KubeStellar Console

View security signals across multiple Kubernetes clusters

kubestellar/console · Kubernetes Security · scanned v0.3.42 (released 2026-09-20) · commit 2a082d0896bc · last scan 2026-11-02

The scan method changed on 2026-11-02. npm development dependencies and npm-shrinkwrap.json are now scanned; matches on GitHub Actions referenced by a moving tag and on npm packages the repository defines itself are no longer counted; directories such as integration-tests and test-fixtures are excluded as fixtures. Most differences from the previous week below come from that change, not from the projects. Details.

Changes since last week

486 added; 28 new advisories.

Added (486)

@adobe/css-tools@4.5.0, @alloc/quick-lru@5.2.0, @axe-core/playwright@4.13.0, @babel/code-frame@7.29.7, @babel/compat-data@7.29.7, @babel/core@7.29.7, @babel/generator@7.29.7, @babel/helper-compilation-targets@7.29.7, @babel/helper-globals@7.29.7, @babel/helper-module-imports@7.29.7, @babel/helper-module-transforms@7.29.7, @babel/helper-string-parser@7.29.7, @babel/helper-validator-identifier@7.29.7, @babel/helper-validator-option@7.29.7, @babel/helpers@7.29.7, @babel/parser@7.29.7, @babel/template@7.29.7, @babel/traverse@7.29.7, @babel/types@7.29.7, @bcoe/v8-coverage@1.0.2, @cacheable/memory@2.2.0, @cacheable/utils@2.5.0, @emnapi/core@1.11.0, @emnapi/core@1.11.1, @emnapi/core@1.9.2, @emnapi/runtime@1.11.0, @emnapi/runtime@1.11.1, @emnapi/runtime@1.9.2, @emnapi/wasi-threads@1.2.1, @emnapi/wasi-threads@1.2.2, @esbuild/aix-ppc64@0.28.1, @esbuild/android-arm@0.28.1, @esbuild/android-arm64@0.28.1, @esbuild/android-x64@0.28.1, @esbuild/darwin-arm64@0.28.1, @esbuild/darwin-x64@0.28.1, @esbuild/freebsd-arm64@0.28.1, @esbuild/freebsd-x64@0.28.1, @esbuild/linux-arm@0.28.1, @esbuild/linux-arm64@0.28.1, @esbuild/linux-ia32@0.28.1, @esbuild/linux-loong64@0.28.1, @esbuild/linux-mips64el@0.28.1, @esbuild/linux-ppc64@0.28.1, @esbuild/linux-riscv64@0.28.1, @esbuild/linux-s390x@0.28.1, @esbuild/linux-x64@0.28.1, @esbuild/netbsd-arm64@0.28.1, @esbuild/netbsd-x64@0.28.1, @esbuild/openbsd-arm64@0.28.1, @esbuild/openbsd-x64@0.28.1, @esbuild/openharmony-arm64@0.28.1, @esbuild/sunos-x64@0.28.1, @esbuild/win32-arm64@0.28.1, @esbuild/win32-ia32@0.28.1, @esbuild/win32-x64@0.28.1, @eslint-community/eslint-utils@4.9.1, @eslint-community/regexpp@4.12.2, @eslint/config-array@0.23.5, @eslint/config-helpers@0.7.0, @eslint/core@1.2.1, @eslint/js@10.0.1, @eslint/object-schema@3.0.5, @eslint/plugin-kit@0.7.3, @hapi/address@5.1.1, @hapi/formula@3.0.2, @hapi/hoek@11.0.7, @hapi/pinpoint@2.0.1, @hapi/tlds@1.1.7, @hapi/topo@6.0.2, @humanfs/core@0.19.2, @humanfs/node@0.16.8, @humanfs/types@0.15.0, @humanwhocodes/module-importer@1.0.1, @humanwhocodes/retry@0.4.3, @inquirer/ansi@2.0.7, @inquirer/confirm@6.1.1, @inquirer/core@11.2.1, @inquirer/figures@2.0.7, @inquirer/type@4.0.7, @istanbuljs/load-nyc-config@1.1.0, @istanbuljs/schema@0.1.6, @joshwooding/vite-plugin-react-docgen-typescript@0.7.0, @jridgewell/remapping@2.3.5, @keyv/bigmap@1.3.1, @keyv/serialize@1.1.1, @mswjs/interceptors@0.41.9, @napi-rs/wasm-runtime@1.1.4, @napi-rs/wasm-runtime@1.1.6, @netlify/functions@6.0.0, @netlify/types@3.0.0, @open-draft/deferred-promise@2.2.0, @open-draft/deferred-promise@3.0.0, @open-draft/logger@0.3.0, @open-draft/until@2.1.0, @oxc-parser/binding-android-arm-eabi@0.127.0, @oxc-parser/binding-android-arm64@0.127.0, @oxc-parser/binding-darwin-arm64@0.127.0, @oxc-parser/binding-darwin-x64@0.127.0, @oxc-parser/binding-freebsd-x64@0.127.0, @oxc-parser/binding-linux-arm-gnueabihf@0.127.0, @oxc-parser/binding-linux-arm-musleabihf@0.127.0, @oxc-parser/binding-linux-arm64-gnu@0.127.0, @oxc-parser/binding-linux-arm64-musl@0.127.0, @oxc-parser/binding-linux-ppc64-gnu@0.127.0, @oxc-parser/binding-linux-riscv64-gnu@0.127.0, @oxc-parser/binding-linux-riscv64-musl@0.127.0, @oxc-parser/binding-linux-s390x-gnu@0.127.0, @oxc-parser/binding-linux-x64-gnu@0.127.0, @oxc-parser/binding-linux-x64-musl@0.127.0, @oxc-parser/binding-openharmony-arm64@0.127.0, @oxc-parser/binding-wasm32-wasi@0.127.0, @oxc-parser/binding-win32-arm64-msvc@0.127.0, @oxc-parser/binding-win32-ia32-msvc@0.127.0, @oxc-parser/binding-win32-x64-msvc@0.127.0, @oxc-project/types@0.127.0, @oxc-project/types@0.148.0, @oxc-resolver/binding-android-arm-eabi@11.21.2, @oxc-resolver/binding-android-arm64@11.21.2, @oxc-resolver/binding-darwin-arm64@11.21.2, @oxc-resolver/binding-darwin-x64@11.21.2, @oxc-resolver/binding-freebsd-x64@11.21.2, @oxc-resolver/binding-linux-arm-gnueabihf@11.21.2, @oxc-resolver/binding-linux-arm-musleabihf@11.21.2, @oxc-resolver/binding-linux-arm64-gnu@11.21.2, @oxc-resolver/binding-linux-arm64-musl@11.21.2, @oxc-resolver/binding-linux-ppc64-gnu@11.21.2, @oxc-resolver/binding-linux-riscv64-gnu@11.21.2, @oxc-resolver/binding-linux-riscv64-musl@11.21.2, @oxc-resolver/binding-linux-s390x-gnu@11.21.2, @oxc-resolver/binding-linux-x64-gnu@11.21.2, @oxc-resolver/binding-linux-x64-musl@11.21.2, @oxc-resolver/binding-openharmony-arm64@11.21.2, @oxc-resolver/binding-wasm32-wasi@11.21.2, @oxc-resolver/binding-win32-arm64-msvc@11.21.2, @oxc-resolver/binding-win32-x64-msvc@11.21.2, @playwright/test@1.61.1, @polka/url@1.0.0-next.29, @rolldown/binding-android-arm-eabi@1.2.7, @rolldown/binding-android-arm64@1.2.7, @rolldown/binding-darwin-arm64@1.2.7, @rolldown/binding-darwin-x64@1.2.7, @rolldown/binding-freebsd-x64@1.2.7, @rolldown/binding-linux-arm-gnueabihf@1.2.7, @rolldown/binding-linux-arm64-gnu@1.2.7, @rolldown/binding-linux-arm64-musl@1.2.7, @rolldown/binding-linux-ppc64-gnu@1.2.7, @rolldown/binding-linux-s390x-gnu@1.2.7, @rolldown/binding-linux-x64-gnu@1.2.7, @rolldown/binding-linux-x64-musl@1.2.7, @rolldown/binding-openharmony-arm64@1.2.7, @rolldown/binding-win32-arm64-msvc@1.2.7, @rolldown/binding-win32-x64-msvc@1.2.7, @rolldown/pluginutils@1.0.1, @rollup/pluginutils@5.4.0, @standard-schema/spec@1.1.0, @storybook/addon-a11y@10.6.0, @storybook/builder-vite@10.6.0, @storybook/global@5.0.0, @storybook/icons@2.0.2, @storybook/react@10.6.0, @storybook/react-dom-shim@10.6.0, @storybook/react-vite@10.6.0, @tailwindcss/node@4.3.3, @tailwindcss/oxide@4.3.3, @tailwindcss/oxide-android-arm64@4.3.3, @tailwindcss/oxide-darwin-arm64@4.3.3, @tailwindcss/oxide-darwin-x64@4.3.3, @tailwindcss/oxide-freebsd-x64@4.3.3, @tailwindcss/oxide-linux-arm-gnueabihf@4.3.3, @tailwindcss/oxide-linux-arm64-gnu@4.3.3, @tailwindcss/oxide-linux-arm64-musl@4.3.3, @tailwindcss/oxide-linux-x64-gnu@4.3.3, @tailwindcss/oxide-linux-x64-musl@4.3.3, @tailwindcss/oxide-wasm32-wasi@4.3.3, @tailwindcss/oxide-win32-arm64-msvc@4.3.3, @tailwindcss/oxide-win32-x64-msvc@4.3.3, @tailwindcss/postcss@4.3.3, @testing-library/dom@10.4.2, @testing-library/jest-dom@6.9.1, @testing-library/jest-dom@7.0.1, @testing-library/react@16.3.3, @testing-library/user-event@14.6.7, @tybys/wasm-util@0.10.2, @tybys/wasm-util@0.10.3, @types/aria-query@5.0.4, @types/babel__core@7.20.5, @types/babel__generator@7.27.0, @types/babel__template@7.4.4, @types/babel__traverse@7.28.0, @types/chai@5.2.3, @types/deep-eql@4.0.2, @types/doctrine@0.0.9, @types/dompurify@3.2.0, @types/esrecurse@4.3.1, @types/js-yaml@4.0.9, @types/json-schema@7.0.15, @types/node@26.5.1, @types/react@19.3.0, @types/react-dom@19.3.0, @types/resolve@1.20.6, @types/set-cookie-parser@2.4.10, @types/statuses@2.0.6, @typescript-eslint/eslint-plugin@8.70.0, @typescript-eslint/parser@8.70.0, @typescript-eslint/project-service@8.70.0, @typescript-eslint/scope-manager@8.70.0, @typescript-eslint/tsconfig-utils@8.70.0, @typescript-eslint/type-utils@8.70.0, @typescript-eslint/types@8.70.0, @typescript-eslint/typescript-estree@8.70.0, @typescript-eslint/utils@8.70.0, @typescript-eslint/visitor-keys@8.70.0, @vitejs/plugin-react@6.1.1, @vitest/coverage-v8@5.0.1, @vitest/expect@3.2.4, @vitest/istanbul-lib-coverage@1.0.1, @vitest/istanbul-lib-report@1.0.1, @vitest/mocker@5.0.1, @vitest/pretty-format@3.2.4, @vitest/pretty-format@5.0.0, @vitest/spy@3.2.4, @vitest/spy@5.0.1, @vitest/ui@5.0.0, @vitest/utils@3.2.4, @vitest/utils@5.0.0, @webcontainer/env@1.1.1, acorn@8.17.0, acorn-jsx@5.3.2, agent-base@6.0.2, ajv@6.15.0, ansi-styles@5.2.0, aria-query@5.3.0, assertion-error@2.0.1, ast-types@0.16.1, ast-v8-to-istanbul@1.0.6, asynckit@0.4.0, axe-core@4.13.0, axios@1.18.1, balanced-match@4.0.4, baseline-browser-mapping@2.11.20, brace-expansion@5.0.9, browserslist@4.28.8, bundle-name@4.1.0, cacheable@2.5.0, camelcase@5.3.1, caniuse-lite@1.0.30001810, chai@5.3.3, chai@6.2.2, check-error@2.1.3, cli-width@4.1.0, cliui@8.0.1, combined-stream@1.0.8, convert-source-map@2.0.0, cookie@1.1.1, css.escape@1.5.1, csstype@3.2.3, deep-eql@5.0.2, deep-is@0.1.4, default-browser@5.5.0, default-browser-id@5.0.1, define-lazy-prop@3.0.0, delayed-stream@1.0.0, detect-libc@2.1.2, doctrine@3.0.0, dom-accessibility-api@0.5.16, dom-accessibility-api@0.6.3, electron-to-chromium@1.5.418, empathic@2.0.1, enhanced-resolve@5.24.3, es-set-tostringtag@2.1.0, esbuild@0.28.1, escalade@3.2.0, escape-string-regexp@4.0.0, eslint@10.10.0, eslint-plugin-react-hooks@7.1.1, eslint-plugin-react-refresh@0.5.7, eslint-scope@9.1.2, eslint-visitor-keys@3.4.3, eslint-visitor-keys@5.0.1, espree@11.2.0, esprima@4.0.1, esquery@1.7.0, esrecurse@4.3.0, estraverse@5.3.0, estree-walker@2.0.2, estree-walker@3.0.3, esutils@2.0.3, expect-type@1.4.0, fast-json-stable-stringify@2.1.0, fast-levenshtein@2.0.6, fast-string-truncated-width@3.0.3, fast-string-width@3.0.2, fast-wrap-ansi@0.2.2, file-entry-cache@11.1.5, find-up@4.1.0, find-up@5.0.0, flat-cache@6.1.23, flatted@3.4.4, follow-redirects@1.16.0, form-data@4.0.6, fsevents@2.3.2, fsevents@2.3.3, gensync@1.0.0-beta.2, get-caller-file@2.0.5, get-package-type@0.1.0, glob@13.0.6, glob-parent@6.0.2, globals@17.12.0, graceful-fs@4.2.11, graphql@16.14.2, has-flag@4.0.0, has-tostringtag@1.0.2, hashery@1.5.1, headers-polyfill@5.0.1, hermes-estree@0.25.1, hermes-parser@0.25.1, hookified@1.15.1, hookified@2.2.0, html-escaper@2.0.2, https-proxy-agent@5.0.1, ignore@5.3.2, ignore@7.0.9, indent-string@4.0.0, is-core-module@2.16.2, is-docker@3.0.0, is-extglob@2.1.1, is-glob@4.0.3, is-inside-container@1.0.0, is-node-process@1.2.0, is-wsl@3.1.1, istanbul-lib-coverage@3.2.2, istanbul-lib-instrument@6.0.3, istanbul-lib-report@3.0.1, istanbul-reports@3.2.0, jiti@2.7.0, joi@18.2.8, js-tokens@10.0.0, js-tokens@4.0.0, jsesc@3.1.0, json-schema-traverse@0.4.1, json-stable-stringify-without-jsonify@1.0.1, json5@2.2.3, jsonc-parser@3.3.1, keyv@5.6.0, levn@0.4.1, lightningcss@1.32.0, lightningcss@1.33.0, lightningcss-android-arm64@1.32.0, lightningcss-android-arm64@1.33.0, lightningcss-darwin-arm64@1.32.0, lightningcss-darwin-arm64@1.33.0, lightningcss-darwin-x64@1.32.0, lightningcss-darwin-x64@1.33.0, lightningcss-freebsd-x64@1.32.0, lightningcss-freebsd-x64@1.33.0, lightningcss-linux-arm-gnueabihf@1.32.0, lightningcss-linux-arm-gnueabihf@1.33.0, lightningcss-linux-arm64-gnu@1.32.0, lightningcss-linux-arm64-gnu@1.33.0, lightningcss-linux-arm64-musl@1.32.0, lightningcss-linux-arm64-musl@1.33.0, lightningcss-linux-x64-gnu@1.32.0, lightningcss-linux-x64-gnu@1.33.0, lightningcss-linux-x64-musl@1.32.0, lightningcss-linux-x64-musl@1.33.0, lightningcss-win32-arm64-msvc@1.32.0, lightningcss-win32-arm64-msvc@1.33.0, lightningcss-win32-x64-msvc@1.32.0, lightningcss-win32-x64-msvc@1.33.0, locate-path@5.0.0, locate-path@6.0.0, lodash@4.18.1, loupe@3.2.1, lru-cache@11.5.1, lru-cache@5.1.1, lz-string@1.5.0, magic-string@0.30.21, magic-string@1.3.1, magic-string@1.4.1, magicast@0.5.5, make-dir@4.0.0, mime-db@1.52.0, mime-types@2.1.35, min-indent@1.0.1, minimatch@10.2.5, minimist@1.2.8, mrmime@2.0.1, msw@2.15.0, mute-stream@3.0.0, nanoid@3.3.18, natural-compare@1.4.0, node-releases@2.0.54, obug@2.2.1, open@10.2.0, optionator@0.9.4, outvariant@1.4.3, oxc-parser@0.127.0, oxc-resolver@11.21.2, p-limit@2.3.0, p-limit@3.1.0, p-locate@4.1.0, p-locate@5.0.0, p-try@2.2.0, path-exists@4.0.0, path-parse@1.0.7, path-scurry@2.0.2, path-to-regexp@6.3.0, pathe@2.0.3, pathval@2.0.1, picocolors@1.1.1, playwright@1.61.1, playwright-core@1.61.1, postcss@8.5.28, prelude-ls@1.2.1, pretty-format@27.5.1, proxy-from-env@2.1.0, qified@0.10.1, react-docgen@8.0.3, react-docgen-typescript@2.4.0, react-is@17.0.2, recast@0.23.11, redent@3.0.0, require-directory@2.1.1, resolve@1.22.12, resolve-from@5.0.0, rettime@0.11.11, rimraf@6.1.3, rolldown@1.2.7, run-applescript@7.1.0, rxjs@7.8.2, semver@6.3.1, semver@7.8.5, set-cookie-parser@3.1.0, siginfo@2.0.0, sirv@3.0.2, source-map@0.6.1, source-map@0.7.6, stackback@0.0.2, statuses@2.0.2, std-env@4.2.0, storybook@10.6.0, strict-event-emitter@0.5.1, strip-bom@3.0.0, strip-indent@3.0.0, strip-indent@4.1.1, supports-color@7.2.0, supports-preserve-symlinks-flag@1.0.0, tagged-tag@1.0.0, tailwindcss@4.3.3, tapable@2.3.3, tar-mini@0.2.0, test-exclude@8.0.0, tiny-invariant@1.3.3, tinybench@6.1.4, tinyexec@1.3.0, tinyrainbow@2.0.0, tinyrainbow@3.1.1, tinyspy@4.0.4, totalist@3.0.1, ts-api-utils@2.5.0, ts-dedent@2.3.0, tsconfig-paths@4.2.0, type-check@0.4.0, type-fest@5.7.0, typescript@6.0.3, typescript-eslint@8.70.0, undici-types@8.9.0, until-async@3.0.2, update-browserslist-db@1.3.2, uri-js@4.4.1, vite@8.3.0, vite-plugin-compression2@2.5.3, vite-plugin-istanbul@9.0.1, vitest@5.0.1, wait-on@9.1.0, why-is-node-running@2.3.0, word-wrap@1.2.5, ws@8.21.3, wsl-utils@0.1.0, y18n@5.0.8, yallist@3.1.1, yargs@17.7.3, yargs-parser@21.1.1, yocto-queue@0.1.0, zod-validation-error@4.0.2

New advisories (28)

• H GHSA-3pq3-5fj3-cg6v in axios@1.18.1
• M GHSA-44g4-m2mj-wpvx in axios@1.18.1
• H GHSA-4528-x5fx-h6hg in joi@18.2.8
• M GHSA-4hqw-qxg8-jxx2 in axios@1.18.1
• H GHSA-542g-h47m-68v8 in axios@1.18.1
• H GHSA-587h-7wmj-h5pm in vite@8.3.0
• M GHSA-698v-4r3x-3vcv in vite@8.3.0
• H GHSA-8r9p-f939-6h3c in follow-redirects@1.16.0
• M GHSA-9fr6-4gfg-395g in axios@1.18.1
• L GHSA-9jrq-w75r-8gcw in vite@8.3.0
• H GHSA-c29m-xwm3-cm6r in axios@1.18.1
• C GHSA-f2ph-cmg5-wxc8 in storybook@10.6.0
• M GHSA-j8rh-479h-cp32 in axios@1.18.1
• H GHSA-m8m8-qj5v-23w3 in axios@1.18.1
• H GHSA-mghh-pgcx-3jjj in axios@1.18.1
• H GHSA-mrwp-f3q8-3g9p in follow-redirects@1.16.0
• M GHSA-p458-7748-mcp3 in @vitest/ui@5.0.0
• H GHSA-px85-f4q5-jh77 in storybook@10.6.0
• H GHSA-q3jh-wrc6-jgq8 in follow-redirects@1.16.0
• M GHSA-qxg6-89mg-rqv8 in @vitest/mocker@5.0.1
• H GHSA-r4gj-5m52-g5wh in axios@1.18.1
• M GHSA-r825-w8mm-5pxw in vite@8.3.0
• M GHSA-rq7h-c2jc-7f22 in vite@8.3.0
• M GHSA-vfpm-58rq-9qcg in vite@8.3.0
• M GHSA-vh66-26gq-q6x8 in axios@1.18.1
• M GHSA-wr44-6hxh-3jwq in joi@18.2.8
• H GHSA-x97p-jq2g-jp4f in axios@1.18.1
• M GHSA-xp26-3454-mjgp in @vitest/mocker@5.0.1

Known vulnerabilities (105)

Vulnerabilities are known advisories that Grype matches against the dependencies declared in each project's release source (manifests and lockfiles, including development and build dependencies). A match does not mean the tool is exploitable: the vulnerable code may be unused, test-only, or not shipped in the released binary. OSV: also reported by OSV-Scanner. Released binary: for Go tools, whether govulncheck found the vulnerable code in the shipped Linux binary. KEV: listed in the CISA Known Exploited Vulnerabilities catalog. EPSS: FIRST's estimated probability of exploitation in the next 30 days. Both describe the vulnerability in general, not its exploitability through this tool; a match in a workflow file refers to a GitHub Action, not to shipped code. Select an advisory for every catalog tool it matches. If a match is wrong or does not apply, use Dispute; accepted disputes are annotated here and listed on the corrections page, and the match stays visible.

Second opinion: OSV-Scanner

OSV-Scanner found 105 advisories in the same files; 105 of Grype's matches are confirmed by it (marked ✓ above). 0 advisories were reported only by OSV-Scanner.

Vulnerable code in the released binary

govulncheck analyzed console from console_0.3.42_linux_amd64.tar.gz, built with go1.26.6. 16 advisories have vulnerable functions compiled into it: 13 in the Go standard library and 3 in dependencies.

Of the 11 Go advisories Grype matched in the source, 0 are in modules or code paths that are not in the shipped binary.

The Go linker removes unreachable functions, so a vulnerable function in the binary is likely reachable. Standard-library advisories are fixed by rebuilding with a newer Go release.

Release integrity

Verdict: verified for console_0.3.42_linux_amd64.tar.gz. The download matches GitHub's recorded digest.

• Checksums file: yes
• Signatures: yes
• SLSA provenance: no
• SBOM published with the release: no

Verified means a signature, provenance, or attestation was checked against an identity in kubestellar/console's own GitHub Actions workflows.

Repository security (OpenSSF Scorecard)

No Scorecard result yet (the OpenSSF public dataset entry is 197 days old (limit 30); the Scorecard CLI fallback was skipped because this shard's weekly budget was used). Results are added as the weekly budget allows.

GitHub Actions workflow audit (zizmor)

37 potential issues in 97 workflow files at this release: 19 high, 7 medium, 11 low severity (medium or high confidence only). Each is a pattern to review, not a confirmed vulnerability.

Dependencies (1092)

By ecosystem: npm 900, golang 102, pypi 50, github 37, unknown 3.

Licenses (as declared in the SBOM): MIT 728, unknown 197, Apache-2.0 52, ISC 35, MPL-2.0 26, BSD-3-Clause 21, BlueOak-1.0.0 13, BSD-2-Clause 9, MIT-0 2, 0BSD 2, MIT OR CC0-1.0 2, Python-2.0 1, CC-BY-4.0 1, MPL-2.0 OR Apache-2.0 1, CC0-1.0 1.