphv-w9fq-2525", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/theupdateframework/go-tuf/v2", "severity": "Medium", "summary": "go-tuf improperly validates the configured threshold for delegations", "url": "https://github.com/advisories/GHSA-fphv-w9fq-2525", "version": "v2.0.1" }, { "aliases": [ "CVE-2026-24686" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-24686", "percentile": 0.14046, "score": 0.00231 }, "fix_state": "fixed", "fixed_in": [ "2.4.1" ], "id": "GHSA-jqc5-w2xx-5vq4", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/theupdateframework/go-tuf/v2", "severity": "Medium", "summary": "go-tuf Path Traversal in TAP 4 Multirepo Client Allows Arbitrary File Write via Malicious Repository Names", "url": "https://github.com/advisories/GHSA-jqc5-w2xx-5vq4", "version": "v2.0.1" }, { "aliases": [ "CVE-2026-118773" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-118773", "percentile": 0.28707, "score": 0.0035 }, "fix_state": "fixed", "fixed_in": [ "14.0.2" ], "id": "GHSA-3g3m-2fjr-6pw4", "kev": null, "location": "actions/installer/package-lock.json", "osv_confirmed": true, "package": "glob", "severity": "Medium", "summary": "Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal", "url": "https://github.com/advisories/GHSA-3g3m-2fjr-6pw4", "version": "10.3.12" }, { "aliases": [ "CVE-2026-118773" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-118773", "percentile": 0.28707, "score": 0.0035 }, "fix_state": "fixed", "fixed_in": [ "14.0.2" ], "id": "GHSA-3g3m-2fjr-6pw4", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "glob", "severity": "Medium", "summary": "Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal", "url": "https://github.com/advisories/GHSA-3g3m-2fjr-6pw4", "version": "10.3.15" }, { "aliases": [ "CVE-2026-2303" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-2303", "percentile": 0.24814, "score": 0.00318 }, "fix_state": "fixed", "fixed_in": [ "1.17.7" ], "id": "GHSA-cp6g-7hqx-qxhp", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "go.mongodb.org/mongo-driver", "severity": "Medium", "summary": "mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling", "url": "https://github.com/advisories/GHSA-cp6g-7hqx-qxhp", "version": "v1.14.0" }, { "aliases": [ "CVE-2026-39828" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-39828", "percentile": 0.3079, "score": 0.00369 }, "fix_state": "fixed", "fixed_in": [ "0.52.0" ], "id": "GHSA-45gg-vh54-h5m9", "in_binary": "package in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "Medium", "summary": "golang.org/x/crypto vulnerable to invoking bypass of certificate restrictions", "url": "https://github.com/advisories/GHSA-45gg-vh54-h5m9", "version": "v0.36.0" }, { "aliases": [ "CVE-2026-39835" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-39835", "percentile": 0.43087, "score": 0.00504 }, "fix_state": "fixed", "fixed_in": [ "0.52.0" ], "id": "GHSA-78mq-xcr3-xm33", "in_binary": "package in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "Medium", "summary": "golang.org/x/crypto is vulnerable to invoking server panic during CheckHostKey/Authenticate flow", "url": "https://github.com/advisories/GHSA-78mq-xcr3-xm33", "version": "v0.36.0" }, { "aliases": [ "CVE-2026-46598" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-46598", "percentile": 0.35509, "score": 0.00412 }, "fix_state": "fixed", "fixed_in": [ "0.52.0" ], "id": "GHSA-9m57-25v3-79x9", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "Medium", "summary": "golang.org/x/crypto: Invoking pathological inputs can lead to client panic", "url": "https://github.com/advisories/GHSA-9m57-25v3-79x9", "version": "v0.36.0" }, { "aliases": [ "CVE-2025-47914" ], "ecosystem": "golang", "epss": { "cve": "CVE-2025-47914", "percentile": 0.45818, "score": 0.00546 }, "fix_state": "fixed", "fixed_in": [ "0.45.0" ], "id": "GHSA-f6x5-jh6r-wrfv", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "Medium", "summary": "golang.org/x/crypto/ssh/agent vulnerable to panic if message is malformed due to out of bounds read", "url": "https://github.com/advisories/GHSA-f6x5-jh6r-wrfv", "version": "v0.36.0" }, { "aliases": [ "CVE-2025-58181" ], "ecosystem": "golang", "epss": { "cve": "CVE-2025-58181", "percentile": 0.4853, "score": 0.00597 }, "fix_state": "fixed", "fixed_in": [ "0.45.0" ], "id": "GHSA-j5w8-q4qc-rx2x", "in_binary": "package in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "Medium", "summary": "golang.org/x/crypto/ssh allows an attacker to cause unbounded memory consumption", "url": "https://github.com/advisories/GHSA-j5w8-q4qc-rx2x", "version": "v0.36.0" }, { "aliases": [ "CVE-2026-39827" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-39827", "percentile": 0.20461, "score": 0.00279 }, "fix_state": "fixed", "fixed_in": [ "0.52.0" ], "id": "GHSA-qpw4-5x99-6vjp", "in_binary": "package in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "Medium", "summary": "golang.org/x/crypto: Invoking memory leak when rejecting channels can lead to DoS", "url": "https://github.com/advisories/GHSA-qpw4-5x99-6vjp", "version": "v0.36.0" }, { "aliases": [ "CVE-2026-25680" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-25680", "percentile": 0.25766, "score": 0.00326 }, "fix_state": "fixed", "fixed_in": [ "0.55.0" ], "id": "GHSA-5cv4-jp36-h3mw", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "Medium", "summary": "Go Net HTML parser is vulnerable to denial of service", "url": "https://github.com/advisories/GHSA-5cv4-jp36-h3mw", "version": "v0.38.0" }, { "aliases": [ "CVE-2025-47911" ], "ecosystem": "golang", "epss": { "cve": "CVE-2025-47911", "percentile": 0.46695, "score": 0.00561 }, "fix_state": "fixed", "fixed_in": [ "0.45.0" ], "id": "GO-2026-4440", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "Medium", "summary": "The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.", "url": "https://go.dev/cl/709876", "version": "v0.38.0" }, { "aliases": [ "CVE-2025-58190" ], "ecosystem": "golang", "epss": { "cve": "CVE-2025-58190", "percentile": 0.45427, "score": 0.0054 }, "fix_state": "fixed", "fixed_in": [ "0.45.0" ], "id": "GO-2026-4441", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "Medium", "summary": "The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.", "url": "https://groups.google.com/g/golang-announce/c/jnQcOYpiR2c", "version": "v0.38.0" }, { "aliases": [ "CVE-2026-42506" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-42506", "percentile": 0.14566, "score": 0.00235 }, "fix_state": "fixed", "fixed_in": [ "0.55.0" ], "id": "GO-2026-5025", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "Medium", "summary": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.", "url": "https://go.dev/issue/79571", "version": "v0.38.0" }, { "aliases": [ "CVE-2026-42502" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-42502", "percentile": 0.12982, "score": 0.00223 }, "fix_state": "fixed", "fixed_in": [ "0.55.0" ], "id": "GO-2026-5027", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "Medium", "summary": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.", "url": "https://go.dev/issue/79572", "version": "v0.38.0" }, { "aliases": [ "CVE-2026-25681" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-25681", "percentile": 0.12983, "score": 0.00223 }, "fix_state": "fixed", "fixed_in": [ "0.55.0" ], "id": "GO-2026-5029", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "Medium", "summary": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.", "url": "https://go.dev/issue/79574", "version": "v0.38.0" }, { "aliases": [ "CVE-2026-27136" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-27136", "percentile": 0.12983, "score": 0.00223 }, "fix_state": "fixed", "fixed_in": [ "0.55.0" ], "id": "GO-2026-5030", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "Medium", "summary": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.", "url": "https://go.dev/issue/79575", "version": "v0.38.0" }, { "aliases": [ "CVE-2026-84303" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-84303", "percentile": 0.23991, "score": 0.00311 }, "fix_state": "fixed", "fixed_in": [ "1.83.1" ], "id": "GHSA-qc2q-p7wx-3px3", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "google.golang.org/grpc", "severity": "Medium", "summary": "gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion", "url": "https://github.com/advisories/GHSA-qc2q-p7wx-3px3", "version": "v1.69.4" }, { "aliases": [ "CVE-2026-33916" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-33916", "percentile": 0.20535, "score": 0.0028 }, "fix_state": "fixed", "fixed_in": [ "4.7.9" ], "id": "GHSA-2qvq-rjwj-gvw9", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "handlebars", "severity": "Medium", "summary": "Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection", "url": "https://github.com/advisories/GHSA-2qvq-rjwj-gvw9", "version": "4.7.8" }, { "aliases": [], "ecosystem": "npm", "epss": null, "fix_state": "fixed", "fixed_in": [ "4.7.9" ], "id": "GHSA-7rx3-28cr-v5wh", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "handlebars", "severity": "Medium", "summary": "Handlebars.js has a Prototype Method Access Control Gap via Missing __lookupSetter__ Blocklist Entry", "url": "https://github.com/advisories/GHSA-7rx3-28cr-v5wh", "version": "4.7.8" }, { "aliases": [ "CVE-2026-106444" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-106444", "percentile": 0.21629, "score": 0.0029 }, "fix_state": "fixed", "fixed_in": [ "4.7.10" ], "id": "GHSA-xw65-4hp5-5hc7", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "handlebars", "severity": "Medium", "summary": "Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates", "url": "https://github.com/advisories/GHSA-xw65-4hp5-5hc7", "version": "4.7.8" }, { "aliases": [ "CVE-2026-101911" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-101911", "percentile": 0.32357, "score": 0.00383 }, "fix_state": "fixed", "fixed_in": [ "10.7.1" ], "id": "GHSA-h3mg-xc3c-68pw", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "ip-address", "severity": "Medium", "summary": "ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process", "url": "https://github.com/advisories/GHSA-h3mg-xc3c-68pw", "version": "9.0.5" }, { "aliases": [ "CVE-2026-101912" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-101912", "percentile": 0.30994, "score": 0.0037 }, "fix_state": "fixed", "fixed_in": [ "10.7.1" ], "id": "GHSA-j6r3-76f7-8jcv", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "ip-address", "severity": "Medium", "summary": "ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range", "url": "https://github.com/advisories/GHSA-j6r3-76f7-8jcv", "version": "9.0.5" }, { "aliases": [ "CVE-2026-101913" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-101913", "percentile": 0.32683, "score": 0.00386 }, "fix_state": "fixed", "fixed_in": [ "10.5.1" ], "id": "GHSA-rpw4-54j3-4h4q", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "ip-address", "severity": "Medium", "summary": "ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts", "url": "https://github.com/advisories/GHSA-rpw4-54j3-4h4q", "version": "9.0.5" }, { "aliases": [ "CVE-2026-111997" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-111997", "percentile": 0.24409, "score": 0.00315 }, "fix_state": "fixed", "fixed_in": [ "10.7.4" ], "id": "GHSA-rxp7-6hxx-x8q5", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "ip-address", "severity": "Medium", "summary": "ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process", "url": "https://github.com/advisories/GHSA-rxp7-6hxx-x8q5", "version": "9.0.5" }, { "aliases": [ "CVE-2026-42338" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-42338", "percentile": 0.40732, "score": 0.00471 }, "fix_state": "fixed", "fixed_in": [ "10.1.1" ], "id": "GHSA-v2v4-37r5-5v8g", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "ip-address", "severity": "Medium", "summary": "ip-address has XSS in Address6 HTML-emitting methods", "url": "https://github.com/advisories/GHSA-v2v4-37r5-5v8g", "version": "9.0.5" }, { "aliases": [ "CVE-2026-53550" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-53550", "percentile": 0.35866, "score": 0.00415 }, "fix_state": "fixed", "fixed_in": [ "3.15.0" ], "id": "GHSA-h67p-54hq-rp68", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "js-yaml", "severity": "Medium", "summary": "JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases", "url": "https://github.com/advisories/GHSA-h67p-54hq-rp68", "version": "3.14.1" }, { "aliases": [ "CVE-2026-53550" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-53550", "percentile": 0.35866, "score": 0.00415 }, "fix_state": "fixed", "fixed_in": [ "4.2.0" ], "id": "GHSA-h67p-54hq-rp68", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "js-yaml", "severity": "Medium", "summary": "JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases", "url": "https://github.com/advisories/GHSA-h67p-54hq-rp68", "version": "4.1.0" }, { "aliases": [ "CVE-2025-64718" ], "ecosystem": "npm", "epss": { "cve": "CVE-2025-64718", "percentile": 0.36631, "score": 0.00423 }, "fix_state": "fixed", "fixed_in": [ "3.14.2" ], "id": "GHSA-mh29-5h37-fv8m", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "js-yaml", "severity": "Medium", "summary": "js-yaml has prototype pollution in merge (<<)", "url": "https://github.com/advisories/GHSA-mh29-5h37-fv8m", "version": "3.14.1" }, { "aliases": [ "CVE-2025-64718" ], "ecosystem": "npm", "epss": { "cve": "CVE-2025-64718", "percentile": 0.36631, "score": 0.00423 }, "fix_state": "fixed", "fixed_in": [ "4.1.1" ], "id": "GHSA-mh29-5h37-fv8m", "kev": null, "location": "actions/installer/package-lock.json", "osv_confirmed": true, "package": "js-yaml", "severity": "Medium", "summary": "js-yaml has prototype pollution in merge (<<)", "url": "https://github.com/advisories/GHSA-mh29-5h37-fv8m", "version": "4.1.0" }, { "aliases": [ "CVE-2026-12208" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-12208", "percentile": 0.24365, "score": 0.00314 }, "fix_state": "fixed", "fixed_in": [ "2.2.1" ], "id": "GHSA-663r-x48j-fg8p", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "jsonata", "severity": "Medium", "summary": "jsonata: Function Binding Prototype Pollution via hasOwnProperty Override", "url": "https://github.com/advisories/GHSA-663r-x48j-fg8p", "version": "2.0.5" }, { "aliases": [ "CVE-2026-2950" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-2950", "percentile": 0.2717, "score": 0.00337 }, "fix_state": "fixed", "fixed_in": [ "4.18.0" ], "id": "GHSA-f23m-r3pf-42rh", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "lodash", "severity": "Medium", "summary": "lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`", "url": "https://github.com/advisories/GHSA-f23m-r3pf-42rh", "version": "4.17.21" }, { "aliases": [ "CVE-2025-13465" ], "ecosystem": "npm", "epss": { "cve": "CVE-2025-13465", "percentile": 0.78784, "score": 0.01823 }, "fix_state": "fixed", "fixed_in": [ "4.17.23" ], "id": "GHSA-xxjr-mmjv-4gpg", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "lodash", "severity": "Medium", "summary": "Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions", "url": "https://github.com/advisories/GHSA-xxjr-mmjv-4gpg", "version": "4.17.21" }, { "aliases": [], "ecosystem": "npm", "epss": null, "fix_state": "fixed", "fixed_in": [ "14.3.1" ], "id": "GHSA-253c-mchw-3w2r", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "markdown-it", "severity": "Medium", "summary": "markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds", "url": "https://github.com/advisories/GHSA-253c-mchw-3w2r", "version": "14.1.0" }, { "aliases": [ "CVE-2026-2327" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-2327", "percentile": 0.54574, "score": 0.00739 }, "fix_state": "fixed", "fixed_in": [ "14.1.1" ], "id": "GHSA-38c4-r59v-3vqw", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "markdown-it", "severity": "Medium", "summary": "markdown-it is has a Regular Expression Denial of Service (ReDoS)", "url": "https://github.com/advisories/GHSA-38c4-r59v-3vqw", "version": "14.1.0" }, { "aliases": [ "CVE-2026-48988" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-48988", "percentile": 0.3186, "score": 0.00379 }, "fix_state": "fixed", "fixed_in": [ "14.2.0" ], "id": "GHSA-6v5v-wf23-fmfq", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "markdown-it", "severity": "Medium", "summary": "markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations", "url": "https://github.com/advisories/GHSA-6v5v-wf23-fmfq", "version": "14.1.0" }, { "aliases": [ "CVE-2024-4067" ], "ecosystem": "npm", "epss": { "cve": "CVE-2024-4067", "percentile": 0.73001, "score": 0.01429 }, "fix_state": "fixed", "fixed_in": [ "4.0.8" ], "id": "GHSA-952p-6rrq-rcjv", "kev": null, "location": "actions/installer/package-lock.json", "osv_confirmed": true, "package": "micromatch", "severity": "Medium", "summary": "Regular Expression Denial of Service (ReDoS) in micromatch", "url": "https://github.com/advisories/GHSA-952p-6rrq-rcjv", "version": "4.0.5" }, { "aliases": [ "CVE-2026-118764" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-118764", "percentile": 0.21751, "score": 0.00291 }, "fix_state": "fixed", "fixed_in": [ "11.0.1" ], "id": "GHSA-g3hv-75wg-m249", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "minimatch", "severity": "Medium", "summary": "minimatch has potential denial of service via globparts amplification", "url": "https://github.com/advisories/GHSA-g3hv-75wg-m249", "version": "3.1.2" }, { "aliases": [ "CVE-2026-118764" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-118764", "percentile": 0.21751, "score": 0.00291 }, "fix_state": "fixed", "fixed_in": [ "11.0.1" ], "id": "GHSA-g3hv-75wg-m249", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "minimatch", "severity": "Medium", "summary": "minimatch has potential denial of service via globparts amplification", "url": "https://github.com/advisories/GHSA-g3hv-75wg-m249", "version": "9.0.2" }, { "aliases": [ "CVE-2026-118764" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-118764", "percentile": 0.21751, "score": 0.00291 }, "fix_state": "fixed", "fixed_in": [ "11.0.1" ], "id": "GHSA-g3hv-75wg-m249", "kev": null, "location": "actions/installer/package-lock.json", "osv_confirmed": true, "package": "minimatch", "severity": "Medium", "summary": "minimatch has potential denial of service via globparts amplification", "url": "https://github.com/advisories/GHSA-g3hv-75wg-m249", "version": "9.0.3" }, { "aliases": [ "CVE-2026-118764" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-118764", "percentile": 0.21751, "score": 0.00291 }, "fix_state": "fixed", "fixed_in": [ "11.0.1" ], "id": "GHSA-g3hv-75wg-m249", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "minimatch", "severity": "Medium", "summary": "minimatch has potential denial of service via globparts amplification", "url": "https://github.com/advisories/GHSA-g3hv-75wg-m249", "version": "9.0.4" }, { "aliases": [ "CVE-2026-17495" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-17495", "percentile": 0.44156, "score": 0.00519 }, "fix_state": "fixed", "fixed_in": [ "2.31.0" ], "id": "GHSA-4p3w-j4w9-5jqw", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "moment", "severity": "Medium", "summary": "moment vulnerable to Path Traversal via crafted non-string locale name", "url": "https://github.com/advisories/GHSA-4p3w-j4w9-5jqw", "version": "2.30.1" }, { "aliases": [ "CVE-2024-55565" ], "ecosystem": "npm", "epss": { "cve": "CVE-2024-55565", "percentile": 0.51785, "score": 0.00665 }, "fix_state": "fixed", "fixed_in": [ "3.3.8" ], "id": "GHSA-mwcw-c2x4-8c55", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "nanoid", "severity": "Medium", "summary": "Predictable results in nanoid generation when given non-integer values", "url": "https://github.com/advisories/GHSA-mwcw-c2x4-8c55", "version": "3.3.7" }, { "aliases": [ "CVE-2026-33672" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-33672", "percentile": 0.36831, "score": 0.00425 }, "fix_state": "fixed", "fixed_in": [ "2.3.2" ], "id": "GHSA-3v7f-55p6-f55p", "kev": null, "location": "actions/installer/package-lock.json", "osv_confirmed": true, "package": "picomatch", "severity": "Medium", "summary": "Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching", "url": "https://github.com/advisories/GHSA-3v7f-55p6-f55p", "version": "2.3.1" }, { "aliases": [ "CVE-2026-82417" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-82417", "percentile": 0.33809, "score": 0.00396 }, "fix_state": "fixed", "fixed_in": [ "6.16.0" ], "id": "GHSA-4mjr-xmp4-gh2g", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "qs", "severity": "Medium", "summary": "qs: Denial of Service via Attacker Controlled isBuffer", "url": "https://github.com/advisories/GHSA-4mjr-xmp4-gh2g", "version": "6.12.1" }, { "aliases": [ "CVE-2026-110816" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-110816", "percentile": 0.30708, "score": 0.00368 }, "fix_state": "fixed", "fixed_in": [ "6.16.1" ], "id": "GHSA-6pq8-jhm2-2vcw", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "qs", "severity": "Medium", "summary": "qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)", "url": "https://github.com/advisories/GHSA-6pq8-jhm2-2vcw", "version": "6.12.1" }, { "aliases": [ "CVE-2025-15284" ], "ecosystem": "npm", "epss": { "cve": "CVE-2025-15284", "percentile": 0.39084, "score": 0.0045 }, "fix_state": "fixed", "fixed_in": [ "6.14.1" ], "id": "GHSA-6rw7-vpxm-498p", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "qs", "severity": "Medium", "summary": "qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion", "url": "https://github.com/advisories/GHSA-6rw7-vpxm-498p", "version": "6.12.1" }, { "aliases": [ "CVE-2026-8723" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-8723", "percentile": 0.34217, "score": 0.00399 }, "fix_state": "fixed", "fixed_in": [ "6.15.2" ], "id": "GHSA-q8mj-m7cp-5q26", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "qs", "severity": "Medium", "summary": "qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set", "url": "https://github.com/advisories/GHSA-q8mj-m7cp-5q26", "version": "6.12.1" }, { "aliases": [ "CVE-2026-68499" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-68499", "percentile": 0.07964, "score": 0.00184 }, "fix_state": "fixed", "fixed_in": [ "1.25.2" ], "id": "GHSA-6hxr-mr5r-9836", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "re2", "severity": "Medium", "summary": "re2: Global `String.prototype.match` with an empty-matchable pattern never advances \u2192 infinite loop with unbounded native memory growth (DoS)", "url": "https://github.com/advisories/GHSA-6hxr-mr5r-9836", "version": "1.20.11" }, { "aliases": [ "CVE-2026-71430" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-71430", "percentile": 0.04865, "score": 0.00157 }, "fix_state": "fixed", "fixed_in": [ "1.25.1" ], "id": "GHSA-8hcv-x26h-mcgp", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "re2", "severity": "Medium", "summary": "node-re2: String.prototype.replace(re2, template) aborts the Node process (uncatchable ToLocalChecked on empty MaybeLocal) when the result exceeds V8's max string length", "url": "https://github.com/advisories/GHSA-8hcv-x26h-mcgp", "version": "1.20.11" }, { "aliases": [ "CVE-2026-67550" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-67550", "percentile": 0.05292, "score": 0.00161 }, "fix_state": "fixed", "fixed_in": [ "1.25.2" ], "id": "GHSA-ff84-5f28-78qj", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "re2", "severity": "Medium", "summary": "re2: Out-of-bounds heap read in `exec`/`test`/`match` via attacker-influenced `lastIndex` on a non-ASCII subject \u2192 uncatchable process crash (DoS)", "url": "https://github.com/advisories/GHSA-ff84-5f28-78qj", "version": "1.20.11" }, { "aliases": [ "CVE-2026-71498" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-71498", "percentile": 0.06811, "score": 0.00174 }, "fix_state": "fixed", "fixed_in": [ "1.26.1" ], "id": "GHSA-j4r3-hg7j-8chg", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "re2", "severity": "Medium", "summary": "node-re2: Out-of-bounds heap read in `replace`/`split` via a `Buffer` ending in a truncated multi-byte UTF-8 character \u2192 adjacent heap memory disclosed to JavaScript", "url": "https://github.com/advisories/GHSA-j4r3-hg7j-8chg", "version": "1.20.11" }, { "aliases": [], "ecosystem": "npm", "epss": null, "fix_state": "fixed", "fixed_in": [ "40.33.0" ], "id": "GHSA-36j9-mx87-2cff", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "renovate", "severity": "Medium", "summary": "Renovate vulnerable to arbitrary command injection via hermit manager and maliciously named dependencies", "url": "https://github.com/advisories/GHSA-36j9-mx87-2cff", "version": "37.374.1" }, { "aliases": [], "ecosystem": "npm", "epss": null, "fix_state": "fixed", "fixed_in": [ "40.33.0" ], "id": "GHSA-3f44-xw83-3pmg", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "renovate", "severity": "Medium", "summary": "Renovate vulnerable to arbitrary command injection via helmv3 manager and malicious Chart.yaml file", "url": "https://github.com/advisories/GHSA-3f44-xw83-3pmg", "version": "37.374.1" }, { "aliases": [], "ecosystem": "npm", "epss": null, "fix_state": "fixed", "fixed_in": [ "40.33.0" ], "id": "GHSA-fr4j-65pv-gjjj", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "renovate", "severity": "Medium", "summary": "Renovate vulnerable to arbitrary command injection via npm manager and malicious Renovate configuration", "url": "https://github.com/advisories/GHSA-fr4j-65pv-gjjj", "version": "37.374.1" }, { "aliases": [], "ecosystem": "npm", "epss": null, "fix_state": "fixed", "fixed_in": [ "42.68.5" ], "id": "GHSA-pfq2-hh62-7m96", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "renovate", "severity": "Medium", "summary": "Renovate vulnerable to arbitrary command injection via Gradle Wrapper and malicious `distributionUrl`", "url": "https://github.com/advisories/GHSA-pfq2-hh62-7m96", "version": "37.374.1" }, { "aliases": [ "CVE-2026-59875" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-59875", "percentile": 0.29158, "score": 0.00354 }, "fix_state": "fixed", "fixed_in": [ "7.5.17" ], "id": "GHSA-gvwx-54wh-qm9j", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "tar", "severity": "Medium", "summary": "node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records", "url": "https://github.com/advisories/GHSA-gvwx-54wh-qm9j", "version": "6.2.1" }, { "aliases": [ "CVE-2026-53655" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-53655", "percentile": 0.04762, "score": 0.00156 }, "fix_state": "fixed", "fixed_in": [ "7.5.16" ], "id": "GHSA-vmf3-w455-68vh", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "tar", "severity": "Medium", "summary": "node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)", "url": "https://github.com/advisories/GHSA-vmf3-w455-68vh", "version": "6.2.1" }, { "aliases": [ "CVE-2026-59871" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-59871", "percentile": 0.50871, "score": 0.00644 }, "fix_state": "fixed", "fixed_in": [ "7.5.18" ], "id": "GHSA-w8wr-v893-vjvp", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "tar", "severity": "Medium", "summary": "node-tar: Process crash via PAX numeric path type confusion", "url": "https://github.com/advisories/GHSA-w8wr-v893-vjvp", "version": "6.2.1" }, { "aliases": [ "CVE-2026-1525" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-1525", "percentile": 0.44454, "score": 0.00524 }, "fix_state": "fixed", "fixed_in": [ "6.24.0" ], "id": "GHSA-2mjp-6q6p-2qxm", "kev": null, "location": "actions/installer/package-lock.json", "osv_confirmed": true, "package": "undici", "severity": "Medium", "summary": "Undici has an HTTP Request/Response Smuggling issue", "url": "https://github.com/advisories/GHSA-2mjp-6q6p-2qxm", "version": "5.29.0" }, { "aliases": [ "CVE-2026-1527" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-1527", "percentile": 0.21318, "score": 0.00287 }, "fix_state": "fixed", "fixed_in": [ "6.24.0" ], "id": "GHSA-4992-7rv2-5pvq", "kev": null, "location": "actions/installer/package-lock.json", "osv_confirmed": true, "package": "undici", "severity": "Medium", "summary": "Undici has CRLF Injection in undici via `upgrade` option", "url": "https://github.com/advisories/GHSA-4992-7rv2-5pvq", "version": "5.29.0" }, { "aliases": [ "CVE-2026-16728" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-16728", "percentile": 0.21384, "score": 0.00288 }, "fix_state": "fixed", "fixed_in": [ "6.28.0" ], "id": "GHSA-8xcm-r25x-g524", "kev": null, "location": "actions/installer/package-lock.json", "osv_confirmed": true, "package": "undici", "severity": "Medium", "summary": "undici vulnerable to downstream response desynchronization via retry interceptor", "url": "https://github.com/advisories/GHSA-8xcm-r25x-g524", "version": "5.29.0" }, { "aliases": [ "CVE-2026-109932" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-109932", "percentile": 0.25126, "score": 0.00321 }, "fix_state": "fixed", "fixed_in": [ "6.29.1" ], "id": "GHSA-9fm3-97px-rjf6", "kev": null, "location": "actions/installer/package-lock.json", "osv_confirmed": true, "package": "undici", "severity": "Medium", "summary": "undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering", "url": "https://github.com/advisories/GHSA-9fm3-97px-rjf6", "version": "5.29.0" }, { "aliases": [ "CVE-2026-22036" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-22036", "percentile": 0.39626, "score": 0.00457 }, "fix_state": "fixed", "fixed_in": [ "6.23.0" ], "id": "GHSA-g9mf-h72j-4rw9", "kev": null, "location": "actions/installer/package-lock.json", "osv_confirmed": true, "package": "undici", "severity": "Medium", "summary": "Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion", "url": "https://github.com/advisories/GHSA-g9mf-h72j-4rw9", "version": "5.29.0" }, { "aliases": [ "CVE-2026-15157" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-15157", "percentile": 0.17976, "score": 0.00261 }, "fix_state": "fixed", "fixed_in": [ "6.28.0" ], "id": "GHSA-m8rv-5g2x-5cg5", "kev": null, "location": "actions/installer/package-lock.json", "osv_confirmed": true, "package": "undici", "severity": "Medium", "summary": "undici vulnerable to CRLF Injection via blob-like body 'type' property", "url": "https://github.com/advisories/GHSA-m8rv-5g2x-5cg5", "version": "5.29.0" }, { "aliases": [ "CVE-2026-9679" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-9679", "percentile": 0.17423, "score": 0.00257 }, "fix_state": "fixed", "fixed_in": [ "6.27.0" ], "id": "GHSA-p88m-4jfj-68fv", "kev": null, "location": "actions/installer/package-lock.json", "osv_confirmed": true, "package": "undici", "severity": "Medium", "summary": "undici vulnerable to HTTP header injection via Set-Cookie percent-decoding", "url": "https://github.com/advisories/GHSA-p88m-4jfj-68fv", "version": "5.29.0" }, { "aliases": [ "CVE-2026-16729" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-16729", "percentile": 0.20316, "score": 0.00278 }, "fix_state": "fixed", "fixed_in": [ "6.28.0" ], "id": "GHSA-v3r7-h72x-cjcm", "kev": null, "location": "actions/installer/package-lock.json", "osv_confirmed": true, "package": "undici", "severity": "Medium", "summary": "undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields", "url": "https://github.com/advisories/GHSA-v3r7-h72x-cjcm", "version": "5.29.0" }, { "aliases": [ "CVE-2026-41907" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-41907", "percentile": 0.28633, "score": 0.0035 }, "fix_state": "fixed", "fixed_in": [ "11.1.1" ], "id": "GHSA-w5hq-g745-h8pq", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "uuid", "severity": "Medium", "summary": "uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided", "url": "https://github.com/advisories/GHSA-w5hq-g745-h8pq", "version": "9.0.1" }, { "aliases": [], "ecosystem": "npm", "epss": null, "fix_state": "fixed", "fixed_in": [ "4.4.0" ], "id": "GHSA-6475-r3vj-m8vf", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "@smithy/config-resolver", "severity": "Low", "summary": "AWS SDK for JavaScript v3 adopted defense in depth enhancement for region parameter value", "url": "https://github.com/advisories/GHSA-6475-r3vj-m8vf", "version": "2.2.0" }, { "aliases": [], "ecosystem": "npm", "epss": null, "fix_state": "fixed", "fixed_in": [ "4.4.0" ], "id": "GHSA-6475-r3vj-m8vf", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "@smithy/config-resolver", "severity": "Low", "summary": "AWS SDK for JavaScript v3 adopted defense in depth enhancement for region parameter value", "url": "https://github.com/advisories/GHSA-6475-r3vj-m8vf", "version": "3.0.0" }, { "aliases": [ "CVE-2025-5889" ], "ecosystem": "npm", "epss": { "cve": "CVE-2025-5889", "percentile": 0.47999, "score": 0.00586 }, "fix_state": "fixed", "fixed_in": [ "1.1.12" ], "id": "GHSA-v6h2-p8h4-qcjw", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "brace-expansion", "severity": "Low", "summary": "brace-expansion Regular Expression Denial of Service vulnerability", "url": "https://github.com/advisories/GHSA-v6h2-p8h4-qcjw", "version": "1.1.11" }, { "aliases": [ "CVE-2025-5889" ], "ecosystem": "npm", "epss": { "cve": "CVE-2025-5889", "percentile": 0.47999, "score": 0.00586 }, "fix_state": "fixed", "fixed_in": [ "2.0.2" ], "id": "GHSA-v6h2-p8h4-qcjw", "kev": null, "location": "actions/installer/package-lock.json", "osv_confirmed": true, "package": "brace-expansion", "severity": "Low", "summary": "brace-expansion Regular Expression Denial of Service vulnerability", "url": "https://github.com/advisories/GHSA-v6h2-p8h4-qcjw", "version": "2.0.1" }, { "aliases": [ "CVE-2026-93753" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-93753", "percentile": 0.43819, "score": 0.00514 }, "fix_state": "not-fixed", "fixed_in": [], "id": "GHSA-gcqx-w48m-w2h4", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "deepmerge", "severity": "Low", "summary": "deepmerge mergeObject() allows prototype poisoning of returned objects", "url": "https://github.com/advisories/GHSA-gcqx-w48m-w2h4", "version": "4.3.1" }, { "aliases": [ "CVE-2026-24001" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-24001", "percentile": 0.49541, "score": 0.00616 }, "fix_state": "fixed", "fixed_in": [ "5.2.2" ], "id": "GHSA-73rr-hh4g-fpgx", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "diff", "severity": "Low", "summary": "jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch", "url": "https://github.com/advisories/GHSA-73rr-hh4g-fpgx", "version": "5.2.0" }, { "aliases": [ "CVE-2026-27942" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-27942", "percentile": 0.45634, "score": 0.00543 }, "fix_state": "fixed", "fixed_in": [ "4.5.4" ], "id": "GHSA-fj3w-jwp8-x2g3", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "fast-xml-parser", "severity": "Low", "summary": "fast-xml-parser has stack overflow in XMLBuilder with preserveOrder", "url": "https://github.com/advisories/GHSA-fj3w-jwp8-x2g3", "version": "4.2.5" }, { "aliases": [ "CVE-2026-24122", "GHSA-wfqv-66vq-46rm" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-24122", "percentile": 0.11979, "score": 0.00215 }, "fix_state": "unknown", "fixed_in": [], "id": "GO-2026-4529", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/sigstore/cosign/v2", "severity": "Low", "summary": "Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigstore/cosign", "url": "https://github.com/sigstore/cosign/security/advisories/GHSA-wfqv-66vq-46rm", "version": "v2.4.1" }, { "aliases": [ "CVE-2026-54787" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-54787", "percentile": 0.02863, "score": 0.00134 }, "fix_state": "fixed", "fixed_in": [ "1.2.1" ], "id": "GHSA-wqqc-jjcq-vfxm", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/sigstore/sigstore-go", "severity": "Low", "summary": "sigstore-go fails to check signature timestamps against a signing key's validity period", "url": "https://github.com/advisories/GHSA-wqqc-jjcq-vfxm", "version": "v0.6.2" }, { "aliases": [ "CVE-2026-39824" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-39824", "percentile": 0.01457, "score": 0.00114 }, "fix_state": "fixed", "fixed_in": [ "0.44.0" ], "id": "GO-2026-5024", "in_binary": "vulnerable code not in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/sys", "severity": "Low", "summary": "NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated string rather than an error.", "url": "https://go.dev/issue/78916", "version": "v0.31.0" }, { "aliases": [], "ecosystem": "npm", "epss": null, "fix_state": "fixed", "fixed_in": [ "4.7.9" ], "id": "GHSA-442j-39wm-28r2", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "handlebars", "severity": "Low", "summary": "Handlebars.js has a Property Access Validation Bypass in container.lookup", "url": "https://github.com/advisories/GHSA-442j-39wm-28r2", "version": "4.7.8" }, { "aliases": [ "CVE-2026-111766" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-111766", "percentile": 0.37056, "score": 0.00428 }, "fix_state": "fixed", "fixed_in": [ "14.3.3" ], "id": "GHSA-vfgh-jcmw-g37q", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "markdown-it", "severity": "Low", "summary": "markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled", "url": "https://github.com/advisories/GHSA-vfgh-jcmw-g37q", "version": "14.1.0" }, { "aliases": [ "CVE-2026-2391" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-2391", "percentile": 0.45582, "score": 0.00542 }, "fix_state": "fixed", "fixed_in": [ "6.14.2" ], "id": "GHSA-w7fw-mjwx-w883", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "qs", "severity": "Low", "summary": "qs's arrayLimit bypass in comma parsing allows denial of service", "url": "https://github.com/advisories/GHSA-w7fw-mjwx-w883", "version": "6.12.1" }, { "aliases": [ "CVE-2026-6733" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-6733", "percentile": 0.12535, "score": 0.0022 }, "fix_state": "fixed", "fixed_in": [ "6.27.0" ], "id": "GHSA-35p6-xmwp-9g52", "kev": null, "location": "actions/installer/package-lock.json", "osv_confirmed": true, "package": "undici", "severity": "Low", "summary": "undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse", "url": "https://github.com/advisories/GHSA-35p6-xmwp-9g52", "version": "5.29.0" }, { "aliases": [ "CVE-2026-11525" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-11525", "percentile": 0.14955, "score": 0.00238 }, "fix_state": "fixed", "fixed_in": [ "6.27.0" ], "id": "GHSA-g8m3-5g58-fq7m", "kev": null, "location": "actions/installer/package-lock.json", "osv_confirmed": true, "package": "undici", "severity": "Low", "summary": "undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching", "url": "https://github.com/advisories/GHSA-g8m3-5g58-fq7m", "version": "5.29.0" }, { "aliases": [ "CVE-2026-18540" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-18540", "percentile": 0.23781, "score": 0.00309 }, "fix_state": "fixed", "fixed_in": [ "6.28.1" ], "id": "GHSA-r53p-7pc4-xj5r", "kev": null, "location": "actions/installer/package-lock.json", "osv_confirmed": true, "package": "undici", "severity": "Low", "summary": "undici vulnerable to downstream response splitting via retry interceptor", "url": "https://github.com/advisories/GHSA-r53p-7pc4-xj5r", "version": "5.29.0" }, { "aliases": [ "GHSA-mqqf-5wvp-8fh8" ], "ecosystem": "golang", "epss": null, "fix_state": "unknown", "fixed_in": [], "id": "GO-2026-4316", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/go-chi/chi", "severity": "Unknown", "summary": "Open redirect vulnerability in the RedirectSlashes middleware in github.com/go-chi/chi", "url": "https://github.com/go-chi/chi/security/advisories/GHSA-mqqf-5wvp-8fh8", "version": "v4.1.2+incompatible" }, { "aliases": [], "ecosystem": "golang", "epss": null, "fix_state": "unknown", "fixed_in": [], "id": "GO-2026-5932", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "Unknown", "summary": "The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used. If you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained f", "url": "https://go.dev/issue/44226", "version": "v0.36.0" }, { "aliases": [ "CVE-2026-78661" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-78661", "percentile": 0.08063, "score": 0.00185 }, "fix_state": "fixed", "fixed_in": [ "0.62.0" ], "id": "GO-2026-6860", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "Unknown", "summary": "When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as \"a\") cau", "url": "https://go.dev/cl/849365", "version": "v0.38.0" }, { "aliases": [ "CVE-2026-97045" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-97045", "percentile": 0.10117, "score": 0.00202 }, "fix_state": "fixed", "fixed_in": [ "0.62.0" ], "id": "GO-2026-6866", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "Unknown", "summary": "In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as or f", "url": "https://go.dev/cl/855121", "version": "v0.38.0" } ], "workflow_audit": { "files": 15, "findings": [ { "confidence": "Medium", "description": "use of fundamentally insecure workflow trigger", "file": ".github/workflows/e2e.schedule.cli.yml", "line": 2, "note": "this workflow", "rule": "dangerous-triggers", "severity": "High", "url": "https://docs.zizmor.sh/audits/#dangerous-triggers" }, { "confidence": "High", "description": "unpinned action reference", "file": ".github/workflows/release.yml", "line": 36, "note": "this job", "rule": "unpinned-uses", "severity": "High", "url": "https://docs.zizmor.sh/audits/#unpinned-uses" }, { "confidence": "High", "description": "overly broad permissions", "file": ".github/workflows/e2e.schedule.installer.yml", "line": 13, "note": "uses read-all permissions", "rule": "excessive-permissions", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#excessive-permissions" }, { "confidence": "High", "description": "overly broad permissions", "file": ".github/workflows/release.yml", "line": 13, "note": "uses read-all permissions", "rule": "excessive-permissions", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#excessive-permissions" }, { "confidence": "High", "description": "overly broad permissions", "file": ".github/workflows/release.yml", "line": 59, "note": "this job", "rule": "excessive-permissions", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#excessive-permissions" }, { "confidence": "High", "description": "use GitHub's dedicated self-repository syntax", "file": ".github/workflows/e2e.schedule.installer.yml", "line": 86, "note": "this step", "rule": "self-repository", "severity": "Low", "url": "https://docs.zizmor.sh/audits/#self-repository" }, { "confidence": "High", "description": "use GitHub's dedicated self-repository syntax", "file": ".github/workflows/e2e.schedule.installer.yml", "line": 122, "note": "this step", "rule": "self-repository", "severity": "Low", "url": "https://docs.zizmor.sh/audits/#self-repository" }, { "confidence": "High", "description": "use GitHub's dedicated self-repository syntax", "file": ".github/workflows/e2e.schedule.installer.yml", "line": 149, "note": "this step", "rule": "self-repository", "severity": "Low", "url": "https://docs.zizmor.sh/audits/#self-repository" }, { "confidence": "High", "description": "use GitHub's dedicated self-repository syntax", "file": ".github/workflows/e2e.schedule.installer.yml", "line": 163, "note": "this step", "rule": "self-repository", "severity": "Low", "url": "https://docs.zizmor.sh/audits/#self-repository" }, { "confidence": "High", "description": "use GitHub's dedicated self-repository syntax", "file": ".github/workflows/e2e.schedule.installer.yml", "line": 178, "note": "this step", "rule": "self-repository", "severity": "Low", "url": "https://docs.zizmor.sh/audits/#self-repository" } ] } }, "updated": "2026-11-02" }