infisical

Manage application secrets with automation integrations

Infisical/infisical · Secret Management · scanned v0.167.4 (released 2026-10-26) · commit 5c13a7ad8de9 · last scan 2026-11-02

The scan method changed on 2026-11-02. npm development dependencies and npm-shrinkwrap.json are now scanned; matches on GitHub Actions referenced by a moving tag and on npm packages the repository defines itself are no longer counted; directories such as integration-tests and test-fixtures are excluded as fixtures. Most differences from the previous week below come from that change, not from the projects. Details.

Changes since last week

1032 added; 84 new advisories; 25 license changes.

Added (1032)

@aashutoshrathi/word-wrap@1.2.6, @adobe/css-tools@4.5.0, @alloc/quick-lru@5.2.0, @babel/code-frame@7.29.7, @babel/compat-data@7.28.4, @babel/core@7.28.4, @babel/generator@7.29.8, @babel/helper-compilation-targets@7.27.2, @babel/helper-globals@7.29.7, @babel/helper-module-transforms@7.28.3, @babel/helper-plugin-utils@7.25.9, @babel/helper-string-parser@7.29.7, @babel/helper-validator-identifier@7.29.7, @babel/helper-validator-option@7.27.1, @babel/helpers@7.28.4, @babel/parser@7.29.8, @babel/plugin-syntax-jsx@7.25.9, @babel/plugin-syntax-typescript@7.25.9, @babel/template@7.29.7, @babel/traverse@7.29.8, @babel/types@7.29.8, @emnapi/core@1.5.0, @emnapi/runtime@1.5.0, @emnapi/wasi-threads@1.1.0, @esbuild/aix-ppc64@0.25.11, @esbuild/aix-ppc64@0.25.12, @esbuild/aix-ppc64@0.27.3, @esbuild/aix-ppc64@0.27.7, @esbuild/aix-ppc64@0.28.2, @esbuild/android-arm@0.25.11, @esbuild/android-arm@0.25.12, @esbuild/android-arm@0.27.3, @esbuild/android-arm@0.27.7, @esbuild/android-arm@0.28.2, @esbuild/android-arm64@0.25.11, @esbuild/android-arm64@0.25.12, @esbuild/android-arm64@0.27.3, @esbuild/android-arm64@0.27.7, @esbuild/android-arm64@0.28.2, @esbuild/android-x64@0.25.11, @esbuild/android-x64@0.25.12, @esbuild/android-x64@0.27.3, @esbuild/android-x64@0.27.7, @esbuild/android-x64@0.28.2, @esbuild/darwin-arm64@0.25.11, @esbuild/darwin-arm64@0.25.12, @esbuild/darwin-arm64@0.27.3, @esbuild/darwin-arm64@0.27.7, @esbuild/darwin-arm64@0.28.2, @esbuild/darwin-x64@0.25.11, @esbuild/darwin-x64@0.25.12, @esbuild/darwin-x64@0.27.3, @esbuild/darwin-x64@0.27.7, @esbuild/darwin-x64@0.28.2, @esbuild/freebsd-arm64@0.25.11, @esbuild/freebsd-arm64@0.25.12, @esbuild/freebsd-arm64@0.27.3, @esbuild/freebsd-arm64@0.27.7, @esbuild/freebsd-arm64@0.28.2, @esbuild/freebsd-x64@0.25.11, @esbuild/freebsd-x64@0.25.12, @esbuild/freebsd-x64@0.27.3, @esbuild/freebsd-x64@0.27.7, @esbuild/freebsd-x64@0.28.2, @esbuild/linux-arm@0.25.11, @esbuild/linux-arm@0.25.12, @esbuild/linux-arm@0.27.3, @esbuild/linux-arm@0.27.7, @esbuild/linux-arm@0.28.2, @esbuild/linux-arm64@0.25.11, @esbuild/linux-arm64@0.25.12, @esbuild/linux-arm64@0.27.3, @esbuild/linux-arm64@0.27.7, @esbuild/linux-arm64@0.28.2, @esbuild/linux-ia32@0.25.11, @esbuild/linux-ia32@0.25.12, @esbuild/linux-ia32@0.27.3, @esbuild/linux-ia32@0.27.7, @esbuild/linux-ia32@0.28.2, @esbuild/linux-loong64@0.25.11, @esbuild/linux-loong64@0.25.12, @esbuild/linux-loong64@0.27.3, @esbuild/linux-loong64@0.27.7, @esbuild/linux-loong64@0.28.2, @esbuild/linux-mips64el@0.25.11, @esbuild/linux-mips64el@0.25.12, @esbuild/linux-mips64el@0.27.3, @esbuild/linux-mips64el@0.27.7, @esbuild/linux-mips64el@0.28.2, @esbuild/linux-ppc64@0.25.11, @esbuild/linux-ppc64@0.25.12, @esbuild/linux-ppc64@0.27.3, @esbuild/linux-ppc64@0.27.7, @esbuild/linux-ppc64@0.28.2, @esbuild/linux-riscv64@0.25.11, @esbuild/linux-riscv64@0.25.12, @esbuild/linux-riscv64@0.27.3, @esbuild/linux-riscv64@0.27.7, @esbuild/linux-riscv64@0.28.2, @esbuild/linux-s390x@0.25.11, @esbuild/linux-s390x@0.25.12, @esbuild/linux-s390x@0.27.3, @esbuild/linux-s390x@0.27.7, @esbuild/linux-s390x@0.28.2, @esbuild/linux-x64@0.25.11, @esbuild/linux-x64@0.25.12, @esbuild/linux-x64@0.27.3, @esbuild/linux-x64@0.27.7, @esbuild/linux-x64@0.28.2, @esbuild/netbsd-arm64@0.25.11, @esbuild/netbsd-arm64@0.25.12, @esbuild/netbsd-arm64@0.27.3, @esbuild/netbsd-arm64@0.27.7, @esbuild/netbsd-arm64@0.28.2, @esbuild/netbsd-x64@0.25.11, @esbuild/netbsd-x64@0.25.12, @esbuild/netbsd-x64@0.27.3, @esbuild/netbsd-x64@0.27.7, @esbuild/netbsd-x64@0.28.2, @esbuild/openbsd-arm64@0.25.11, @esbuild/openbsd-arm64@0.25.12, @esbuild/openbsd-arm64@0.27.3, @esbuild/openbsd-arm64@0.27.7, @esbuild/openbsd-arm64@0.28.2, @esbuild/openbsd-x64@0.25.11, @esbuild/openbsd-x64@0.25.12, @esbuild/openbsd-x64@0.27.3, @esbuild/openbsd-x64@0.27.7, @esbuild/openbsd-x64@0.28.2, @esbuild/openharmony-arm64@0.25.11, @esbuild/openharmony-arm64@0.25.12, @esbuild/openharmony-arm64@0.27.3, @esbuild/openharmony-arm64@0.27.7, @esbuild/openharmony-arm64@0.28.2, @esbuild/sunos-x64@0.25.11, @esbuild/sunos-x64@0.25.12, @esbuild/sunos-x64@0.27.3, @esbuild/sunos-x64@0.27.7, @esbuild/sunos-x64@0.28.2, @esbuild/win32-arm64@0.25.11, @esbuild/win32-arm64@0.25.12, @esbuild/win32-arm64@0.27.3, @esbuild/win32-arm64@0.27.7, @esbuild/win32-arm64@0.28.2, @esbuild/win32-ia32@0.25.11, @esbuild/win32-ia32@0.25.12, @esbuild/win32-ia32@0.27.3, @esbuild/win32-ia32@0.27.7, @esbuild/win32-ia32@0.28.2, @esbuild/win32-x64@0.25.11, @esbuild/win32-x64@0.25.12, @esbuild/win32-x64@0.27.3, @esbuild/win32-x64@0.27.7, @esbuild/win32-x64@0.28.2, @eslint-community/eslint-utils@4.10.1, @eslint-community/eslint-utils@4.4.0, @eslint-community/eslint-utils@4.4.1, @eslint-community/eslint-utils@4.9.1, @eslint-community/regexpp@4.12.1, @eslint-community/regexpp@4.12.2, @eslint/config-array@0.21.2, @eslint/config-helpers@0.4.2, @eslint/core@0.17.0, @eslint/eslintrc@2.1.4, @eslint/eslintrc@3.3.7, @eslint/js@8.57.1, @eslint/js@9.39.5, @eslint/object-schema@2.1.7, @eslint/plugin-kit@0.4.1, @humanfs/core@0.19.2, @humanfs/node@0.16.8, @humanfs/types@0.15.0, @humanwhocodes/config-array@0.13.0, @humanwhocodes/module-importer@1.0.1, @humanwhocodes/object-schema@2.0.3, @humanwhocodes/retry@0.4.3, @img/colour@1.1.0, @img/sharp-darwin-arm64@0.34.5, @img/sharp-darwin-x64@0.34.5, @img/sharp-libvips-darwin-arm64@1.2.4, @img/sharp-libvips-darwin-x64@1.2.4, @img/sharp-libvips-linux-arm@1.2.4, @img/sharp-libvips-linux-arm64@1.2.4, @img/sharp-libvips-linux-ppc64@1.2.4, @img/sharp-libvips-linux-riscv64@1.2.4, @img/sharp-libvips-linux-s390x@1.2.4, @img/sharp-libvips-linux-x64@1.2.4, @img/sharp-libvips-linuxmusl-arm64@1.2.4, @img/sharp-libvips-linuxmusl-x64@1.2.4, @img/sharp-linux-arm@0.34.5, @img/sharp-linux-arm64@0.34.5, @img/sharp-linux-ppc64@0.34.5, @img/sharp-linux-riscv64@0.34.5, @img/sharp-linux-s390x@0.34.5, @img/sharp-linux-x64@0.34.5, @img/sharp-linuxmusl-arm64@0.34.5, @img/sharp-linuxmusl-x64@0.34.5, @img/sharp-wasm32@0.34.5, @img/sharp-win32-arm64@0.34.5, @img/sharp-win32-ia32@0.34.5, @img/sharp-win32-x64@0.34.5, @joshwooding/vite-plugin-react-docgen-typescript@0.7.0, @jridgewell/remapping@2.3.5, @jridgewell/resolve-uri@3.1.1, @jridgewell/trace-mapping@0.3.25, @mdx-js/react@3.1.1, @mswjs/interceptors@0.39.8, @napi-rs/wasm-runtime@1.0.5, @next/env@16.1.7, @next/eslint-plugin-next@16.3.6, @next/swc-darwin-arm64@16.1.7, @next/swc-darwin-x64@16.1.7, @next/swc-linux-arm64-gnu@16.1.7, @next/swc-linux-arm64-musl@16.1.7, @next/swc-linux-x64-gnu@16.1.7, @next/swc-linux-x64-musl@16.1.7, @next/swc-win32-arm64-msvc@16.1.7, @next/swc-win32-x64-msvc@16.1.7, @nodelib/fs.scandir@2.1.5, @nodelib/fs.stat@2.0.5, @nodelib/fs.walk@1.2.8, @nolyfill/is-core-module@1.0.39, @open-draft/deferred-promise@2.2.0, @open-draft/logger@0.3.0, @open-draft/until@2.1.0, @oxc-project/types@0.148.0, @oxc-project/types@0.151.0, @pkgr/core@0.1.1, @quansync/fs@1.1.0, @react-email/preview-server@5.2.10, @rolldown/binding-android-arm-eabi@1.2.11, @rolldown/binding-android-arm-eabi@1.2.7, @rolldown/binding-android-arm64@1.2.11, @rolldown/binding-android-arm64@1.2.7, @rolldown/binding-darwin-arm64@1.2.11, @rolldown/binding-darwin-arm64@1.2.7, @rolldown/binding-darwin-x64@1.2.11, @rolldown/binding-darwin-x64@1.2.7, @rolldown/binding-freebsd-x64@1.2.11, @rolldown/binding-freebsd-x64@1.2.7, @rolldown/binding-linux-arm-gnueabihf@1.2.11, @rolldown/binding-linux-arm-gnueabihf@1.2.7, @rolldown/binding-linux-arm64-gnu@1.2.11, @rolldown/binding-linux-arm64-gnu@1.2.7, @rolldown/binding-linux-arm64-musl@1.2.11, @rolldown/binding-linux-arm64-musl@1.2.7, @rolldown/binding-linux-ppc64-gnu@1.2.11, @rolldown/binding-linux-ppc64-gnu@1.2.7, @rolldown/binding-linux-s390x-gnu@1.2.11, @rolldown/binding-linux-s390x-gnu@1.2.7, @rolldown/binding-linux-x64-gnu@1.2.11, @rolldown/binding-linux-x64-gnu@1.2.7, @rolldown/binding-linux-x64-musl@1.2.11, @rolldown/binding-linux-x64-musl@1.2.7, @rolldown/binding-openharmony-arm64@1.2.11, @rolldown/binding-openharmony-arm64@1.2.7, @rolldown/binding-win32-arm64-msvc@1.2.11, @rolldown/binding-win32-arm64-msvc@1.2.7, @rolldown/binding-win32-x64-msvc@1.2.11, @rolldown/binding-win32-x64-msvc@1.2.7, @rolldown/pluginutils@1.0.1, @rollup/plugin-inject@5.0.5, @rollup/pluginutils@5.1.3, @rollup/rollup-android-arm-eabi@4.60.1, @rollup/rollup-android-arm-eabi@4.60.2, @rollup/rollup-android-arm64@4.60.1, @rollup/rollup-android-arm64@4.60.2, @rollup/rollup-darwin-arm64@4.60.1, @rollup/rollup-darwin-arm64@4.60.2, @rollup/rollup-darwin-x64@4.60.1, @rollup/rollup-darwin-x64@4.60.2, @rollup/rollup-freebsd-arm64@4.60.1, @rollup/rollup-freebsd-arm64@4.60.2, @rollup/rollup-freebsd-x64@4.60.1, @rollup/rollup-freebsd-x64@4.60.2, @rollup/rollup-linux-arm-gnueabihf@4.60.1, @rollup/rollup-linux-arm-gnueabihf@4.60.2, @rollup/rollup-linux-arm-musleabihf@4.60.1, @rollup/rollup-linux-arm-musleabihf@4.60.2, @rollup/rollup-linux-arm64-gnu@4.60.1, @rollup/rollup-linux-arm64-gnu@4.60.2, @rollup/rollup-linux-arm64-musl@4.60.1, @rollup/rollup-linux-arm64-musl@4.60.2, @rollup/rollup-linux-loong64-gnu@4.60.1, @rollup/rollup-linux-loong64-gnu@4.60.2, @rollup/rollup-linux-loong64-musl@4.60.1, @rollup/rollup-linux-loong64-musl@4.60.2, @rollup/rollup-linux-ppc64-gnu@4.60.1, @rollup/rollup-linux-ppc64-gnu@4.60.2, @rollup/rollup-linux-ppc64-musl@4.60.1, @rollup/rollup-linux-ppc64-musl@4.60.2, @rollup/rollup-linux-riscv64-gnu@4.60.1, @rollup/rollup-linux-riscv64-gnu@4.60.2, @rollup/rollup-linux-riscv64-musl@4.60.1, @rollup/rollup-linux-riscv64-musl@4.60.2, @rollup/rollup-linux-s390x-gnu@4.60.1, @rollup/rollup-linux-s390x-gnu@4.60.2, @rollup/rollup-linux-x64-gnu@4.60.1, @rollup/rollup-linux-x64-gnu@4.60.2, @rollup/rollup-linux-x64-musl@4.60.1, @rollup/rollup-linux-x64-musl@4.60.2, @rollup/rollup-openbsd-x64@4.60.1, @rollup/rollup-openbsd-x64@4.60.2, @rollup/rollup-openharmony-arm64@4.60.1, @rollup/rollup-openharmony-arm64@4.60.2, @rollup/rollup-win32-arm64-msvc@4.60.1, @rollup/rollup-win32-arm64-msvc@4.60.2, @rollup/rollup-win32-ia32-msvc@4.60.1, @rollup/rollup-win32-ia32-msvc@4.60.2, @rollup/rollup-win32-x64-gnu@4.60.1, @rollup/rollup-win32-x64-gnu@4.60.2, @rollup/rollup-win32-x64-msvc@4.60.1, @rollup/rollup-win32-x64-msvc@4.60.2, @rtsao/scc@1.1.0, @socket.io/component-emitter@3.1.2, @storybook/addon-a11y@10.3.6, @storybook/addon-docs@10.3.6, @storybook/builder-vite@10.3.6, @storybook/csf-plugin@10.3.6, @storybook/global@5.0.0, @storybook/icons@2.1.0, @storybook/react@10.3.6, @storybook/react-dom-shim@10.3.6, @storybook/react-vite@10.3.6, @stylistic/eslint-plugin@2.13.0, @stylistic/eslint-plugin@5.10.0, @tailwindcss/node@4.1.14, @tailwindcss/oxide@4.1.14, @tailwindcss/oxide-android-arm64@4.1.14, @tailwindcss/oxide-darwin-arm64@4.1.14, @tailwindcss/oxide-darwin-x64@4.1.14, @tailwindcss/oxide-freebsd-x64@4.1.14, @tailwindcss/oxide-linux-arm-gnueabihf@4.1.14, @tailwindcss/oxide-linux-arm64-gnu@4.1.14, @tailwindcss/oxide-linux-arm64-musl@4.1.14, @tailwindcss/oxide-linux-x64-gnu@4.1.14, @tailwindcss/oxide-linux-x64-musl@4.1.14, @tailwindcss/oxide-wasm32-wasi@4.1.14, @tailwindcss/oxide-win32-arm64-msvc@4.1.14, @tailwindcss/oxide-win32-x64-msvc@4.1.14, @tailwindcss/postcss@4.1.14, @tanstack/eslint-plugin-router@1.120.17, @tanstack/router-generator@1.95.1, @tanstack/router-plugin@1.95.1, @testing-library/dom@10.4.1, @testing-library/jest-dom@6.9.1, @testing-library/user-event@14.6.7, @tybys/wasm-util@0.10.1, @types/aria-query@5.0.4, @types/babel__core@7.20.5, @types/babel__generator@7.6.8, @types/babel__template@7.4.4, @types/babel__traverse@7.28.0, @types/bcrypt@5.0.2, @types/chai@5.2.3, @types/cors@2.8.17, @types/deep-eql@4.0.2, @types/dns-packet@5.6.5, @types/doctrine@0.0.9, @types/estree@1.0.8, @types/file-saver@2.0.7, @types/json-schema@7.0.15, @types/json5@0.0.29, @types/jsrp@0.2.6, @types/libsodium-wrappers@0.7.13, @types/lodash@4.14.202, @types/lodash.isequal@4.5.8, @types/mdx@2.0.13, @types/netmask@2.0.6, @types/node@18.19.130, @types/oauth@0.9.4, @types/oracledb@6.10.0, @types/passport-google-oauth20@2.0.14, @types/passport-oauth2@1.4.15, @types/pg@8.10.9, @types/picomatch@2.3.3, @types/picomatch@3.0.1, @types/pkcs11js@1.0.4, @types/prompt-sync@4.2.3, @types/qrcode@1.5.5, @types/react@19.1.2, @types/react-helmet@6.1.11, @types/resolve@1.20.6, @types/safe-regex@1.1.6, @types/sjcl@1.0.34, @types/ssh2@1.15.5, @types/uuid@9.0.7, @typescript-eslint/eslint-plugin@8.70.1, @typescript-eslint/eslint-plugin@8.71.0, @typescript-eslint/parser@8.70.1, @typescript-eslint/parser@8.71.0, @typescript-eslint/project-service@8.70.1, @typescript-eslint/project-service@8.71.0, @typescript-eslint/scope-manager@8.70.1, @typescript-eslint/scope-manager@8.71.0, @typescript-eslint/tsconfig-utils@8.70.1, @typescript-eslint/tsconfig-utils@8.71.0, @typescript-eslint/type-utils@8.70.1, @typescript-eslint/type-utils@8.71.0, @typescript-eslint/types@8.70.1, @typescript-eslint/types@8.71.0, @typescript-eslint/typescript-estree@8.70.1, @typescript-eslint/typescript-estree@8.71.0, @typescript-eslint/utils@8.70.1, @typescript-eslint/utils@8.71.0, @typescript-eslint/visitor-keys@8.70.1, @typescript-eslint/visitor-keys@8.71.0, @ungap/structured-clone@1.2.0, @unrs/resolver-binding-android-arm-eabi@1.12.2, @unrs/resolver-binding-android-arm64@1.12.2, @unrs/resolver-binding-darwin-arm64@1.12.2, @unrs/resolver-binding-darwin-x64@1.12.2, @unrs/resolver-binding-freebsd-x64@1.12.2, @unrs/resolver-binding-linux-arm-gnueabihf@1.12.2, @unrs/resolver-binding-linux-arm-musleabihf@1.12.2, @unrs/resolver-binding-linux-arm64-gnu@1.12.2, @unrs/resolver-binding-linux-arm64-musl@1.12.2, @unrs/resolver-binding-linux-loong64-gnu@1.12.2, @unrs/resolver-binding-linux-loong64-musl@1.12.2, @unrs/resolver-binding-linux-ppc64-gnu@1.12.2, @unrs/resolver-binding-linux-riscv64-gnu@1.12.2, @unrs/resolver-binding-linux-riscv64-musl@1.12.2, @unrs/resolver-binding-linux-s390x-gnu@1.12.2, @unrs/resolver-binding-linux-x64-gnu@1.12.2, @unrs/resolver-binding-linux-x64-musl@1.12.2, @unrs/resolver-binding-openharmony-arm64@1.12.2, @unrs/resolver-binding-wasm32-wasi@1.12.2, @unrs/resolver-binding-win32-arm64-msvc@1.12.2, @unrs/resolver-binding-win32-ia32-msvc@1.12.2, @unrs/resolver-binding-win32-x64-msvc@1.12.2, @vitejs/plugin-react@6.1.1, @vitest/expect@3.2.4, @vitest/expect@3.2.7, @vitest/expect@4.1.11, @vitest/mocker@3.2.4, @vitest/mocker@3.2.7, @vitest/mocker@4.1.11, @vitest/pretty-format@3.2.4, @vitest/pretty-format@3.2.7, @vitest/pretty-format@4.1.11, @vitest/runner@3.2.4, @vitest/runner@3.2.7, @vitest/runner@4.1.11, @vitest/snapshot@3.2.4, @vitest/snapshot@3.2.7, @vitest/snapshot@4.1.11, @vitest/spy@3.2.4, @vitest/spy@3.2.7, @vitest/spy@4.1.11, @vitest/utils@3.2.4, @vitest/utils@3.2.7, @vitest/utils@4.1.11, @webcontainer/env@1.1.1, @yuku-codegen/binding-android-arm64@0.10.2, @yuku-codegen/binding-darwin-arm64@0.10.2, @yuku-codegen/binding-darwin-x64@0.10.2, @yuku-codegen/binding-freebsd-x64@0.10.2, @yuku-codegen/binding-linux-arm-gnu@0.10.2, @yuku-codegen/binding-linux-arm-musl@0.10.2, @yuku-codegen/binding-linux-arm64-gnu@0.10.2, @yuku-codegen/binding-linux-arm64-musl@0.10.2, @yuku-codegen/binding-linux-x64-gnu@0.10.2, @yuku-codegen/binding-linux-x64-musl@0.10.2, @yuku-codegen/binding-win32-arm64@0.10.2, @yuku-codegen/binding-win32-x64@0.10.2, @yuku-parser/binding-android-arm64@0.10.2, @yuku-parser/binding-darwin-arm64@0.10.2, @yuku-parser/binding-darwin-x64@0.10.2, @yuku-parser/binding-freebsd-x64@0.10.2, @yuku-parser/binding-linux-arm-gnu@0.10.2, @yuku-parser/binding-linux-arm-musl@0.10.2, @yuku-parser/binding-linux-arm64-gnu@0.10.2, @yuku-parser/binding-linux-arm64-musl@0.10.2, @yuku-parser/binding-linux-x64-gnu@0.10.2, @yuku-parser/binding-linux-x64-musl@0.10.2, @yuku-parser/binding-win32-arm64@0.10.2, @yuku-parser/binding-win32-x64@0.10.2, @yuku-toolchain/types@0.10.2, acorn@8.14.0, acorn@8.15.0, acorn@8.18.0, acorn-jsx@5.3.2, ajv@6.14.0, ansi-regex@4.1.1, ansi-styles@5.2.0, anymatch@3.1.3, aria-query@5.3.0, aria-query@5.3.2, array-buffer-byte-length@1.0.2, array-includes@3.2.0, array.prototype.findlast@1.2.5, array.prototype.findlastindex@1.2.6, array.prototype.flat@1.3.3, array.prototype.flatmap@1.3.3, array.prototype.tosorted@1.1.4, arraybuffer.prototype.slice@1.0.4, asn1.js@4.10.1, assert@2.1.0, assertion-error@2.0.1, ast-types@0.16.3, ast-types-flow@0.0.8, async-function@1.0.0, atomically@2.1.0, axe-core@4.10.2, axobject-query@4.1.0, babel-dead-code-elimination@1.0.8, balanced-match@4.0.4, base64id@2.0.0, baseline-browser-mapping@2.11.19, baseline-browser-mapping@2.8.19, binary-extensions@2.3.0, bn.js@5.2.3, brace-expansion@1.1.14, brace-expansion@1.1.21, brace-expansion@2.1.0, brace-expansion@5.0.12, brace-expansion@5.0.9, braces@3.0.3, brorand@1.1.0, browser-resolve@2.0.0, browserify-aes@1.2.0, browserify-cipher@1.0.1, browserify-des@1.0.2, browserify-rsa@4.1.1, browserify-sign@4.2.5, browserify-zlib@0.2.0, browserslist@4.26.3, buffer-xor@1.0.3, builtin-status-codes@3.0.0, cac@6.7.14, cac@7.0.0, call-bind@1.0.8, caniuse-lite@1.0.30001751, caniuse-lite@1.0.30001810, chai@5.3.3, chai@6.2.2, chalk@5.3.0, check-error@2.1.3, chokidar@3.6.0, chokidar@4.0.3, cipher-base@1.0.6, citty@0.1.6, cli-cursor@5.0.0, client-only@0.0.1, colorette@2.0.20, commander@13.1.0, comment-parser@1.4.9, concat-map@0.0.1, conf@15.0.2, confbox@0.2.2, confusing-browser-globals@1.0.11, consola@3.4.2, console-browserify@1.2.0, constants-browserify@1.0.0, convert-source-map@2.0.0, core-util-is@1.0.3, cors@2.8.5, create-ecdh@4.0.4, create-hmac@1.1.7, create-require@1.1.1, crypto-browserify@3.12.1, css.escape@1.5.1, csstype@3.1.3, damerau-levenshtein@1.0.8, data-view-buffer@1.0.2, data-view-byte-length@1.0.2, data-view-byte-offset@1.0.1, debounce@2.0.0, debounce-fn@6.0.0, debug@3.2.7, deep-eql@5.0.2, deep-is@0.1.4, default-browser@5.5.1, default-browser-id@5.0.1, define-properties@1.2.1, defu@6.1.7, diffie-hellman@5.0.3, doctrine@2.1.0, doctrine@3.0.0, dom-accessibility-api@0.5.16, dom-accessibility-api@0.6.3, domain-browser@4.22.0, dot-prop@10.1.0, dts-resolver@3.0.0, electron-to-chromium@1.5.237, elliptic@6.6.1, emoji-regex@10.3.0, empathic@2.0.1, empathic@2.1.0, engine.io@6.6.9, engine.io-parser@5.2.3, enhanced-resolve@5.18.3, env-paths@3.0.0, es-abstract@1.24.2, es-abstract-get@1.0.0, es-iterator-helpers@1.4.0, es-module-lexer@1.7.0, es-module-lexer@2.3.2, es-shim-unscopables@1.1.0, es-to-primitive@1.3.0, es-to-primitive@1.3.4, esbuild@0.25.11, esbuild@0.25.12, esbuild@0.27.3, esbuild@0.27.7, esbuild@0.28.2, eslint@8.57.1, eslint@9.39.5, eslint-compat-utils@0.5.1, eslint-config-airbnb-base@15.0.0, eslint-config-airbnb-extended@3.2.0, eslint-config-prettier@9.1.0, eslint-import-context@0.1.9, eslint-import-resolver-node@0.3.9, eslint-import-resolver-typescript@3.10.1, eslint-import-resolver-typescript@3.7.0, eslint-import-resolver-typescript@4.4.5, eslint-module-utils@2.14.0, eslint-plugin-es-x@7.8.0, eslint-plugin-import@2.32.0, eslint-plugin-import-x@4.17.1, eslint-plugin-jsx-a11y@6.10.2, eslint-plugin-n@18.3.0, eslint-plugin-prettier@5.1.3, eslint-plugin-prettier@5.2.1, eslint-plugin-react@7.37.5, eslint-plugin-react-hooks@7.1.1, eslint-plugin-react-refresh@0.4.16, eslint-plugin-simple-import-sort@10.0.0, eslint-plugin-simple-import-sort@12.1.1, eslint-plugin-storybook@10.3.6, eslint-scope@7.2.2, eslint-scope@8.4.0, eslint-visitor-keys@3.4.3, eslint-visitor-keys@4.2.1, eslint-visitor-keys@5.0.1, espree@10.3.0, espree@10.4.0, espree@9.6.1, esprima@4.0.1, esquery@1.5.0, esquery@1.6.0, esrecurse@4.3.0, estraverse@5.3.0, estree-walker@2.0.2, estree-walker@3.0.3, esutils@2.0.3, evp_bytestokey@1.0.3, expect-type@1.2.2, expect-type@1.3.0, expect-type@1.4.0, exsolve@1.0.7, fast-copy@3.0.1, fast-diff@1.3.0, fast-glob@3.3.1, fast-glob@3.3.2, fast-json-stable-stringify@2.1.0, fast-levenshtein@2.0.6, fastq@1.14.0, file-entry-cache@6.0.1, file-entry-cache@8.0.0, fill-range@7.1.1, find-up@5.0.0, flat-cache@3.0.4, flat-cache@3.2.0, flat-cache@4.0.1, flatted@3.4.2, flatted@3.4.4, for-each@0.3.3, fs.realpath@1.0.0, fsevents@2.3.3, function.prototype.name@1.2.0, functions-have-names@1.2.3, generator-function@2.0.1, gensync@1.0.0-beta.2, get-east-asian-width@1.4.0, get-symbol-description@1.1.0, get-tsconfig@4.13.0, get-tsconfig@4.14.0, get-tsconfig@4.14.3, get-tsconfig@5.0.0-beta.6, glob@11.1.0, glob@13.0.6, glob@7.2.3, glob-parent@5.1.2, glob-parent@6.0.2, globals@13.23.0, globals@13.24.0, globals@14.0.0, globals@15.13.0, globals@17.12.0, globalthis@1.0.4, globrex@0.1.2, graphemer@1.4.0, has-bigints@1.0.2, has-bigints@1.1.0, has-proto@1.2.0, hash-base@3.0.5, hash-base@3.1.2, hash.js@1.1.7, help-me@4.2.0, hermes-estree@0.25.1, hermes-parser@0.25.1, hmac-drbg@1.0.1, hookable@6.1.2, https-browserify@1.0.0, husky@8.0.3, ignore@5.3.0, ignore@5.3.2, ignore@7.0.10, ignore@7.0.5, import-without-cache@0.4.1, imurmurhash@0.1.4, inflight@1.0.6, internal-slot@1.1.0, is-arguments@1.2.0, is-array-buffer@3.0.5, is-async-function@2.1.1, is-bigint@1.1.0, is-binary-path@2.1.0, is-boolean-object@1.2.2, is-bun-module@1.3.0, is-bun-module@2.0.0, is-data-view@1.0.2, is-date-object@1.1.0, is-document.all@1.0.0, is-extglob@2.1.1, is-finalizationregistry@1.1.1, is-generator-function@1.0.10, is-generator-function@1.1.2, is-glob@4.0.3, is-interactive@2.0.0, is-map@2.0.3, is-nan@1.3.2, is-negative-zero@2.0.3, is-node-process@1.2.0, is-number@7.0.0, is-number-object@1.1.1, is-path-inside@3.0.3, is-regex@1.2.1, is-set@2.0.3, is-shared-array-buffer@1.0.4, is-string@1.1.1, is-symbol@1.1.1, is-unicode-supported@1.3.0, is-unicode-supported@2.1.0, is-weakmap@2.0.2, is-weakref@1.1.1, is-weakset@2.0.4, is-wsl@3.1.1, isarray@1.0.0, isomorphic-timers-promises@1.0.1, iterator.prototype@1.1.5, jackspeak@4.1.1, jiti@2.4.2, jiti@2.6.1, js-tokens@9.0.1, js-yaml@4.1.1, json-buffer@3.0.1, json-schema-traverse@0.4.1, json-stable-stringify-without-jsonify@1.0.1, json-stringify-safe@5.0.1, json5@1.0.2, json5@2.2.3, jsx-ast-utils@3.3.5, keyv@4.5.4, kleur@3.0.3, language-subtag-registry@0.3.23, language-tags@1.0.9, levn@0.4.1, lightningcss@1.30.1, lightningcss@1.33.0, lightningcss-android-arm64@1.33.0, lightningcss-darwin-arm64@1.30.1, lightningcss-darwin-arm64@1.33.0, lightningcss-darwin-x64@1.30.1, lightningcss-darwin-x64@1.33.0, lightningcss-freebsd-x64@1.30.1, lightningcss-freebsd-x64@1.33.0, lightningcss-linux-arm-gnueabihf@1.30.1, lightningcss-linux-arm-gnueabihf@1.33.0, lightningcss-linux-arm64-gnu@1.30.1, lightningcss-linux-arm64-gnu@1.33.0, lightningcss-linux-arm64-musl@1.30.1, lightningcss-linux-arm64-musl@1.33.0, lightningcss-linux-x64-gnu@1.30.1, lightningcss-linux-x64-gnu@1.33.0, lightningcss-linux-x64-musl@1.30.1, lightningcss-linux-x64-musl@1.33.0, lightningcss-win32-arm64-msvc@1.30.1, lightningcss-win32-arm64-msvc@1.33.0, lightningcss-win32-x64-msvc@1.30.1, lightningcss-win32-x64-msvc@1.33.0, locate-path@6.0.0, lodash.merge@4.6.2, log-symbols@6.0.0, log-symbols@7.0.1, loupe@3.2.1, lru-cache@11.2.2, lru-cache@11.5.2, lru-cache@5.1.1, lz-string@1.5.0, magic-string@0.30.21, map-or-similar@1.5.0, memoizerific@1.11.3, merge2@1.4.1, micromatch@4.0.8, miller-rabin@4.0.1, mimic-function@5.0.1, min-indent@1.0.1, minimalistic-crypto-utils@1.0.1, minimatch@10.2.5, minimatch@10.2.6, minimatch@3.1.5, nanoid@3.3.11, napi-postinstall@0.3.4, natural-compare@1.4.0, next@16.1.7, nock@14.0.10, node-releases@2.0.26, node-stdlib-browser@1.3.1, normalize-path@3.0.0, nypm@0.6.0, object-is@1.1.6, object-keys@1.1.1, object.assign@4.1.7, object.entries@1.1.7, object.entries@1.1.9, object.fromentries@2.0.8, object.groupby@1.0.3, object.values@1.2.1, obuf@1.1.2, obug@2.2.1, obug@3.0.0, onetime@7.0.0, open@10.2.0, optionator@0.9.3, optionator@0.9.4, ora@8.2.0, os-browserify@0.3.0, outvariant@1.4.3, own-keys@1.0.2, p-locate@5.0.0, pako@1.0.11, parse-asn1@5.1.9, path-browserify@1.0.1, path-is-absolute@1.0.1, path-scurry@2.0.0, path-scurry@2.0.2, pathe@2.0.3, pathval@2.0.1, pbkdf2@3.1.5, pg-numeric@1.0.2, pg-types@4.0.1, picomatch@2.3.2, pino-pretty@10.2.3, pkg-dir@5.0.0, pkg-types@2.3.0, possible-typed-array-names@1.0.0, postcss@8.4.31, postcss@8.5.12, postcss@8.5.26, postcss@8.5.28, postcss@8.5.6, postgres-array@3.0.2, postgres-bytea@3.0.0, postgres-date@2.0.1, postgres-interval@3.0.0, postgres-range@1.1.3, prelude-ls@1.2.1, prettier@3.4.2, prettier-linter-helpers@1.0.0, prettier-plugin-tailwindcss@0.6.14, pretty-format@27.5.1, process-nextick-args@2.0.1, prompt-sync@4.2.0, prompts@2.4.2, propagate@2.0.1, public-encrypt@4.0.3, punycode@1.4.1, qs@6.15.0, quansync@1.0.0, querystring-es3@0.2.1, queue-microtask@1.2.3, randomfill@1.0.4, react-docgen@8.0.2, react-docgen-typescript@2.4.0, react-email@5.0.6, react-is@17.0.2, readable-stream@2.3.8, readdirp@3.6.0, readdirp@4.1.2, recast@0.23.21, redent@3.0.0, reflect.getprototypeof@1.0.10, regexp.prototype.flags@1.5.4, resolve@2.0.0-next.5, resolve-pkg-maps@1.0.0, restore-cursor@5.1.0, ripemd160@2.0.3, rolldown@1.2.11, rolldown@1.2.7, rolldown-plugin-dts@0.28.6, rollup@4.60.1, rollup@4.60.2, run-applescript@7.1.0, run-parallel@1.2.0, safe-array-concat@1.1.3, safe-array-concat@1.1.4, safe-buffer@5.1.2, safe-push-apply@1.0.0, safe-regex-test@1.1.0, secure-json-parse@2.7.0, set-function-name@2.0.2, set-proto@1.0.0, setimmediate@1.0.5, sharp@0.34.5, siginfo@2.0.0, sisteransi@1.0.5, socket.io@4.8.1, socket.io-adapter@2.5.5, socket.io-parser@4.2.7, source-map-js@1.2.1, stable-hash@0.0.4, stable-hash@0.0.5, stable-hash-x@0.2.0, stackback@0.0.2, std-env@3.10.0, std-env@4.2.0, stdin-discarder@0.2.2, stop-iteration-iterator@1.1.0, storybook@10.3.6, storybook-addon-tag-badges@3.1.0, stream-browserify@3.0.0, stream-http@3.2.0, strict-event-emitter@0.5.1, string-width@7.2.0, string.prototype.includes@2.0.1, string.prototype.matchall@4.1.0, string.prototype.repeat@1.0.0, string.prototype.trim@1.2.10, string.prototype.trim@1.2.11, string.prototype.trimend@1.0.10, string.prototype.trimend@1.0.9, string.prototype.trimstart@1.0.8, string_decoder@1.1.1, strip-ansi@5.2.0, strip-indent@3.0.0, strip-indent@4.1.1, strip-literal@3.1.0, stubborn-fs@2.0.0, stubborn-utils@1.0.2, styled-jsx@5.1.6, synckit@0.8.8, synckit@0.9.2, tagged-tag@1.0.0, tailwindcss@4.1.14, tapable@2.2.1, tar@7.5.13, text-table@0.2.0, timers-browserify@2.0.12, tinybench@2.9.0, tinyexec@0.3.2, tinyexec@1.3.1, tinyglobby@0.2.16, tinyglobby@0.2.17, tinypool@1.1.1, tinyrainbow@2.0.0, tinyrainbow@3.1.1, tinyspy@4.0.4, tinyspy@4.0.6, to-regex-range@5.0.1, tree-kill@1.2.2, ts-api-utils@2.5.0, ts-dedent@2.2.0, tsconfck@3.1.6, tsconfig-paths@3.15.0, tsconfig-paths@4.2.0, tsdown@0.23.0, tsx@4.19.3, tsx@4.21.0, tsx@4.23.15, tty-browserify@0.0.1, tw-animate-css@1.4.0, type-check@0.4.0, type-fest@0.20.2, type-fest@5.3.1, typed-array-byte-length@1.0.3, typed-array-byte-offset@1.0.5, typed-array-length@1.0.7, typed-array-length@1.0.8, typescript@5.6.3, typescript-eslint@8.70.1, unbox-primitive@1.1.0, unconfig-core@7.5.0, unplugin@1.16.0, unplugin@2.3.11, unrs-resolver@1.12.2, update-browserslist-db@1.1.3, uri-js@4.4.1, url@0.11.4, util@0.12.5, verkit@0.4.1, vite@7.3.2, vite@7.3.6, vite@8.2.2, vite-node@3.2.4, vite-plugin-node-polyfills@0.28.0, vite-plugin-wasm@3.6.0, vite-tsconfig-paths@5.1.4, vitest@3.2.4, vitest@3.2.7, vitest@4.1.11, vm-browserify@1.1.2, webpack-virtual-modules@0.6.2, when-exit@2.1.5, which-boxed-primitive@1.1.1, which-builtin-type@1.2.1, which-collection@1.0.2, which-typed-array@1.1.16, which-typed-array@1.1.24, why-is-node-running@2.3.0, word-wrap@1.2.5, ws@8.21.3, wsl-utils@0.1.0, yallist@3.1.1, yoctocolors@2.1.2, yuku-ast@0.10.2, yuku-codegen@0.10.2, yuku-parser@0.10.2, zod@4.6.5, zod-validation-error@4.0.2

New advisories (84)

• C GHSA-23hp-3jrh-7fpw in tar@7.5.13
• C GHSA-2464-fhr4-w9xw in next@16.1.7
• H GHSA-267c-6grr-h53f in next@16.1.7
• H GHSA-26hh-7cqf-hhc6 in next@16.1.7
• H GHSA-2883-xcg3-v3hh in js-yaml@4.1.1
• H GHSA-2gc4-cqfq-p2gv in engine.io@6.6.9
• H GHSA-2v37-7h3g-55p8 in nanoid@3.3.11
• C GHSA-2xp9-vwfh-vxw4 in next@16.1.7
• H GHSA-36qx-fr4f-26g5 in next@16.1.7
• L GHSA-39w2-rjm5-chcv in next@16.1.7
• L GHSA-3g8h-86w9-wvmq in next@16.1.7
• H GHSA-3jxr-9vmj-r5cp in brace-expansion@2.1.0
• M GHSA-4633-3j49-mh5q in next@16.1.7
• M GHSA-477h-4r7f-fvrx in pbkdf2@3.1.5
• H GHSA-492v-c6pp-mqqv in next@16.1.7
• M GHSA-4c39-4ccg-62r3 in next@16.1.7
• M GHSA-4jqv-mc3x-m676 in next@16.1.7
• L GHSA-4x5r-pxfx-6jf8 in @babel/core@7.28.4
• H GHSA-52cp-r559-cp3m in js-yaml@4.1.1
• H GHSA-587h-7wmj-h5pm in vite@8.2.2
• C GHSA-5gmw-xhrv-c9v3 in tinypool@1.1.1
• H GHSA-5p4m-2wfm-xmqj in js-yaml@4.1.1
• C GHSA-5xrq-8626-4rwp in vitest@3.2.4
• C GHSA-673q-mjm6-r5xr in next@16.1.7
• H GHSA-68fv-2mgg-jv7q in source-map-js@1.2.1
• M GHSA-68g3-v927-f742 in next@16.1.7
• M GHSA-698v-4r3x-3vcv in vite@8.2.2
• H GHSA-6g55-p6wh-862q in postcss@8.5.6
• H GHSA-6gpp-xcg3-4w24 in next@16.1.7
• H GHSA-6j4f-fj2g-mc7p in brace-expansion@5.0.9
• H GHSA-73wf-gq98-2v4g in browserslist@4.26.3
• M GHSA-82fw-gwwq-j7x9 in @vitest/mocker@3.2.7
• M GHSA-82fw-gwwq-j7x9 in vitest@3.2.7
• L GHSA-848j-6mx2-7j84 in elliptic@6.6.1
• C GHSA-85c8-ppgw-ccpr in tinypool@1.1.1
• H GHSA-89xv-2m56-2m9x in next@16.1.7
• H GHSA-8h8q-6873-q5fj in next@16.1.7
• H GHSA-8x88-c5mf-7j5w in tar@7.5.13
• M GHSA-955p-x3mx-jcvp in next@16.1.7
• L GHSA-9jrq-w75r-8gcw in vite@8.2.2
• H GHSA-c4j6-fc7j-m34r in next@16.1.7
• H GHSA-c83g-rgw3-j3cx in browserslist@4.26.3
• H GHSA-cjq9-62q9-8jv4 in next@16.1.7
• C GHSA-f2ph-cmg5-wxc8 in storybook@10.3.6
• M GHSA-f87g-xv8r-7p7x in next@16.1.7
• H GHSA-f88m-g3jw-g9cj in sharp@0.34.5
• M GHSA-ffhc-5mcf-pf4q in next@16.1.7
• M GHSA-fx2h-pf6j-xcff in vite@7.3.2
• M GHSA-fxqj-rqcc-2cmp in postcss@8.5.6
• L GHSA-g7r4-m6w7-qqqr in esbuild@0.27.7
• M GHSA-gvwx-54wh-qm9j in tar@7.5.13
• M GHSA-gx5p-jg67-6x7h in next@16.1.7
• M GHSA-h64f-5h5j-jqjh in next@16.1.7
• M GHSA-h67p-54hq-rp68 in js-yaml@4.1.1
• M GHSA-jggr-w7fw-pc2j in fast-copy@3.0.1
• H GHSA-m99w-x7hq-7vfj in next@16.1.7
• M GHSA-mcj8-r9mp-w47p in next@16.1.7
• H GHSA-mg66-mrh9-m8jx in next@16.1.7
• H GHSA-mh99-v99m-4gvg in brace-expansion@2.1.0
• C GHSA-p293-qw3h-jr36 in next@16.1.7
• H GHSA-p3m5-59mp-jv5r in next@16.1.7
• H GHSA-p9j2-gv94-2wf4 in next@16.1.7
• H GHSA-px85-f4q5-jh77 in storybook@10.3.6
• M GHSA-q2hr-2g5m-vwhr in brace-expansion@5.0.9
• H GHSA-q4gf-8mx6-v5v3 in next@16.1.7
• M GHSA-q8wf-6r8g-63ch in next@16.1.7
• H GHSA-qhr7-859c-m2p7 in brace-expansion@5.0.9
• M GHSA-qx2v-qp2m-jg93 in postcss@8.5.6
• M GHSA-qxg6-89mg-rqv8 in @vitest/mocker@4.1.11
• H GHSA-r28c-9q8g-f849 in postcss@8.5.6
• H GHSA-r292-9mhp-454m in tar@7.5.13
• M GHSA-r825-w8mm-5pxw in vite@8.2.2
• H GHSA-rgj7-g3m4-5g8c in sharp@0.34.5
• H GHSA-rgw5-rvv9-x895 in brace-expansion@2.1.0
• M GHSA-rq7h-c2jc-7f22 in vite@8.2.2
• M GHSA-v6wh-96g9-6wx3 in vite@7.3.2
• M GHSA-vfpm-58rq-9qcg in vite@8.2.2
• L GHSA-vfv6-92ff-j949 in next@16.1.7
• M GHSA-vmf3-w455-68vh in tar@7.5.13
• M GHSA-w5vr-8v7q-w6rv in baseline-browser-mapping@2.8.19
• M GHSA-w8wr-v893-vjvp in tar@7.5.13
• M GHSA-wfc6-r584-vfw7 in next@16.1.7
• H GHSA-wq5f-xc86-pv6w in sharp@0.34.5
• M GHSA-xp26-3454-mjgp in @vitest/mocker@4.1.11

License changes

• argparse: none → Python-2.0
• base64-js: none → MIT
• create-hash: none → MIT
• emoji-regex: none → MIT
• events: none → MIT
• graceful-fs: none → ISC
• ieee754: none → BSD-3-Clause
• indent-string: none → MIT
• is-callable: none → MIT
• isarray: none → MIT
• md5.js: none → MIT
• minimist: none → MIT
• process: none → MIT
• punycode: none → MIT
• randombytes: none → MIT
• reusify: none → MIT
• semver: none → ISC
• signal-exit: none → ISC
• source-map: none → BSD-3-Clause
• string_decoder: none → MIT
• strip-bom: none → MIT
• strip-json-comments: none → MIT
• util-deprecate: none → MIT
• xtend: none → MIT
• yocto-queue: none → MIT

Known vulnerabilities (396)

Vulnerabilities are known advisories that Grype matches against the dependencies declared in each project's release source (manifests and lockfiles, including development and build dependencies). A match does not mean the tool is exploitable: the vulnerable code may be unused, test-only, or not shipped in the released binary. OSV: also reported by OSV-Scanner. Released binary: for Go tools, whether govulncheck found the vulnerable code in the shipped Linux binary. KEV: listed in the CISA Known Exploited Vulnerabilities catalog. EPSS: FIRST's estimated probability of exploitation in the next 30 days. Both describe the vulnerability in general, not its exploitability through this tool; a match in a workflow file refers to a GitHub Action, not to shipped code. Select an advisory for every catalog tool it matches. If a match is wrong or does not apply, use Dispute; accepted disputes are annotated here and listed on the corrections page, and the match stays visible.