slsa-verifier

Verify SLSA provenance for supply chain security

slsa-framework/slsa-verifier · Supply Chain Compliance · scanned v2.7.1 (released 2025-06-27) · commit ea584f4502ba · last scan 2026-11-02

1198
declared dependencies
19 / 116
critical / high advisories
243
advisories with a fixed version
79
advisories with vulnerable code in the go1.23.5 binary
—
OpenSSF Scorecard (of 10); no result this week
verified
release verification

Changes since last week

1035 added; 132 new advisories; 4 license changes.

Added (1035)

@aashutoshrathi/word-wrap@1.2.6, @arcanis/slice-ansi@1.1.1, @aws-crypto/crc32@3.0.0, @aws-crypto/crc32c@3.0.0, @aws-crypto/ie11-detection@3.0.0, @aws-crypto/sha1-browser@3.0.0, @aws-crypto/sha256-browser@3.0.0, @aws-crypto/sha256-js@3.0.0, @aws-crypto/supports-web-crypto@3.0.0, @aws-crypto/util@3.0.0, @aws-sdk/client-codecommit@3.565.0, @aws-sdk/client-cognito-identity@3.565.0, @aws-sdk/client-ec2@3.565.0, @aws-sdk/client-ecr@3.565.0, @aws-sdk/client-rds@3.565.0, @aws-sdk/client-s3@3.565.0, @aws-sdk/client-sso@3.556.0, @aws-sdk/client-sso@3.575.0, @aws-sdk/client-sso@3.576.0, @aws-sdk/client-sso-oidc@3.575.0, @aws-sdk/client-sso-oidc@3.576.0, @aws-sdk/client-sts@3.565.0, @aws-sdk/client-sts@3.575.0, @aws-sdk/client-sts@3.576.0, @aws-sdk/core@3.556.0, @aws-sdk/core@3.575.0, @aws-sdk/core@3.576.0, @aws-sdk/credential-provider-cognito-identity@3.565.0, @aws-sdk/credential-provider-env@3.535.0, @aws-sdk/credential-provider-env@3.575.0, @aws-sdk/credential-provider-http@3.552.0, @aws-sdk/credential-provider-http@3.575.0, @aws-sdk/credential-provider-ini@3.565.0, @aws-sdk/credential-provider-ini@3.575.0, @aws-sdk/credential-provider-ini@3.576.0, @aws-sdk/credential-provider-node@3.565.0, @aws-sdk/credential-provider-node@3.575.0, @aws-sdk/credential-provider-node@3.576.0, @aws-sdk/credential-provider-process@3.535.0, @aws-sdk/credential-provider-process@3.575.0, @aws-sdk/credential-provider-sso@3.565.0, @aws-sdk/credential-provider-sso@3.575.0, @aws-sdk/credential-provider-sso@3.576.0, @aws-sdk/credential-provider-web-identity@3.565.0, @aws-sdk/credential-provider-web-identity@3.575.0, @aws-sdk/credential-providers@3.565.0, @aws-sdk/middleware-bucket-endpoint@3.535.0, @aws-sdk/middleware-expect-continue@3.535.0, @aws-sdk/middleware-flexible-checksums@3.535.0, @aws-sdk/middleware-host-header@3.535.0, @aws-sdk/middleware-host-header@3.575.0, @aws-sdk/middleware-location-constraint@3.535.0, @aws-sdk/middleware-logger@3.535.0, @aws-sdk/middleware-logger@3.575.0, @aws-sdk/middleware-recursion-detection@3.535.0, @aws-sdk/middleware-recursion-detection@3.575.0, @aws-sdk/middleware-sdk-ec2@3.556.0, @aws-sdk/middleware-sdk-rds@3.556.0, @aws-sdk/middleware-sdk-s3@3.556.0, @aws-sdk/middleware-signing@3.556.0, @aws-sdk/middleware-ssec@3.537.0, @aws-sdk/middleware-user-agent@3.540.0, @aws-sdk/middleware-user-agent@3.575.0, @aws-sdk/region-config-resolver@3.535.0, @aws-sdk/region-config-resolver@3.575.0, @aws-sdk/signature-v4-multi-region@3.556.0, @aws-sdk/token-providers@3.565.0, @aws-sdk/token-providers@3.575.0, @aws-sdk/types@3.535.0, @aws-sdk/types@3.575.0, @aws-sdk/util-arn-parser@3.535.0, @aws-sdk/util-endpoints@3.540.0, @aws-sdk/util-endpoints@3.575.0, @aws-sdk/util-format-url@3.535.0, @aws-sdk/util-locate-window@3.568.0, @aws-sdk/util-user-agent-browser@3.535.0, @aws-sdk/util-user-agent-browser@3.575.0, @aws-sdk/util-user-agent-node@3.535.0, @aws-sdk/util-user-agent-node@3.575.0, @aws-sdk/util-utf8-browser@3.259.0, @aws-sdk/xml-builder@3.535.0, @babel/code-frame@7.24.2, @babel/helper-validator-identifier@7.24.5, @babel/highlight@7.24.5, @babel/runtime@7.21.0, @babel/runtime-corejs3@7.24.5, @breejs/later@4.2.0, @cdktf/hcl2json@0.20.7, @eslint-community/eslint-utils@4.4.0, @eslint-community/regexpp@4.10.0, @eslint/eslintrc@2.1.4, @eslint/js@8.57.0, @github/browserslist-config@1.0.0, @gwhitney/detect-indent@7.0.1, @humanwhocodes/config-array@0.11.14, @humanwhocodes/module-importer@1.0.1, @humanwhocodes/object-schema@2.0.3, @isaacs/cliui@8.0.2, @kwsites/file-exists@1.1.1, @kwsites/promise-deferred@1.1.1, @nodelib/fs.scandir@2.1.5, @nodelib/fs.stat@2.0.5, @nodelib/fs.walk@1.2.8, @npmcli/agent@2.2.2, @npmcli/fs@3.1.1, @octokit/core@5.2.0, @octokit/graphql@7.1.0, @octokit/plugin-paginate-rest@11.4.4-cjs.2, @octokit/plugin-request-log@4.0.1, @octokit/plugin-rest-endpoint-methods@13.3.2-cjs.1, @octokit/rest@20.1.2, @one-ini/wasm@0.1.1, @opentelemetry/api@1.8.0, @opentelemetry/api-logs@0.51.1, @opentelemetry/context-async-hooks@1.24.1, @opentelemetry/core@1.24.1, @opentelemetry/exporter-trace-otlp-http@0.51.1, @opentelemetry/instrumentation@0.51.1, @opentelemetry/instrumentation-bunyan@0.38.0, @opentelemetry/instrumentation-http@0.51.1, @opentelemetry/otlp-exporter-base@0.51.1, @opentelemetry/otlp-transformer@0.51.1, @opentelemetry/propagator-b3@1.24.1, @opentelemetry/propagator-jaeger@1.24.1, @opentelemetry/resources@1.24.1, @opentelemetry/sdk-logs@0.51.1, @opentelemetry/sdk-metrics@1.24.1, @opentelemetry/sdk-trace-base@1.24.1, @opentelemetry/sdk-trace-node@1.24.1, @opentelemetry/semantic-conventions@1.24.1, @pkgjs/parseargs@0.11.0, @pkgr/core@0.1.1, @pnpm/constants@6.1.0, @pnpm/error@4.0.0, @pnpm/graceful-fs@2.0.0, @pnpm/read-project-manifest@4.1.1, @pnpm/text.comments-parser@1.0.0, @pnpm/types@8.9.0, @pnpm/util.lex-comparator@1.0.0, @pnpm/write-project-manifest@4.1.1, @qnighy/marshal@0.1.3, @redis/bloom@1.2.0, @redis/client@1.5.14, @redis/graph@1.1.1, @redis/json@1.0.6, @redis/search@1.1.6, @redis/time-series@1.0.5, @renovatebot/kbpgp@3.0.1, @renovatebot/osv-offline@1.5.5, @renovatebot/osv-offline-db@1.6.0, @renovatebot/pep440@3.0.20, @renovatebot/ruby-semver@3.0.23, @seald-io/binary-search-tree@1.0.3, @seald-io/nedb@4.0.4, @sindresorhus/is@4.6.0, @smithy/abort-controller@2.2.0, @smithy/abort-controller@3.0.0, @smithy/chunked-blob-reader@2.2.0, @smithy/chunked-blob-reader-native@2.2.0, @smithy/config-resolver@2.2.0, @smithy/config-resolver@3.0.0, @smithy/core@1.4.2, @smithy/core@2.0.1, @smithy/credential-provider-imds@2.3.0, @smithy/credential-provider-imds@3.0.0, @smithy/eventstream-codec@2.2.0, @smithy/eventstream-serde-browser@2.2.0, @smithy/eventstream-serde-config-resolver@2.2.0, @smithy/eventstream-serde-node@2.2.0, @smithy/eventstream-serde-universal@2.2.0, @smithy/fetch-http-handler@2.5.0, @smithy/fetch-http-handler@3.0.1, @smithy/hash-blob-browser@2.2.0, @smithy/hash-node@2.2.0, @smithy/hash-node@3.0.0, @smithy/hash-stream-node@2.2.0, @smithy/invalid-dependency@2.2.0, @smithy/invalid-dependency@3.0.0, @smithy/is-array-buffer@2.2.0, @smithy/is-array-buffer@3.0.0, @smithy/md5-js@2.2.0, @smithy/middleware-content-length@2.2.0, @smithy/middleware-content-length@3.0.0, @smithy/middleware-endpoint@2.5.1, @smithy/middleware-endpoint@3.0.0, @smithy/middleware-retry@2.3.1, @smithy/middleware-retry@3.0.1, @smithy/middleware-serde@2.3.0, @smithy/middleware-serde@3.0.0, @smithy/middleware-stack@2.2.0, @smithy/middleware-stack@3.0.0, @smithy/node-config-provider@2.3.0, @smithy/node-config-provider@3.0.0, @smithy/node-http-handler@2.5.0, @smithy/node-http-handler@3.0.0, @smithy/property-provider@2.2.0, @smithy/property-provider@3.0.0, @smithy/protocol-http@3.3.0, @smithy/protocol-http@4.0.0, @smithy/querystring-builder@2.2.0, @smithy/querystring-builder@3.0.0, @smithy/querystring-parser@2.2.0, @smithy/querystring-parser@3.0.0, @smithy/service-error-classification@2.1.5, @smithy/service-error-classification@3.0.0, @smithy/shared-ini-file-loader@2.4.0, @smithy/shared-ini-file-loader@3.0.0, @smithy/signature-v4@2.3.0, @smithy/signature-v4@3.0.0, @smithy/smithy-client@2.5.1, @smithy/smithy-client@3.0.1, @smithy/types@2.12.0, @smithy/types@3.0.0, @smithy/url-parser@2.2.0, @smithy/url-parser@3.0.0, @smithy/util-base64@2.3.0, @smithy/util-base64@3.0.0, @smithy/util-body-length-browser@2.2.0, @smithy/util-body-length-browser@3.0.0, @smithy/util-body-length-node@2.3.0, @smithy/util-body-length-node@3.0.0, @smithy/util-buffer-from@2.2.0, @smithy/util-buffer-from@3.0.0, @smithy/util-config-provider@2.3.0, @smithy/util-config-provider@3.0.0, @smithy/util-defaults-mode-browser@2.2.1, @smithy/util-defaults-mode-browser@3.0.1, @smithy/util-defaults-mode-node@2.3.1, @smithy/util-defaults-mode-node@3.0.1, @smithy/util-endpoints@1.2.0, @smithy/util-endpoints@2.0.0, @smithy/util-hex-encoding@2.2.0, @smithy/util-hex-encoding@3.0.0, @smithy/util-middleware@2.2.0, @smithy/util-middleware@3.0.0, @smithy/util-retry@2.2.0, @smithy/util-retry@3.0.0, @smithy/util-stream@2.2.0, @smithy/util-stream@3.0.1, @smithy/util-uri-escape@2.2.0, @smithy/util-uri-escape@3.0.0, @smithy/util-utf8@2.3.0, @smithy/util-utf8@3.0.0, @smithy/util-waiter@2.2.0, @szmarczak/http-timer@4.0.6, @thi.ng/api@7.2.0, @thi.ng/arrays@1.0.3, @thi.ng/checks@2.9.11, @thi.ng/compare@1.3.34, @thi.ng/equiv@1.0.45, @thi.ng/errors@1.3.4, @thi.ng/hex@1.0.4, @thi.ng/random@2.4.8, @thi.ng/zipper@1.0.3, @types/bunyan@1.8.9, @types/cacheable-request@6.0.3, @types/emscripten@1.39.12, @types/http-cache-semantics@4.0.4, @types/jasmine@4.6.4, @types/json-schema@7.0.15, @types/json5@0.0.29, @types/keyv@3.1.4, @types/mdast@3.0.15, @types/minimist@1.2.5, @types/moo@0.5.5, @types/node@18.19.33, @types/node@20.12.12, @types/normalize-package-data@2.4.4, @types/responselike@1.0.3, @types/semver@7.5.8, @types/shimmer@1.0.5, @types/treeify@1.0.3, @types/unist@2.0.10, @types/yauzl@2.10.3, @typescript-eslint/eslint-plugin@7.5.0, @typescript-eslint/parser@7.5.0, @typescript-eslint/scope-manager@7.5.0, @typescript-eslint/type-utils@7.5.0, @typescript-eslint/types@7.5.0, @typescript-eslint/typescript-estree@7.5.0, @typescript-eslint/utils@7.5.0, @typescript-eslint/visitor-keys@7.5.0, @ungap/structured-clone@1.2.0, @vercel/ncc@0.38.1, @yarnpkg/core@4.0.5, @yarnpkg/fslib@3.1.0, @yarnpkg/libzip@3.1.0, @yarnpkg/parsers@3.0.2, @yarnpkg/shell@4.0.2, abbrev@2.0.0, acorn@8.11.3, acorn-import-attributes@1.9.5, acorn-jsx@5.3.2, adm-zip@0.5.12, agent-base@7.1.1, agentkeepalive@4.5.0, aggregate-error@3.1.0, ajv@6.12.6, ansi-red@0.1.1, ansi-regex@5.0.1, ansi-regex@6.0.1, ansi-styles@3.2.1, ansi-styles@4.3.0, ansi-styles@6.2.1, ansi-wrap@0.1.0, argparse@1.0.10, argparse@2.0.1, aria-query@5.3.0, array-buffer-byte-length@1.0.1, array-includes@3.1.6, array-union@2.1.0, array.prototype.flat@1.3.0, array.prototype.flatmap@1.3.1, arraybuffer.prototype.slice@1.0.3, arrify@1.0.1, asn1.js@5.4.1, ast-types-flow@0.0.7, auth-header@1.0.0, autolinker@4.0.0, available-typed-arrays@1.0.5, available-typed-arrays@1.0.7, aws4@1.12.0, axe-core@4.6.3, axobject-query@3.1.1, azure-devops-node-api@13.0.0, backslash@0.2.0, bail@1.0.5, balanced-match@1.0.2, base64-js@1.5.1, better-sqlite3@9.6.0, bignumber.js@9.1.2, bindings@1.5.0, bl@4.1.0, bn@1.0.5, bn.js@4.12.0, boolbase@1.0.0, boolean@3.2.0, bowser@2.11.0, brace-expansion@1.1.11, brace-expansion@2.0.1, braces@3.0.3, browserslist@4.21.3, buffer@5.7.1, buffer-crc32@0.2.13, buffer-equal-constant-time@1.0.1, buffer-from@1.1.2, bunyan@1.8.15, bzip-deflate@1.0.0, cacache@18.0.3, cacheable-lookup@5.0.4, cacheable-request@7.0.4, call-bind@1.0.2, call-bind@1.0.7, callsites@3.1.0, camelcase@5.3.1, camelcase-keys@6.2.2, caniuse-lite@1.0.30001387, chalk@2.4.2, chalk@3.0.0, chalk@4.1.2, changelog-filename-regex@2.0.1, character-entities@1.2.4, character-entities-legacy@1.1.4, character-reference-invalid@1.1.4, chownr@1.1.4, chownr@2.0.0, ci-info@3.9.0, cjs-module-lexer@1.3.1, clean-git-ref@2.0.1, clean-stack@2.2.0, clipanion@4.0.0-rc.3, clone-response@1.0.3, cluster-key-slot@1.1.2, coffee-script@1.12.7, color-convert@1.9.3, color-convert@2.0.1, color-name@1.1.3, color-name@1.1.4, commander@11.1.0, commander@12.0.0, concat-map@0.0.1, concat-stream@1.6.2, conventional-commits-detector@1.0.3, core-js-pure@3.37.1, core-util-is@1.0.3, cron-parser@4.9.0, cross-spawn@7.0.3, css-select@5.1.0, css-what@6.1.0, damerau-levenshtein@1.0.8, dargs@7.0.0, data-view-buffer@1.0.1, data-view-byte-length@1.0.1, data-view-byte-offset@1.0.0, debug@2.6.9, debug@3.2.7, debug@4.3.4, decamelize@1.2.0, decamelize-keys@1.1.1, decompress-response@6.0.0, deep-equal@2.2.0, deep-equal@2.2.3, deep-extend@0.6.0, deep-is@0.1.4, deepmerge@4.3.1, defer-to-connect@2.0.1, define-data-property@1.1.4, define-properties@1.1.4, define-properties@1.2.1, dequal@2.0.3, detect-indent@6.1.0, detect-libc@2.0.3, detect-node@2.1.0, diacritics-map@0.1.0, diff@5.2.0, dir-glob@3.0.1, doctrine@2.1.0, doctrine@3.0.0, dom-serializer@2.0.0, domelementtype@2.3.0, domhandler@5.0.3, domutils@3.1.0, dotenv@16.4.5, dtrace-provider@0.8.8, eastasianwidth@0.2.0, ecdsa-sig-formatter@1.0.11, editorconfig@2.0.0, electron-to-chromium@1.4.238, email-addresses@5.0.0, emoji-regex@10.3.0, emoji-regex@8.0.0, emoji-regex@9.2.2, emojibase@15.3.0, emojibase-regex@15.3.0, encoding@0.1.13, end-of-stream@1.4.4, entities@4.5.0, env-paths@2.2.1, err-code@2.0.3, error-ex@1.3.2, es-abstract@1.21.1, es-abstract@1.23.3, es-define-property@1.0.0, es-errors@1.3.0, es-get-iterator@1.1.3, es-object-atoms@1.0.0, es-set-tostringtag@2.0.1, es-set-tostringtag@2.0.3, es-shim-unscopables@1.0.0, es-to-primitive@1.2.1, es6-error@4.1.1, escalade@3.1.1, escape-string-regexp@1.0.5, escape-string-regexp@4.0.0, eslint@8.57.0, eslint-config-prettier@8.5.0, eslint-import-resolver-node@0.3.6, eslint-module-utils@2.7.4, eslint-plugin-escompat@3.3.3, eslint-plugin-eslint-comments@3.2.0, eslint-plugin-filenames@1.3.2, eslint-plugin-github@4.10.2, eslint-plugin-i18n-text@1.0.1, eslint-plugin-import@2.26.0, eslint-plugin-jsx-a11y@6.7.1, eslint-plugin-no-only-tests@3.0.0, eslint-plugin-prettier@5.1.3, eslint-rule-documentation@1.0.23, eslint-scope@7.2.2, eslint-visitor-keys@3.4.3, espree@9.6.1, esprima@4.0.1, esquery@1.4.2, esrecurse@4.3.0, estraverse@5.3.0, esutils@2.0.3, eventemitter3@4.0.7, expand-range@1.8.2, expand-template@2.0.3, exponential-backoff@3.1.1, extend@3.0.2, extend-shallow@2.0.1, extract-zip@2.0.1, fast-deep-equal@3.1.3, fast-diff@1.2.0, fast-glob@3.3.2, fast-json-stable-stringify@2.1.0, fast-levenshtein@2.0.6, fast-xml-parser@4.2.5, fastq@1.13.0, fastq@1.17.1, fd-slicer@1.1.0, file-entry-cache@6.0.1, file-uri-to-path@1.0.0, fill-range@2.2.4, fill-range@7.1.1, find-packages@10.0.4, find-up@4.1.0, find-up@5.0.0, flat-cache@3.0.4, flatted@3.2.7, for-each@0.3.3, for-in@1.0.2, foreground-child@3.1.1, fs-constants@1.0.0, fs-extra@11.2.0, fs-minipass@2.1.0, fs-minipass@3.0.3, fs.realpath@1.0.0, function-bind@1.1.1, function-bind@1.1.2, function.prototype.name@1.1.5, function.prototype.name@1.1.6, functions-have-names@1.2.3, gaxios@6.5.0, gcp-metadata@6.1.0, generic-pool@3.9.0, get-intrinsic@1.2.0, get-intrinsic@1.2.4, get-stream@5.2.0, get-symbol-description@1.0.0, get-symbol-description@1.0.2, git-raw-commits@2.0.11, git-up@7.0.0, git-url-parse@14.0.0, github-from-package@0.0.0, github-url-from-git@1.5.0, glob@10.3.12, glob@10.3.15, glob@6.0.4, glob@7.2.3, glob-parent@5.1.2, glob-parent@6.0.2, global-agent@3.0.0, globals@13.19.0, globalthis@1.0.3, globalthis@1.0.4, globby@11.1.0, good-enough-parser@1.1.23, google-auth-library@9.10.0, gopd@1.0.1, got@11.8.6, graceful-fs@4.2.11, graph-data-structure@3.5.0, grapheme-splitter@1.0.4, graphemer@1.4.0, gray-matter@2.1.1, gtoken@7.1.0, handlebars@4.7.8, hard-rejection@2.1.0, has@1.0.3, has-bigints@1.0.2, has-flag@3.0.0, has-flag@4.0.0, has-property-descriptors@1.0.0, has-property-descriptors@1.0.2, has-proto@1.0.1, has-proto@1.0.3, has-symbols@1.0.3, has-tostringtag@1.0.0, has-tostringtag@1.0.2, hasown@2.0.2, he@1.2.0, hosted-git-info@2.8.9, hosted-git-info@4.1.0, http-cache-semantics@4.1.1, http-proxy-agent@7.0.2, http2-wrapper@1.0.3, https-proxy-agent@7.0.4, humanize-ms@1.2.1, iced-error@0.0.13, iced-lock@1.1.0, iced-lock@2.0.1, iced-runtime@1.0.4, iced-runtime-3@3.0.5, iconv-lite@0.6.3, ieee754@1.2.1, ignore@5.3.1, immediate@3.0.6, import-fresh@3.3.0, import-in-the-middle@1.7.4, imurmurhash@0.1.4, indent-string@4.0.0, inflight@1.0.6, inherits@2.0.4, ini@1.3.8, ini@4.1.2, install-artifact-from-github@1.3.5, internal-slot@1.0.5, internal-slot@1.0.7, ip-address@9.0.5, is-alphabetical@1.0.4, is-alphanumerical@1.0.4, is-arguments@1.1.1, is-array-buffer@3.0.1, is-array-buffer@3.0.4, is-arrayish@0.2.1, is-bigint@1.0.4, is-boolean-object@1.1.2, is-buffer@1.1.6, is-buffer@2.0.5, is-callable@1.2.7, is-core-module@2.10.0, is-core-module@2.13.1, is-data-view@1.0.1, is-date-object@1.0.5, is-decimal@1.0.4, is-extendable@0.1.1, is-extendable@1.0.1, is-extglob@2.1.1, is-fullwidth-code-point@3.0.0, is-generator-function@1.0.10, is-glob@4.0.3, is-hexadecimal@1.0.4, is-lambda@1.0.1, is-map@2.0.2, is-map@2.0.3, is-negative-zero@2.0.2, is-negative-zero@2.0.3, is-number@2.1.0, is-number@4.0.0, is-number@7.0.0, is-number-object@1.0.7, is-path-inside@3.0.3, is-plain-obj@1.1.0, is-plain-obj@2.1.0, is-plain-object@2.0.4, is-regex@1.1.4, is-set@2.0.2, is-set@2.0.3, is-shared-array-buffer@1.0.2, is-shared-array-buffer@1.0.3, is-ssh@1.4.0, is-stream@2.0.1, is-string@1.0.7, is-symbol@1.0.4, is-typed-array@1.1.10, is-typed-array@1.1.13, is-typedarray@1.0.0, is-weakmap@2.0.1, is-weakmap@2.0.2, is-weakref@1.0.2, is-weakset@2.0.2, is-weakset@2.0.3, is-windows@1.0.2, isarray@1.0.0, isarray@2.0.5, isexe@2.0.0, isexe@3.1.1, isobject@2.1.0, isobject@3.0.1, jackspeak@2.3.6, jasmine@5.1.0, jasmine-core@5.1.2, js-tokens@4.0.0, js-yaml@3.14.1, js-yaml@4.1.0, jsbn@1.1.0, json-bigint@1.0.0, json-buffer@3.0.1, json-dup-key-validator@1.0.3, json-parse-even-better-errors@2.3.1, json-schema-traverse@0.4.1, json-stable-stringify-without-jsonify@1.0.1, json-stringify-pretty-compact@3.0.0, json-stringify-safe@5.0.1, json5@1.0.2, json5@2.2.3, jsonata@2.0.5, jsonc-parser@3.2.1, jsonfile@6.1.0, jsx-ast-utils@3.3.3, jwa@2.0.0, jws@4.0.0, keybase-ecurve@1.0.1, keybase-nacl@1.1.4, keyv@4.5.4, kind-of@3.2.2, kind-of@6.0.3, klona@2.0.6, language-subtag-registry@0.3.22, language-tags@1.0.5, lazy-cache@2.0.2, levn@0.4.1, lie@3.1.1, lines-and-columns@1.2.4, linkify-it@5.0.0, list-item@1.1.1, localforage@1.10.0, locate-path@5.0.0, locate-path@6.0.0, lodash@4.17.21, lodash.camelcase@4.3.0, lodash.kebabcase@4.1.1, lodash.merge@4.6.2, lodash.snakecase@4.1.1, lodash.upperfirst@4.3.1, longest-streak@2.0.4, lowercase-keys@2.0.0, lru-cache@10.2.0, lru-cache@10.2.2, lru-cache@6.0.0, luxon@3.4.4, make-fetch-happen@13.0.1, map-obj@1.0.1, map-obj@4.3.0, markdown-it@14.1.0, markdown-link@0.1.1, markdown-table@2.0.0, markdown-toc@1.2.0, matcher@3.0.0, math-random@1.0.4, mdast-util-find-and-replace@1.1.1, mdast-util-from-markdown@0.8.5, mdast-util-to-markdown@0.6.5, mdast-util-to-string@1.1.0, mdast-util-to-string@2.0.0, mdurl@2.0.0, meow@7.1.1, meow@8.1.2, merge2@1.4.1, micromark@2.11.4, micromatch@4.0.5, mimic-response@1.0.1, mimic-response@3.1.0, min-indent@1.0.1, minimalistic-assert@1.0.1, minimatch@3.1.2, minimatch@9.0.2, minimatch@9.0.3, minimatch@9.0.4, minimist@1.2.6, minimist@1.2.8, minimist-options@4.1.0, minipass@3.3.6, minipass@5.0.0, minipass@7.0.4, minipass@7.1.1, minipass-collect@2.0.1, minipass-fetch@3.0.5, minipass-flush@1.0.5, minipass-pipeline@1.2.4, minipass-sized@1.0.3, minizlib@2.1.2, mixin-deep@1.3.2, mkdirp@0.5.6, mkdirp@1.0.4, mkdirp-classic@0.5.3, module-details-from-path@1.0.3, moment@2.30.1, moo@0.5.2, more-entropy@0.0.7, ms@2.0.0, ms@2.1.2, ms@2.1.3, mv@2.1.1, nan@2.19.0, nanoid@3.3.7, napi-build-utils@1.0.2, natural-compare@1.4.0, ncp@2.0.0, negotiator@0.6.3, neo-async@2.6.2, node-abi@3.62.0, node-fetch@2.7.0, node-gyp@10.1.0, node-html-parser@6.1.13, node-releases@2.0.6, nopt@7.2.1, normalize-package-data@2.5.0, normalize-package-data@3.0.3, normalize-url@6.1.0, nth-check@2.1.1, object-inspect@1.12.2, object-inspect@1.13.1, object-is@1.1.5, object-is@1.1.6, object-keys@1.1.1, object.assign@4.1.4, object.assign@4.1.5, object.entries@1.1.6, object.fromentries@2.0.6, object.pick@1.3.0, object.values@1.1.5, openpgp@5.11.1, optionator@0.9.3, p-all@3.0.0, p-cancelable@2.1.1, p-filter@2.1.0, p-finally@1.0.0, p-limit@2.3.0, p-limit@3.1.0, p-locate@4.1.0, p-locate@5.0.0, p-map@2.1.0, p-map@4.0.0, p-queue@6.6.2, p-throttle@4.1.1, p-timeout@3.2.0, p-try@2.2.0, parent-module@1.0.1, parse-entities@2.0.0, parse-json@5.2.0, parse-link-header@2.0.0, parse-path@7.0.0, parse-url@8.1.0, path-exists@4.0.0, path-is-absolute@1.0.1, path-key@3.1.1, path-parse@1.0.7, path-scurry@1.10.2, path-scurry@1.11.1, path-type@4.0.0, pend@1.2.0, pgp-utils@0.0.35, picocolors@1.0.0, picocolors@1.0.1, picomatch@2.3.1, possible-typed-array-names@1.0.0, prebuild-install@7.1.2, prelude-ls@1.2.1, prettier@3.2.5, prettier-linter-helpers@1.0.0, proc-log@3.0.0, proc-log@4.2.0, process-nextick-args@2.0.1, progress@1.1.8, promise-retry@2.0.1, protocols@2.0.1, pump@3.0.0, punycode@2.1.1, punycode.js@2.3.1, purepack@1.0.6, qs@6.12.1, queue-microtask@1.2.3, quick-lru@4.0.1, quick-lru@5.1.1, randomatic@3.1.1, rc@1.2.8, re2@1.20.11, read-pkg@5.2.0, read-pkg-up@7.0.1, read-yaml-file@2.1.0, readable-stream@2.3.8, readable-stream@3.6.2, redent@3.0.0, redis@4.6.13, regenerator-runtime@0.13.11, regenerator-runtime@0.14.1, regexp.prototype.flags@1.4.3, regexp.prototype.flags@1.5.2, remark@13.0.0, remark-github@10.1.0, remark-parse@9.0.0, remark-stringify@9.0.1, remarkable@1.7.4, renovate@37.374.1, repeat-element@1.1.4, repeat-string@1.6.1, require-in-the-middle@7.3.0, resolve@1.22.1, resolve@1.22.8, resolve-alpn@1.2.1, resolve-from@4.0.0, responselike@2.0.1, retry@0.12.0, reusify@1.0.4, rimraf@2.4.5, rimraf@3.0.2, roarr@2.15.4, run-parallel@1.2.0, safe-array-concat@1.1.2, safe-buffer@5.1.2, safe-json-stringify@1.2.0, safe-regex-test@1.0.0, safe-regex-test@1.0.3, safe-stable-stringify@2.4.3, safer-buffer@2.1.2, sax@1.3.0, semver@5.7.2, semver@7.6.0, semver@7.6.2, semver-compare@1.0.0, semver-stable@3.0.0, semver-utils@1.1.4, serialize-error@7.0.1, set-function-length@1.2.2, set-function-name@2.0.2, set-getter@0.1.1, shebang-command@2.0.0, shebang-regex@3.0.0, shimmer@1.2.1, shlex@2.1.2, side-channel@1.0.4, side-channel@1.0.6, signal-exit@3.0.7, signal-exit@4.0.2, signal-exit@4.1.0, simple-concat@1.0.1, simple-get@4.0.1, simple-git@3.24.0, slash@3.0.0, slugify@1.6.6, smart-buffer@4.2.0, socks@2.8.3, socks-proxy-agent@8.0.3, sort-keys@4.2.0, source-map@0.6.1, source-map-support@0.5.21, spdx-correct@3.2.0, spdx-exceptions@2.5.0, spdx-expression-parse@3.0.1, spdx-license-ids@3.0.17, split2@3.2.2, sprintf-js@1.0.3, sprintf-js@1.1.3, ssri@10.0.6, stop-iteration-iterator@1.0.0, string-width@4.2.3, string-width@5.1.2, string.prototype.trim@1.2.9, string.prototype.trimend@1.0.6, string.prototype.trimend@1.0.8, string.prototype.trimstart@1.0.6, string.prototype.trimstart@1.0.8, string_decoder@1.1.1, strip-ansi@6.0.1, strip-ansi@7.0.1, strip-ansi@7.1.0, strip-bom@3.0.0, strip-bom@4.0.0, strip-color@0.1.0, strip-comments-strings@1.2.0, strip-indent@3.0.0, strip-json-comments@2.0.1, strip-json-comments@3.1.1, strnum@1.0.5, supports-color@5.5.0, supports-color@7.2.0, supports-preserve-symlinks-flag@1.0.0, svg-element-attributes@1.3.1, synckit@0.8.8, tar@6.2.1, tar-fs@2.1.3, tar-stream@2.2.0, text-table@0.2.0, through2@2.0.5, through2@4.0.2, through2-concurrent@2.0.0, tinylogic@2.0.0, to-object-path@0.3.0, to-regex-range@5.0.1, toml@2.3.6, toml-eslint-parser@0.9.3, tr46@0.0.3, traverse@0.6.9, treeify@1.1.0, trim-newlines@3.0.1, triplesec@4.0.3, trough@1.0.5, ts-api-utils@1.3.0, tsconfig-paths@3.14.1, tslib@1.14.1, tslib@2.6.2, tunnel-agent@0.6.0, tweetnacl@0.13.3, tweetnacl@1.0.3, typanion@3.14.0, type-check@0.4.0, type-fest@0.13.1, type-fest@0.18.1, type-fest@0.20.2, type-fest@0.6.0, type-fest@0.8.1, typed-array-buffer@1.0.2, typed-array-byte-length@1.0.1, typed-array-byte-offset@1.0.2, typed-array-length@1.0.4, typed-array-length@1.0.6, typed-rest-client@1.8.11, typedarray@0.0.6, typedarray-to-buffer@3.1.5, typedarray.prototype.slice@1.0.3, typescript@5.4.3, typescript-eslint@7.5.0, uc.micro@2.1.0, uglify-js@3.17.4, uint64be@1.0.1, unbox-primitive@1.0.2, underscore@1.13.6, undici-types@5.26.5, unified@9.2.2, unique-filename@3.0.0, unique-slug@4.0.0, unist-util-is@4.1.0, unist-util-stringify-position@2.0.3, unist-util-visit@2.0.3, unist-util-visit-parents@3.1.1, universalify@2.0.1, upath@2.0.1, update-browserslist-db@1.0.5, uri-js@4.4.1, url-join@4.0.1, util@0.12.5, util-deprecate@1.0.2, uuid@9.0.1, validate-npm-package-license@3.0.4, validate-npm-package-name@5.0.1, vfile@4.2.1, vfile-message@2.0.4, vuln-vects@1.1.0, webidl-conversions@3.0.1, whatwg-url@5.0.0, which@2.0.2, which@4.0.0, which-boxed-primitive@1.0.2, which-collection@1.0.1, which-collection@1.0.2, which-typed-array@1.1.15, which-typed-array@1.1.9, wordwrap@1.0.0, wrap-ansi@7.0.0, wrap-ansi@8.1.0, write-file-atomic@3.0.3, write-file-atomic@5.0.1, write-yaml-file@4.2.0, xmldoc@1.3.0, xtend@4.0.2, yallist@4.0.0, yargs-parser@18.1.3, yargs-parser@20.2.9, yauzl@2.10.0, yocto-queue@0.1.0, zod@3.23.8, zwitch@1.0.5

New advisories (132)

License changes

Known vulnerabilities (253)

Vulnerabilities are known advisories that Grype matches against the dependencies declared in each project's release source (manifests and lockfiles, including development and build dependencies). A match does not mean the tool is exploitable: the vulnerable code may be unused, test-only, or not shipped in the released binary. OSV: also reported by OSV-Scanner. Released binary: for Go tools, whether govulncheck found the vulnerable code in the shipped Linux binary. KEV: listed in the CISA Known Exploited Vulnerabilities catalog. EPSS: FIRST's estimated probability of exploitation in the next 30 days. Both describe the vulnerability in general, not its exploitability through this tool; a match in a workflow file refers to a GitHub Action, not to shipped code. Select an advisory for every catalog tool it matches. If a match is wrong or does not apply, use Dispute; accepted disputes are annotated here and listed on the corrections page, and the match stays visible.

SeverityAdvisoryPackageVersionFixed inOSVReleased binaryKEVEPSSDeclared inDispute
CriticalGHSA-m7jm-9gc2-mpf2 source
CVE-2026-25896
fast-xml-parser
npm
4.2.54.5.4✓—no0.5%package-lock.jsonDispute
CriticalGHSA-5cgq-3rg8-m6cv source
CVE-2026-42508
golang.org/x/crypto
golang
v0.36.00.52.0✓module in binaryno6.9%go.modDispute
CriticalGHSA-89gr-r52h-f8rx source
CVE-2026-39831
golang.org/x/crypto
golang
v0.36.00.52.0✓vulnerable code in binaryno0.5%go.modDispute
CriticalGHSA-f5wc-c3c7-36mc source
CVE-2026-39832
golang.org/x/crypto
golang
v0.36.00.52.0✓module in binaryno0.7%go.modDispute
CriticalGHSA-jppx-rxg9-jmrx source
CVE-2026-39833
golang.org/x/crypto
golang
v0.36.00.52.0✓module in binaryno0.5%go.modDispute
CriticalGHSA-rm3j-f69w-wqmq source
CVE-2026-39834
golang.org/x/crypto
golang
v0.36.00.52.0✓vulnerable code in binaryno0.6%go.modDispute
CriticalGHSA-vgwf-h737-ff37 source
CVE-2026-39830
golang.org/x/crypto
golang
v0.36.00.52.0✓package in binaryno0.7%go.modDispute
CriticalGHSA-x527-x647-q7gg source
CVE-2026-46595
golang.org/x/crypto
golang
v0.36.00.52.0✓package in binaryno0.6%go.modDispute
CriticalGO-2026-6612 source
CVE-2026-78663
golang.org/x/net
golang
v0.38.00.60.0✓vulnerable code in binaryno0.6%go.modDispute
CriticalGHSA-p77j-4mvh-x3m3 source
CVE-2026-33186
google.golang.org/grpc
golang
v1.69.41.79.3✓vulnerable code in binaryno1.6%go.modDispute
CriticalGHSA-2w6w-674q-4c4q source
CVE-2026-33937
handlebars
npm
4.7.84.7.9✓—no1.9%package-lock.jsonDispute
CriticalGHSA-8r5x-fm3f-whwj source
CVE-2026-106446
handlebars
npm
4.7.84.7.10✓—no0.8%package-lock.jsonDispute
CriticalGHSA-p8wg-vrv2-v86f source
CVE-2026-106445
handlebars
npm
4.7.84.7.10✓—no0.6%package-lock.jsonDispute
CriticalGHSA-2943-5xfg-gq5f source
CVE-2026-77414
jsonata
npm
2.0.52.2.1✓—no0.6%package-lock.jsonDispute
CriticalGHSA-66mm-25pp-rfff source
CVE-2026-77415
jsonata
npm
2.0.52.2.1✓—no0.9%package-lock.jsonDispute
CriticalGHSA-8gq3-vp5j-2grp source
CVE-2026-77413
jsonata
npm
2.0.52.2.0✓—no0.7%package-lock.jsonDispute
CriticalGHSA-r275-fr43-pm7q source
CVE-2026-28292
simple-git
npm
3.24.03.32.3✓—no1.3%package-lock.jsonDispute
CriticalGHSA-x6jw-m9v5-85vh source
CVE-2026-102828
simple-git
npm
3.24.04.0.1✓—no0.4%package-lock.jsonDispute
CriticalGHSA-23hp-3jrh-7fpw source
CVE-2026-59873
tar
npm
6.2.17.5.19✓—no0.6%package-lock.jsonDispute
HighGHSA-x8mw-p69m-v3mx source
CVE-2026-19481
@fastify/busboy
npm
2.1.13.2.1✓—no0.5%actions/installer/package-lock.jsonDispute
HighGHSA-45rx-2jwx-cxfr source
CVE-2026-59892
@opentelemetry/propagator-jaeger
npm
1.24.12.9.0✓—no0.6%package-lock.jsonDispute
HighGHSA-7q85-xj36-vmfc source
CVE-2026-77301
adm-zip
npm
0.5.120.6.1✓—no0.6%package-lock.jsonDispute
HighGHSA-8238-w5pm-2374 sourceadm-zip
npm
0.5.120.6.1✓—no—package-lock.jsonDispute
HighGHSA-j5f4-cc29-5x44 source
CVE-2026-102282
adm-zip
npm
0.5.120.6.1✓—no0.2%package-lock.jsonDispute
HighGHSA-rcw4-f5rp-g42v sourceadm-zip
npm
0.5.120.6.1✓—no—package-lock.jsonDispute
HighGHSA-xcpc-8h2w-3j85 source
CVE-2026-39244
adm-zip
npm
0.5.120.6.0✓—no0.8%package-lock.jsonDispute
HighGHSA-3jxr-9vmj-r5cp source
CVE-2026-13149
brace-expansion
npm
1.1.111.1.16✓—no0.4%package-lock.jsonDispute
HighGHSA-3jxr-9vmj-r5cp source
CVE-2026-13149
brace-expansion
npm
2.0.12.1.2✓—no0.4%actions/installer/package-lock.jsonDispute
HighGHSA-6j4f-fj2g-mc7p source
CVE-2026-102276
brace-expansion
npm
1.1.111.1.19✓—no0.5%package-lock.jsonDispute
HighGHSA-6j4f-fj2g-mc7p source
CVE-2026-102276
brace-expansion
npm
2.0.12.1.5✓—no0.5%actions/installer/package-lock.jsonDispute
HighGHSA-mh99-v99m-4gvg source
CVE-2026-14257
brace-expansion
npm
1.1.111.1.17✓—no0.6%package-lock.jsonDispute
HighGHSA-mh99-v99m-4gvg source
CVE-2026-14257
brace-expansion
npm
2.0.12.1.3✓—no0.6%actions/installer/package-lock.jsonDispute
HighGHSA-qhr7-859c-m2p7 source
CVE-2026-102278
brace-expansion
npm
1.1.111.1.20✓—no0.5%package-lock.jsonDispute
HighGHSA-qhr7-859c-m2p7 source
CVE-2026-102278
brace-expansion
npm
2.0.12.1.6✓—no0.5%package-lock.jsonDispute
HighGHSA-rgw5-rvv9-x895 source
CVE-2026-69152
brace-expansion
npm
1.1.111.1.18✓—no0.6%package-lock.jsonDispute
HighGHSA-rgw5-rvv9-x895 source
CVE-2026-69152
brace-expansion
npm
2.0.12.1.4✓—no0.6%actions/installer/package-lock.jsonDispute
HighGHSA-73wf-gq98-2v4g source
CVE-2026-73088
browserslist
npm
4.21.34.28.7✓—no0.7%actions/installer/package-lock.jsonDispute
HighGHSA-c83g-rgw3-j3cx source
CVE-2026-73089
browserslist
npm
4.21.34.28.7✓—no0.7%actions/installer/package-lock.jsonDispute
HighGHSA-3xgq-45jj-v275 source
CVE-2024-21538
cross-spawn
npm
7.0.37.0.5✓—no0.9%actions/installer/package-lock.jsonDispute
HighGHSA-7pqw-9j4j-h8q3 source
CVE-2026-19693
extract-zip
npm
2.0.1no fix listed✓—no0.5%package-lock.jsonDispute
HighGHSA-jmr9-qjv8-65gv source
CVE-2026-56876
extract-zip
npm
2.0.1no fix listed✓—no0.5%package-lock.jsonDispute
HighGHSA-8gc5-j5rx-235r source
CVE-2026-33036
fast-xml-parser
npm
4.2.54.5.5✓—no0.6%package-lock.jsonDispute
HighGHSA-jmr7-xgp7-cmfj source
CVE-2026-26278
fast-xml-parser
npm
4.2.54.5.4✓—no0.9%package-lock.jsonDispute
HighGHSA-25h7-pfq9-p65f source
CVE-2026-32141
flatted
npm
3.2.73.4.0✓—no0.8%actions/installer/package-lock.jsonDispute
HighGHSA-rf6f-7fwh-wjgh source
CVE-2026-33228
flatted
npm
3.2.73.4.2✓—no0.8%actions/installer/package-lock.jsonDispute
HighGHSA-p436-gjf2-799p source
CVE-2025-15558
github.com/docker/cli
golang
v27.5.0+incompatible29.2.0✓module in binaryno0.5%go.modDispute
HighGHSA-78h2-9frx-2jm8 source
CVE-2026-34986
github.com/go-jose/go-jose/v4
golang
v4.0.54.1.4✓vulnerable code in binaryno0.7%go.modDispute
HighGHSA-mgcc-cww5-fp2q source
CVE-2026-116587
github.com/go-jose/go-jose/v4
golang
v4.0.54.1.6✓vulnerable code not in binaryno0.4%go.modDispute
HighGHSA-259r-337f-4rfw source
CVE-2026-63209
github.com/klauspost/compress
golang
v1.17.111.18.7✓module in binaryno0.6%go.modDispute
HighGHSA-f5mr-q85p-6hh6 source
CVE-2026-49478
github.com/sigstore/fulcio
golang
v1.6.51.8.6✓module in binaryno0.3%go.modDispute
HighGHSA-f83f-xpx7-ffpw source
CVE-2025-66506
github.com/sigstore/fulcio
golang
v1.6.51.8.3✓module in binaryno0.2%go.modDispute
HighGHSA-47q9-m4ww-924m source
CVE-2026-48702
github.com/sigstore/rekor
golang
v1.3.81.5.2✓vulnerable code in binaryno0.5%go.modDispute
HighGHSA-4qg8-fj49-pxjh source
CVE-2025-66564
github.com/sigstore/timestamp-authority
golang
v1.2.22.0.3✓vulnerable code in binaryno0.4%go.modDispute
HighGHSA-5j98-mcp5-4vw2 source
CVE-2025-64756
glob
npm
10.3.1210.5.0✓—no3.1%actions/installer/package-lock.jsonDispute
HighGHSA-5j98-mcp5-4vw2 source
CVE-2025-64756
glob
npm
10.3.1510.5.0✓—no3.1%package-lock.jsonDispute
HighGHSA-q4h4-gmj2-qvw2 source
CVE-2026-46597
golang.org/x/crypto
golang
v0.36.00.52.0✓vulnerable code in binaryno0.5%go.modDispute
HighGHSA-w879-237q-wc7r source
CVE-2026-39829
golang.org/x/crypto
golang
v0.36.00.52.0✓vulnerable code in binaryno0.5%go.modDispute
HighGO-2025-4116 source
CVE-2025-47913
golang.org/x/crypto
golang
v0.36.00.43.0✓module in binaryno0.7%go.modDispute
HighGO-2026-6303 source
CVE-2026-56854
golang.org/x/crypto
golang
v0.36.00.55.0✓package in binaryno0.4%go.modDispute
HighGO-2026-6354 source
CVE-2026-78662
golang.org/x/crypto
golang
v0.36.00.56.0✓package in binaryno0.4%go.modDispute
HighGO-2026-6355 source
CVE-2026-56855
golang.org/x/crypto
golang
v0.36.00.56.0✓package in binaryno0.5%go.modDispute
HighGO-2026-6179 source
CVE-2026-56865
golang.org/x/mod
golang
v0.25.00.40.0✓module in binaryno0.1%go.modDispute
HighGO-2026-6180 source
CVE-2026-56864
golang.org/x/mod
golang
v0.25.00.40.0✓module in binaryno0.3%go.modDispute
HighGO-2026-4918 source
CVE-2026-33814
golang.org/x/net
golang
v0.38.00.53.0✓vulnerable code in binaryno0.8%go.modDispute
HighGO-2026-5026 source
CVE-2026-39821
golang.org/x/net
golang
v0.38.00.55.0✓vulnerable code in binaryno1.8%go.modDispute
HighGO-2026-5942 source
CVE-2026-46600
golang.org/x/net
golang
v0.38.00.56.0✓module in binaryno0.5%go.modDispute
HighGO-2026-6603 source
CVE-2026-78659
golang.org/x/net
golang
v0.38.00.60.0✓vulnerable code in binaryno0.6%go.modDispute
HighGO-2026-6610 source
CVE-2026-78660
golang.org/x/net
golang
v0.38.00.60.0✓vulnerable code in binaryno0.4%go.modDispute
HighGO-2026-6611 source
CVE-2026-78669
golang.org/x/net
golang
v0.38.00.60.0✓vulnerable code in binaryno0.6%go.modDispute
HighGO-2026-6617 source
CVE-2026-97032
golang.org/x/net
golang
v0.38.00.60.0✓vulnerable code in binaryno0.5%go.modDispute
HighGO-2026-5970 source
CVE-2026-56852
golang.org/x/text
golang
v0.23.00.39.0✓package in binaryno0.5%go.modDispute
HighGO-2026-6629 source
CVE-2026-56851
golang.org/x/text
golang
v0.23.00.41.0✓module in binaryno0.5%go.modDispute
HighGHSA-2v4p-qf9q-27wj source
CVE-2026-84445
google.golang.org/grpc
golang
v1.69.41.82.2✓vulnerable code in binaryno0.6%go.modDispute
HighGHSA-hrxh-6v49-42gf sourcegoogle.golang.org/grpc
golang
v1.69.41.82.1✓vulnerable code in binaryno—go.modDispute
HighGHSA-vp52-pcj8-j9qc source
CVE-2026-84304
google.golang.org/grpc
golang
v1.69.41.83.1✓vulnerable code in binaryno0.6%go.modDispute
HighGHSA-3mfm-83xf-c92r source
CVE-2026-33938
handlebars
npm
4.7.84.7.9✓—no0.7%package-lock.jsonDispute
HighGHSA-9cx6-37pm-9jff source
CVE-2026-33939
handlebars
npm
4.7.84.7.9✓—no0.6%package-lock.jsonDispute
HighGHSA-xhpv-hc6g-r9c6 source
CVE-2026-33940
handlebars
npm
4.7.84.7.9✓—no0.7%package-lock.jsonDispute
HighGHSA-xjpj-3mr7-gcpf source
CVE-2026-33941
handlebars
npm
4.7.84.7.9✓—no0.3%package-lock.jsonDispute
HighGHSA-mwp4-54f8-5fhr source
CVE-2026-69192
ip-address
npm
9.0.510.3.1✓—no0.5%package-lock.jsonDispute
HighGHSA-2883-xcg3-v3hh source
CVE-2026-84375
js-yaml
npm
3.14.13.15.2✓—no0.5%package-lock.jsonDispute
HighGHSA-2883-xcg3-v3hh source
CVE-2026-84375
js-yaml
npm
4.1.04.3.2✓—no0.5%actions/installer/package-lock.jsonDispute
HighGHSA-52cp-r559-cp3m source
CVE-2026-59869
js-yaml
npm
3.14.13.15.0✓—no0.6%package-lock.jsonDispute
HighGHSA-52cp-r559-cp3m source
CVE-2026-59869
js-yaml
npm
4.1.04.3.0✓—no0.6%package-lock.jsonDispute
HighGHSA-5p4m-2wfm-xmqj sourcejs-yaml
npm
3.14.13.15.1✓—no—package-lock.jsonDispute
HighGHSA-5p4m-2wfm-xmqj sourcejs-yaml
npm
4.1.04.3.1✓—no—package-lock.jsonDispute
HighGHSA-86vw-mfpg-wwv9 source
CVE-2026-52746
jsonata
npm
2.0.52.2.0✓—no0.7%package-lock.jsonDispute
HighGHSA-869p-cjfg-cm3x source
CVE-2025-65945
jws
npm
4.0.04.0.1✓—no0.2%package-lock.jsonDispute
HighGHSA-22p9-wv53-3rq4 source
CVE-2026-48801
linkify-it
npm
5.0.05.0.1✓—no0.4%package-lock.jsonDispute
HighGHSA-v245-v573-v5vm source
CVE-2026-59887
linkify-it
npm
5.0.05.0.2✓—no0.5%package-lock.jsonDispute
HighGHSA-r5fr-rjxr-66jc source
CVE-2026-4800
lodash
npm
4.17.214.18.0✓—no2.8%package-lock.jsonDispute
HighGHSA-gfr2-rv44-r23c source
CVE-2026-111758
markdown-it
npm
14.1.014.3.3✓—no0.5%package-lock.jsonDispute
HighGHSA-r7fv-28h4-cvq7 source
CVE-2026-111759
markdown-it
npm
14.1.014.3.2✓—no0.6%package-lock.jsonDispute
HighGHSA-23c5-xmqv-rm74 source
CVE-2026-27904
minimatch
npm
3.1.23.1.4✓—no0.5%package-lock.jsonDispute
HighGHSA-23c5-xmqv-rm74 source
CVE-2026-27904
minimatch
npm
9.0.29.0.7✓—no0.5%package-lock.jsonDispute
HighGHSA-23c5-xmqv-rm74 source
CVE-2026-27904
minimatch
npm
9.0.39.0.7✓—no0.5%actions/installer/package-lock.jsonDispute
HighGHSA-23c5-xmqv-rm74 source
CVE-2026-27904
minimatch
npm
9.0.49.0.7✓—no0.5%package-lock.jsonDispute
HighGHSA-3ppc-4f35-3m26 source
CVE-2026-26996
minimatch
npm
3.1.23.1.3✓—no0.6%actions/installer/package-lock.jsonDispute
HighGHSA-3ppc-4f35-3m26 source
CVE-2026-26996
minimatch
npm
9.0.29.0.6✓—no0.6%package-lock.jsonDispute
HighGHSA-3ppc-4f35-3m26 source
CVE-2026-26996
minimatch
npm
9.0.39.0.6✓—no0.6%actions/installer/package-lock.jsonDispute
HighGHSA-3ppc-4f35-3m26 source
CVE-2026-26996
minimatch
npm
9.0.49.0.6✓—no0.6%actions/installer/package-lock.jsonDispute
HighGHSA-7r86-cg39-jmmj source
CVE-2026-27903
minimatch
npm
3.1.23.1.3✓—no0.6%actions/installer/package-lock.jsonDispute
HighGHSA-7r86-cg39-jmmj source
CVE-2026-27903
minimatch
npm
9.0.29.0.7✓—no0.6%package-lock.jsonDispute
HighGHSA-7r86-cg39-jmmj source
CVE-2026-27903
minimatch
npm
9.0.39.0.7✓—no0.6%actions/installer/package-lock.jsonDispute
HighGHSA-7r86-cg39-jmmj source
CVE-2026-27903
minimatch
npm
9.0.49.0.7✓—no0.6%package-lock.jsonDispute
HighGHSA-28wg-ghj8-5hjv source
CVE-2026-67214
nanoid
npm
3.3.73.3.16✓—no0.3%package-lock.jsonDispute
HighGHSA-2v37-7h3g-55p8 source
CVE-2026-67213
nanoid
npm
3.3.73.3.18✓—no0.3%package-lock.jsonDispute
HighGHSA-xwg4-73v4-xw9w source
CVE-2026-73086
nanoid
npm
3.3.73.3.12✓—no0.3%package-lock.jsonDispute
HighGHSA-8qff-qr5q-5pr8 source
CVE-2025-47934
openpgp
npm
5.11.15.11.3✓—no0.6%package-lock.jsonDispute
HighGHSA-c2c7-rcm5-vvqj source
CVE-2026-33671
picomatch
npm
2.3.12.3.2✓—no0.4%package-lock.jsonDispute
HighGHSA-858h-whjf-mvg5 source
CVE-2026-102827
simple-git
npm
3.24.04.0.0✓—no0.6%package-lock.jsonDispute
HighGHSA-g4wm-2vf7-vfgr source
CVE-2026-102826
simple-git
npm
3.24.04.0.0✓—no0.5%package-lock.jsonDispute
HighGHSA-hffm-xvc3-vprc source
CVE-2026-6951
simple-git
npm
3.24.03.36.0✓—no0.9%package-lock.jsonDispute
HighGHSA-jcxm-m3jx-f287 source
CVE-2026-28291
simple-git
npm
3.24.03.32.0✓—no0.8%package-lock.jsonDispute
HighGHSA-34x7-hfp2-rc4v source
CVE-2026-24842
tar
npm
6.2.17.5.7✓—no0.6%package-lock.jsonDispute
HighGHSA-83g3-92jg-28cx source
CVE-2026-26960
tar
npm
6.2.17.5.8✓—no0.3%package-lock.jsonDispute
HighGHSA-8qq5-rm4j-mr97 source
CVE-2026-23745
tar
npm
6.2.17.5.3✓—no0.4%package-lock.jsonDispute
HighGHSA-8x88-c5mf-7j5w source
CVE-2026-59874
tar
npm
6.2.17.5.18✓—no0.4%package-lock.jsonDispute
HighGHSA-9ppj-qmqm-q256 source
CVE-2026-31802
tar
npm
6.2.17.5.11✓—no0.3%package-lock.jsonDispute
HighGHSA-qffp-2rhf-9h96 source
CVE-2026-29786
tar
npm
6.2.17.5.10✓—no0.5%package-lock.jsonDispute
HighGHSA-r292-9mhp-454m source
CVE-2026-73566
tar
npm
6.2.17.5.21✓—no0.5%package-lock.jsonDispute
HighGHSA-r6q2-hw4h-h46w source
CVE-2026-23950
tar
npm
6.2.17.5.4✓—no0.3%package-lock.jsonDispute
HighGHSA-vj76-c3g6-qr5v source
CVE-2025-59343
tar-fs
npm
2.1.32.1.4✓—no0.6%package-lock.jsonDispute
HighGHSA-4qx8-w7c3-pj3p source
CVE-2026-114141
toml
npm
2.3.65.0.1✓—no0.5%package-lock.jsonDispute
HighGHSA-82x6-q7mm-w9cf source
CVE-2026-77465
toml
npm
2.3.64.2.0✓—no0.6%package-lock.jsonDispute
HighGHSA-9j65-hcg3-gc64 source
CVE-2026-114143
toml
npm
2.3.65.0.1✓—no0.5%package-lock.jsonDispute
HighGHSA-9qmh-m7c6-f92p source
CVE-2026-114144
toml
npm
2.3.65.0.1✓—no0.4%package-lock.jsonDispute
HighGHSA-v5mp-jgw5-2x6j source
CVE-2026-63376
toml
npm
2.3.64.1.2✓—no0.7%package-lock.jsonDispute
HighGHSA-qpx9-hpmf-5gmw source
CVE-2026-27601
underscore
npm
1.13.61.13.8✓—no1.1%package-lock.jsonDispute
HighGHSA-2m5v-pch6-74hx source
CVE-2026-109383
undici
npm
5.29.06.29.1✓—no0.2%actions/installer/package-lock.jsonDispute
HighGHSA-qrxm-fqhp-jwvm source
CVE-2026-87018
undici
npm
5.29.06.29.1✓—no0.2%actions/installer/package-lock.jsonDispute
HighGHSA-v9p9-hfj2-hcw8 source
CVE-2026-2229
undici
npm
5.29.06.24.0✓—no0.9%actions/installer/package-lock.jsonDispute
HighGHSA-vrm6-8vpv-qv8q source
CVE-2026-1526
undici
npm
5.29.06.24.0✓—no1.2%actions/installer/package-lock.jsonDispute
HighGHSA-vxpw-j846-p89q source
CVE-2026-12151
undici
npm
5.29.06.27.0✓—no0.8%actions/installer/package-lock.jsonDispute
HighGHSA-mrhx-c7xc-m3w5 source
CVE-2023-54404
zod
npm
3.23.84.6.6✓—no—package-lock.jsonDispute
MediumGHSA-968p-4wvh-cqc8 source
CVE-2025-27789
@babel/runtime
npm
7.21.07.26.10✓—no0.6%actions/installer/package-lock.jsonDispute
MediumGHSA-968p-4wvh-cqc8 source
CVE-2025-27789
@babel/runtime-corejs3
npm
7.24.57.26.10✓—no0.6%package-lock.jsonDispute
MediumGHSA-gxm5-99cw-xjw9 source
CVE-2026-74866
@fastify/busboy
npm
2.1.13.2.2✓—no0.3%actions/installer/package-lock.jsonDispute
MediumGHSA-8988-4f7v-96qf source
CVE-2026-54285
@opentelemetry/core
npm
1.24.12.8.0✓—no0.4%package-lock.jsonDispute
MediumGHSA-c6fg-446q-cg94 sourceadm-zip
npm
0.5.120.6.1✓—no—package-lock.jsonDispute
MediumGHSA-p634-w6r4-rjp2 sourceadm-zip
npm
0.5.120.6.1✓—no—package-lock.jsonDispute
MediumGHSA-vwc7-r8mq-g2x9 source
CVE-2026-76845
adm-zip
npm
0.5.12no fix listed✓—no0.2%package-lock.jsonDispute
MediumGHSA-2g4f-4pwh-qvx6 source
CVE-2025-69873
ajv
npm
6.12.66.14.0✓—no0.5%actions/installer/package-lock.jsonDispute
MediumGHSA-378v-28hj-76wf source
CVE-2026-2739
bn.js
npm
4.12.04.12.3✓—no0.5%package-lock.jsonDispute
MediumGHSA-f886-m6hf-6m8v source
CVE-2026-33750
brace-expansion
npm
1.1.111.1.13✓—no0.4%package-lock.jsonDispute
MediumGHSA-f886-m6hf-6m8v source
CVE-2026-33750
brace-expansion
npm
2.0.12.0.3✓—no0.4%actions/installer/package-lock.jsonDispute
MediumGHSA-q2hr-2g5m-vwhr source
CVE-2026-102277
brace-expansion
npm
1.1.111.1.21✓—no0.4%actions/installer/package-lock.jsonDispute
MediumGHSA-q2hr-2g5m-vwhr source
CVE-2026-102277
brace-expansion
npm
2.0.12.1.7✓—no0.4%actions/installer/package-lock.jsonDispute
MediumGHSA-gh4j-gqv2-49f6 source
CVE-2026-41650
fast-xml-parser
npm
4.2.55.7.0✓—no0.2%package-lock.jsonDispute
MediumGHSA-jp2q-39xq-3w4g source
CVE-2026-33349
fast-xml-parser
npm
4.2.54.5.5✓—no0.5%package-lock.jsonDispute
MediumGHSA-685w-q87j-wqw3 source
CVE-2026-85747
github.com/docker/distribution
golang
v2.8.3+incompatibleno fix listed✓vulnerable code not in binaryno0.2%go.modDispute
MediumGHSA-4w3g-jfj2-cw2q source
CVE-2026-116585
github.com/go-jose/go-jose/v4
golang
v4.0.54.1.5✓vulnerable code not in binaryno0.3%go.modDispute
MediumGHSA-vvm8-gf78-28g4 source
CVE-2026-116586
github.com/go-jose/go-jose/v4
golang
v4.0.54.1.5✓vulnerable code not in binaryno0.3%go.modDispute
MediumGHSA-pmwq-pjrm-6p5r sourcegithub.com/in-toto/in-toto-golang
golang
v0.9.00.11.0✓module in binaryno—go.modDispute
MediumGHSA-whqx-f9j3-ch6m source
CVE-2026-22703
github.com/sigstore/cosign/v2
golang
v2.4.12.6.2✓vulnerable code in binaryno0.1%go.modDispute
MediumGO-2026-5694 source
CVE-2026-39395, GHSA-w6c6-c85g-mmv6
github.com/sigstore/cosign/v2
golang
v2.4.12.6.3✓vulnerable code in binaryno0.2%go.modDispute
MediumGHSA-59jp-pj84-45mr source
CVE-2026-22772
github.com/sigstore/fulcio
golang
v1.6.51.8.5✓module in binaryno0.2%go.modDispute
MediumGHSA-273p-m2cw-6833 source
CVE-2026-23831
github.com/sigstore/rekor
golang
v1.3.81.5.0✓vulnerable code in binaryno0.4%go.modDispute
MediumGHSA-4c4x-jm2x-pf9j source
CVE-2026-24117
github.com/sigstore/rekor
golang
v1.3.81.5.0✓vulnerable code in binaryno0.4%go.modDispute
MediumGHSA-fcv2-xgw5-pqxf source
CVE-2026-24137
github.com/sigstore/sigstore
golang
v1.8.121.10.4✓vulnerable code in binaryno0.4%go.modDispute
MediumGHSA-9vcr-p3rj-q5q6 source
CVE-2026-49834
github.com/sigstore/sigstore-go
golang
v0.6.21.2.0✓vulnerable code in binaryno0.2%go.modDispute
MediumGHSA-9c54-x2g4-v92j source
CVE-2026-49835
github.com/sigstore/timestamp-authority
golang
v1.2.2no fix listed✓vulnerable code in binaryno0.7%go.modDispute
MediumGO-2026-5763 source
CVE-2026-39984, GHSA-xm5m-wgh2-rrg3
github.com/sigstore/timestamp-authority
golang
v1.2.2no fix listed✓vulnerable code in binaryno0.1%go.modDispute
MediumGHSA-846p-jg2w-w324 source
CVE-2026-23991
github.com/theupdateframework/go-tuf/v2
golang
v2.0.12.3.1✓vulnerable code in binaryno0.6%go.modDispute
MediumGHSA-fphv-w9fq-2525 source
CVE-2026-23992
github.com/theupdateframework/go-tuf/v2
golang
v2.0.12.3.1✓vulnerable code in binaryno0.2%go.modDispute
MediumGHSA-jqc5-w2xx-5vq4 source
CVE-2026-24686
github.com/theupdateframework/go-tuf/v2
golang
v2.0.12.4.1✓vulnerable code in binaryno0.2%go.modDispute
MediumGHSA-3g3m-2fjr-6pw4 source
CVE-2026-118773
glob
npm
10.3.1214.0.2✓—no0.4%actions/installer/package-lock.jsonDispute
MediumGHSA-3g3m-2fjr-6pw4 source
CVE-2026-118773
glob
npm
10.3.1514.0.2✓—no0.4%package-lock.jsonDispute
MediumGHSA-cp6g-7hqx-qxhp source
CVE-2026-2303
go.mongodb.org/mongo-driver
golang
v1.14.01.17.7✓module in binaryno0.3%go.modDispute
MediumGHSA-45gg-vh54-h5m9 source
CVE-2026-39828
golang.org/x/crypto
golang
v0.36.00.52.0✓package in binaryno0.4%go.modDispute
MediumGHSA-78mq-xcr3-xm33 source
CVE-2026-39835
golang.org/x/crypto
golang
v0.36.00.52.0✓package in binaryno0.5%go.modDispute
MediumGHSA-9m57-25v3-79x9 source
CVE-2026-46598
golang.org/x/crypto
golang
v0.36.00.52.0✓module in binaryno0.4%go.modDispute
MediumGHSA-f6x5-jh6r-wrfv source
CVE-2025-47914
golang.org/x/crypto
golang
v0.36.00.45.0✓module in binaryno0.5%go.modDispute
MediumGHSA-j5w8-q4qc-rx2x source
CVE-2025-58181
golang.org/x/crypto
golang
v0.36.00.45.0✓package in binaryno0.6%go.modDispute
MediumGHSA-qpw4-5x99-6vjp source
CVE-2026-39827
golang.org/x/crypto
golang
v0.36.00.52.0✓package in binaryno0.3%go.modDispute
MediumGHSA-5cv4-jp36-h3mw source
CVE-2026-25680
golang.org/x/net
golang
v0.38.00.55.0✓module in binaryno0.3%go.modDispute
MediumGO-2026-4440 source
CVE-2025-47911
golang.org/x/net
golang
v0.38.00.45.0✓module in binaryno0.6%go.modDispute
MediumGO-2026-4441 source
CVE-2025-58190
golang.org/x/net
golang
v0.38.00.45.0✓module in binaryno0.5%go.modDispute
MediumGO-2026-5025 source
CVE-2026-42506
golang.org/x/net
golang
v0.38.00.55.0✓module in binaryno0.2%go.modDispute
MediumGO-2026-5027 source
CVE-2026-42502
golang.org/x/net
golang
v0.38.00.55.0✓module in binaryno0.2%go.modDispute
MediumGO-2026-5029 source
CVE-2026-25681
golang.org/x/net
golang
v0.38.00.55.0✓module in binaryno0.2%go.modDispute
MediumGO-2026-5030 source
CVE-2026-27136
golang.org/x/net
golang
v0.38.00.55.0✓module in binaryno0.2%go.modDispute
MediumGHSA-qc2q-p7wx-3px3 source
CVE-2026-84303
google.golang.org/grpc
golang
v1.69.41.83.1✓module in binaryno0.3%go.modDispute
MediumGHSA-2qvq-rjwj-gvw9 source
CVE-2026-33916
handlebars
npm
4.7.84.7.9✓—no0.3%package-lock.jsonDispute
MediumGHSA-7rx3-28cr-v5wh sourcehandlebars
npm
4.7.84.7.9✓—no—package-lock.jsonDispute
MediumGHSA-xw65-4hp5-5hc7 source
CVE-2026-106444
handlebars
npm
4.7.84.7.10✓—no0.3%package-lock.jsonDispute
MediumGHSA-h3mg-xc3c-68pw source
CVE-2026-101911
ip-address
npm
9.0.510.7.1✓—no0.4%package-lock.jsonDispute
MediumGHSA-j6r3-76f7-8jcv source
CVE-2026-101912
ip-address
npm
9.0.510.7.1✓—no0.4%package-lock.jsonDispute
MediumGHSA-rpw4-54j3-4h4q source
CVE-2026-101913
ip-address
npm
9.0.510.5.1✓—no0.4%package-lock.jsonDispute
MediumGHSA-rxp7-6hxx-x8q5 source
CVE-2026-111997
ip-address
npm
9.0.510.7.4✓—no0.3%package-lock.jsonDispute
MediumGHSA-v2v4-37r5-5v8g source
CVE-2026-42338
ip-address
npm
9.0.510.1.1✓—no0.5%package-lock.jsonDispute
MediumGHSA-h67p-54hq-rp68 source
CVE-2026-53550
js-yaml
npm
3.14.13.15.0✓—no0.4%package-lock.jsonDispute
MediumGHSA-h67p-54hq-rp68 source
CVE-2026-53550
js-yaml
npm
4.1.04.2.0✓—no0.4%package-lock.jsonDispute
MediumGHSA-mh29-5h37-fv8m source
CVE-2025-64718
js-yaml
npm
3.14.13.14.2✓—no0.4%package-lock.jsonDispute
MediumGHSA-mh29-5h37-fv8m source
CVE-2025-64718
js-yaml
npm
4.1.04.1.1✓—no0.4%actions/installer/package-lock.jsonDispute
MediumGHSA-663r-x48j-fg8p source
CVE-2026-12208
jsonata
npm
2.0.52.2.1✓—no0.3%package-lock.jsonDispute
MediumGHSA-f23m-r3pf-42rh source
CVE-2026-2950
lodash
npm
4.17.214.18.0✓—no0.3%package-lock.jsonDispute
MediumGHSA-xxjr-mmjv-4gpg source
CVE-2025-13465
lodash
npm
4.17.214.17.23✓—no1.8%package-lock.jsonDispute
MediumGHSA-253c-mchw-3w2r sourcemarkdown-it
npm
14.1.014.3.1✓—no—package-lock.jsonDispute
MediumGHSA-38c4-r59v-3vqw source
CVE-2026-2327
markdown-it
npm
14.1.014.1.1✓—no0.7%package-lock.jsonDispute
MediumGHSA-6v5v-wf23-fmfq source
CVE-2026-48988
markdown-it
npm
14.1.014.2.0✓—no0.4%package-lock.jsonDispute
MediumGHSA-952p-6rrq-rcjv source
CVE-2024-4067
micromatch
npm
4.0.54.0.8✓—no1.4%actions/installer/package-lock.jsonDispute
MediumGHSA-g3hv-75wg-m249 source
CVE-2026-118764
minimatch
npm
3.1.211.0.1✓—no0.3%package-lock.jsonDispute
MediumGHSA-g3hv-75wg-m249 source
CVE-2026-118764
minimatch
npm
9.0.211.0.1✓—no0.3%package-lock.jsonDispute
MediumGHSA-g3hv-75wg-m249 source
CVE-2026-118764
minimatch
npm
9.0.311.0.1✓—no0.3%actions/installer/package-lock.jsonDispute
MediumGHSA-g3hv-75wg-m249 source
CVE-2026-118764
minimatch
npm
9.0.411.0.1✓—no0.3%package-lock.jsonDispute
MediumGHSA-4p3w-j4w9-5jqw source
CVE-2026-17495
moment
npm
2.30.12.31.0✓—no0.5%package-lock.jsonDispute
MediumGHSA-mwcw-c2x4-8c55 source
CVE-2024-55565
nanoid
npm
3.3.73.3.8✓—no0.7%package-lock.jsonDispute
MediumGHSA-3v7f-55p6-f55p source
CVE-2026-33672
picomatch
npm
2.3.12.3.2✓—no0.4%actions/installer/package-lock.jsonDispute
MediumGHSA-4mjr-xmp4-gh2g source
CVE-2026-82417
qs
npm
6.12.16.16.0✓—no0.4%package-lock.jsonDispute
MediumGHSA-6pq8-jhm2-2vcw source
CVE-2026-110816
qs
npm
6.12.16.16.1✓—no0.4%package-lock.jsonDispute
MediumGHSA-6rw7-vpxm-498p source
CVE-2025-15284
qs
npm
6.12.16.14.1✓—no0.4%package-lock.jsonDispute
MediumGHSA-q8mj-m7cp-5q26 source
CVE-2026-8723
qs
npm
6.12.16.15.2✓—no0.4%package-lock.jsonDispute
MediumGHSA-6hxr-mr5r-9836 source
CVE-2026-68499
re2
npm
1.20.111.25.2✓—no0.2%package-lock.jsonDispute
MediumGHSA-8hcv-x26h-mcgp source
CVE-2026-71430
re2
npm
1.20.111.25.1✓—no0.2%package-lock.jsonDispute
MediumGHSA-ff84-5f28-78qj source
CVE-2026-67550
re2
npm
1.20.111.25.2✓—no0.2%package-lock.jsonDispute
MediumGHSA-j4r3-hg7j-8chg source
CVE-2026-71498
re2
npm
1.20.111.26.1✓—no0.2%package-lock.jsonDispute
MediumGHSA-36j9-mx87-2cff sourcerenovate
npm
37.374.140.33.0✓—no—package-lock.jsonDispute
MediumGHSA-3f44-xw83-3pmg sourcerenovate
npm
37.374.140.33.0✓—no—package-lock.jsonDispute
MediumGHSA-fr4j-65pv-gjjj sourcerenovate
npm
37.374.140.33.0✓—no—package-lock.jsonDispute
MediumGHSA-pfq2-hh62-7m96 sourcerenovate
npm
37.374.142.68.5✓—no—package-lock.jsonDispute
MediumGHSA-gvwx-54wh-qm9j source
CVE-2026-59875
tar
npm
6.2.17.5.17✓—no0.4%package-lock.jsonDispute
MediumGHSA-vmf3-w455-68vh source
CVE-2026-53655
tar
npm
6.2.17.5.16✓—no0.2%package-lock.jsonDispute
MediumGHSA-w8wr-v893-vjvp source
CVE-2026-59871
tar
npm
6.2.17.5.18✓—no0.6%package-lock.jsonDispute
MediumGHSA-2mjp-6q6p-2qxm source
CVE-2026-1525
undici
npm
5.29.06.24.0✓—no0.5%actions/installer/package-lock.jsonDispute
MediumGHSA-4992-7rv2-5pvq source
CVE-2026-1527
undici
npm
5.29.06.24.0✓—no0.3%actions/installer/package-lock.jsonDispute
MediumGHSA-8xcm-r25x-g524 source
CVE-2026-16728
undici
npm
5.29.06.28.0✓—no0.3%actions/installer/package-lock.jsonDispute
MediumGHSA-9fm3-97px-rjf6 source
CVE-2026-109932
undici
npm
5.29.06.29.1✓—no0.3%actions/installer/package-lock.jsonDispute
MediumGHSA-g9mf-h72j-4rw9 source
CVE-2026-22036
undici
npm
5.29.06.23.0✓—no0.5%actions/installer/package-lock.jsonDispute
MediumGHSA-m8rv-5g2x-5cg5 source
CVE-2026-15157
undici
npm
5.29.06.28.0✓—no0.3%actions/installer/package-lock.jsonDispute
MediumGHSA-p88m-4jfj-68fv source
CVE-2026-9679
undici
npm
5.29.06.27.0✓—no0.3%actions/installer/package-lock.jsonDispute
MediumGHSA-v3r7-h72x-cjcm source
CVE-2026-16729
undici
npm
5.29.06.28.0✓—no0.3%actions/installer/package-lock.jsonDispute
MediumGHSA-w5hq-g745-h8pq source
CVE-2026-41907
uuid
npm
9.0.111.1.1✓—no0.4%package-lock.jsonDispute
LowGHSA-6475-r3vj-m8vf source@smithy/config-resolver
npm
2.2.04.4.0✓—no—package-lock.jsonDispute
LowGHSA-6475-r3vj-m8vf source@smithy/config-resolver
npm
3.0.04.4.0✓—no—package-lock.jsonDispute
LowGHSA-v6h2-p8h4-qcjw source
CVE-2025-5889
brace-expansion
npm
1.1.111.1.12✓—no0.6%package-lock.jsonDispute
LowGHSA-v6h2-p8h4-qcjw source
CVE-2025-5889
brace-expansion
npm
2.0.12.0.2✓—no0.6%actions/installer/package-lock.jsonDispute
LowGHSA-gcqx-w48m-w2h4 source
CVE-2026-93753
deepmerge
npm
4.3.1no fix listed✓—no0.5%package-lock.jsonDispute
LowGHSA-73rr-hh4g-fpgx source
CVE-2026-24001
diff
npm
5.2.05.2.2✓—no0.6%package-lock.jsonDispute
LowGHSA-fj3w-jwp8-x2g3 source
CVE-2026-27942
fast-xml-parser
npm
4.2.54.5.4✓—no0.5%package-lock.jsonDispute
LowGO-2026-4529 source
CVE-2026-24122, GHSA-wfqv-66vq-46rm
github.com/sigstore/cosign/v2
golang
v2.4.1no fix listed✓vulnerable code in binaryno0.2%go.modDispute
LowGHSA-wqqc-jjcq-vfxm source
CVE-2026-54787
github.com/sigstore/sigstore-go
golang
v0.6.21.2.1✓vulnerable code in binaryno0.1%go.modDispute
LowGO-2026-5024 source
CVE-2026-39824
golang.org/x/sys
golang
v0.31.00.44.0✓vulnerable code not in binaryno0.1%go.modDispute
LowGHSA-442j-39wm-28r2 sourcehandlebars
npm
4.7.84.7.9✓—no—package-lock.jsonDispute
LowGHSA-vfgh-jcmw-g37q source
CVE-2026-111766
markdown-it
npm
14.1.014.3.3✓—no0.4%package-lock.jsonDispute
LowGHSA-w7fw-mjwx-w883 source
CVE-2026-2391
qs
npm
6.12.16.14.2✓—no0.5%package-lock.jsonDispute
LowGHSA-35p6-xmwp-9g52 source
CVE-2026-6733
undici
npm
5.29.06.27.0✓—no0.2%actions/installer/package-lock.jsonDispute
LowGHSA-g8m3-5g58-fq7m source
CVE-2026-11525
undici
npm
5.29.06.27.0✓—no0.2%actions/installer/package-lock.jsonDispute
LowGHSA-r53p-7pc4-xj5r source
CVE-2026-18540
undici
npm
5.29.06.28.1✓—no0.3%actions/installer/package-lock.jsonDispute
UnknownGO-2026-4316 source
GHSA-mqqf-5wvp-8fh8
github.com/go-chi/chi
golang
v4.1.2+incompatibleno fix listed✓vulnerable code in binaryno—go.modDispute
UnknownGO-2026-5932 sourcegolang.org/x/crypto
golang
v0.36.0no fix listed✓vulnerable code in binaryno—go.modDispute
UnknownGO-2026-6860 source
CVE-2026-78661
golang.org/x/net
golang
v0.38.00.62.0✓module in binaryno0.2%go.modDispute
UnknownGO-2026-6866 source
CVE-2026-97045
golang.org/x/net
golang
v0.38.00.62.0✓module in binaryno0.2%go.modDispute

Second opinion: OSV-Scanner

OSV-Scanner found 289 advisories in the same files; 253 of Grype's matches are confirmed by it (marked ✓ above). 3 advisories were reported only by OSV-Scanner.

Reported only by OSV-Scanner (3)
AdvisoryPackageVersionSeverity
CVE-2026-102554, GHSA-xxph-c9ww-hj94com.google.guava:guava33.2.1-jreHigh
CVE-2025-67030, GHSA-6fmv-xxpf-w3cworg.codehaus.plexus:plexus-utils3.5.1Unknown
CVE-2026-114142, GHSA-h895-cgqg-jf52toml2.3.6High

Vulnerable code in the released binary

govulncheck analyzed slsa-verifier-linux-amd64 from slsa-verifier-linux-amd64, built with go1.23.5. 79 advisories have vulnerable functions compiled into it: 52 in the Go standard library and 27 in dependencies.

Of the 75 Go advisories Grype matched in the source, 5 are in modules or code paths that are not in the shipped binary.

The Go linker removes unreachable functions, so a vulnerable function in the binary is likely reachable. Standard-library advisories are fixed by rebuilding with a newer Go release.

AdvisoryModuleVersionFixed inSummary
GO-2025-3503
CVE-2025-22870, GHSA-qxp5-gwg8-xv66
stdlibv1.23.5v1.23.7HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net
GO-2025-3563
CVE-2025-22871
stdlibv1.23.5v1.23.8Request smuggling due to acceptance of invalid chunked data in net/http
GO-2025-3751
CVE-2025-4673
stdlibv1.23.5v1.23.10Sensitive headers not cleared on cross-origin redirect in net/http
GO-2025-3956
CVE-2025-47906, CVE-2025-47906
stdlibv1.23.5v1.23.12Unexpected paths returned from LookPath in os/exec
GO-2025-4006
CVE-2025-61725, CVE-2025-61725
stdlibv1.23.5v1.24.8Excessive CPU consumption in ParseAddress in net/mail
GO-2025-4007
CVE-2025-58187, CVE-2025-58187
stdlibv1.23.5v1.24.9Quadratic complexity when checking name constraints in crypto/x509
GO-2025-4008
CVE-2025-58189, CVE-2025-58189
stdlibv1.23.5v1.24.8ALPN negotiation error contains attacker controlled information in crypto/tls
GO-2025-4009
CVE-2025-61723, CVE-2025-61723
stdlibv1.23.5v1.24.8Quadratic complexity when parsing some invalid inputs in encoding/pem
GO-2025-4010
CVE-2025-47912, CVE-2025-47912
stdlibv1.23.5v1.24.8Insufficient validation of bracketed IPv6 hostnames in net/url
GO-2025-4011
CVE-2025-58185, CVE-2025-58185
stdlibv1.23.5v1.24.8Parsing DER payload can cause memory exhaustion in encoding/asn1
GO-2025-4012
CVE-2025-58186, CVE-2025-58186
stdlibv1.23.5v1.24.8Lack of limit when parsing cookies can cause memory exhaustion in net/http
GO-2025-4013
CVE-2025-58188, CVE-2025-58188
stdlibv1.23.5v1.24.8Panic when validating certificates with DSA public keys in crypto/x509
GO-2025-4015
CVE-2025-61724, CVE-2025-61724
stdlibv1.23.5v1.24.8Excessive CPU consumption in Reader.ReadResponse in net/textproto
GO-2025-4155
CVE-2025-61729, CVE-2025-61729
stdlibv1.23.5v1.24.11Excessive resource consumption when printing error string for host certificate validation in crypto/x509
GO-2025-4175
CVE-2025-61727
stdlibv1.23.5v1.24.11Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509
GO-2026-4337
CVE-2025-68121
stdlibv1.23.5v1.24.13Unexpected session resumption in crypto/tls
GO-2026-4340
CVE-2025-61730, CVE-2025-61730
stdlibv1.23.5v1.24.12Handshake messages may be processed at the incorrect encryption level in crypto/tls
GO-2026-4341
CVE-2025-61726, CVE-2025-61726
stdlibv1.23.5v1.24.12Memory exhaustion in query parameter parsing in net/url
GO-2026-4601
CVE-2026-25679
stdlibv1.23.5v1.25.8Incorrect parsing of IPv6 host literals in net/url
GO-2026-4602
CVE-2026-27139
stdlibv1.23.5v1.25.8FileInfo can escape from a Root in os
GO-2026-4603
CVE-2026-27142
stdlibv1.23.5v1.25.8URLs in meta content attribute actions are not escaped in html/template
GO-2026-4865
CVE-2026-32289
stdlibv1.23.5v1.25.9JsBraceDepth Context Tracking Bugs (XSS) in html/template
GO-2026-4870
CVE-2026-32283
stdlibv1.23.5v1.25.9Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls
GO-2026-4918
CVE-2026-33814
stdlibv1.23.5v1.25.10Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
GO-2026-4946
CVE-2026-32281
stdlibv1.23.5v1.25.9Inefficient policy validation in crypto/x509
GO-2026-4947
CVE-2026-32280
stdlibv1.23.5v1.25.9Unexpected work during chain building in crypto/x509
GO-2026-4971
CVE-2026-39836
stdlibv1.23.5v1.25.10Panic in Dial and LookupPort when handling NUL byte on Windows in net
GO-2026-4977
CVE-2026-42499
stdlibv1.23.5v1.25.10Quadratic string concatenation in consumePhrase in net/mail
GO-2026-4980
CVE-2026-39826
stdlibv1.23.5v1.25.10Escaper bypass leads to XSS in html/template
GO-2026-4981
CVE-2026-33811
stdlibv1.23.5v1.25.10Crash when handling long CNAME response in net
GO-2026-4982
CVE-2026-39823
stdlibv1.23.5v1.25.10Bypass of meta content URL escaping causes XSS in html/template
GO-2026-4986
CVE-2026-39820
stdlibv1.23.5v1.25.10Quadratic string concatentation in consumeComment in net/mail
GO-2026-5026
CVE-2026-39821
stdlibv1.23.5v1.25.13Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
GO-2026-5037
CVE-2026-27145
stdlibv1.23.5v1.25.11Inefficient candidate hostname parsing in crypto/x509
GO-2026-5039
CVE-2026-42507
stdlibv1.23.5v1.25.11Arbitrary inputs are included in errors without any escaping in net/textproto
GO-2026-5856
CVE-2026-42505
stdlibv1.23.5v1.25.12Invoking Encrypted Client Hello privacy leak in crypto/tls
GO-2026-5972
CVE-2026-33818
stdlibv1.23.5v1.25.13Enforce maximum recursion depth in encoding/asn1
GO-2026-6088
CVE-2026-56859
stdlibv1.23.5v1.25.13Add recursion depth guard during decode in encoding/xml
GO-2026-6090
CVE-2026-56862
stdlibv1.23.5v1.25.13Limit handshake messages we are willing to accept post-handshake in crypto/tls
GO-2026-6091
CVE-2026-56858
stdlibv1.23.5v1.25.13Fix Javascript regexp context tracking in html/template
GO-2026-6218
CVE-2026-56860
stdlibv1.23.5v1.25.13Avoid quadratic complexity in resolvePath in net/url
GO-2026-6599
CVE-2026-94448
stdlibv1.23.5v1.26.9Reset context tracking on consecutive template expressions in html/template
GO-2026-6600
CVE-2026-97030
stdlibv1.23.5v1.26.9Recognize yield as regexp preceder keyword in html/template
GO-2026-6603
CVE-2026-78659
stdlibv1.23.5v1.26.9HTTP/2 server memory exhaustion due to Trailer headers in net/http
GO-2026-6605
CVE-2026-56866
stdlibv1.23.5v1.26.9HTTP/1 client connection desynchronization after CONNECT rejection in net/http
GO-2026-6607
CVE-2026-97031
stdlibv1.23.5v1.26.9Reject malformed ECH outer extension references in crypto/tls
GO-2026-6608
CVE-2026-94440
stdlibv1.23.5v1.26.9Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart
GO-2026-6610
CVE-2026-78660
stdlibv1.23.5v1.26.9HTTP/2 transport accepts malformed framing-related headers in net/http
GO-2026-6611
CVE-2026-78669
stdlibv1.23.5v1.26.9Excessive CPU consumption from repeated initial window changes in net/http
GO-2026-6612
CVE-2026-78663
stdlibv1.23.5v1.26.9Double flow control refund on HTTP/2 server streams in net/http
GO-2026-6613
CVE-2026-94439
stdlibv1.23.5v1.26.9HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http
GO-2026-6809
CVE-2026-111943
stdlibv1.23.5v1.26.10Distrust compromised intermediate certificates in crypto/x509
GO-2026-4316
GHSA-mqqf-5wvp-8fh8
github.com/go-chi/chiv4.1.2+incompatible—Open redirect vulnerability in the RedirectSlashes middleware in github.com/go-chi/chi
GO-2026-4945
CVE-2026-34986, GHSA-78h2-9frx-2jm8
github.com/go-jose/go-jose/v4v4.0.5v4.1.4Go JOSE Panics in JWE decryption in github.com/go-jose/go-jose
GO-2026-4309
CVE-2026-22703, GHSA-whqx-f9j3-ch6m
github.com/sigstore/cosign/v2v2.4.1v2.6.2Cosign verification accepts any valid Rekor entry under certain conditions in github.com/sigstore/cosign
GO-2026-4529
CVE-2026-24122, GHSA-wfqv-66vq-46rm
github.com/sigstore/cosign/v2v2.4.1—Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigstore/cosign
GO-2026-5694
CVE-2026-39395, GHSA-w6c6-c85g-mmv6
github.com/sigstore/cosign/v2v2.4.1v2.6.3Cosign's verify-blob-attestation reports false positive when payload parsing fails in github.com/sigstore/cosign
GO-2026-4354
CVE-2026-23831, GHSA-273p-m2cw-6833
github.com/sigstore/rekorv1.3.8v1.5.0Rekor's COSE v0.0.1 entry type nil pointer dereference in Canonicalize via empty Message in github.com/sigstore/rekor
GO-2026-4355
CVE-2026-24117, GHSA-4c4x-jm2x-pf9j
github.com/sigstore/rekorv1.3.8v1.5.0Rekor affected by Server-Side Request Forgery (SSRF) via provided public key URL in github.com/sigstore/rekor
GO-2026-5778
CVE-2026-48702, GHSA-47q9-m4ww-924m
github.com/sigstore/rekorv1.3.8v1.5.2Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic in github.com/sigstore/rekor
GO-2026-4358
CVE-2026-24137, GHSA-fcv2-xgw5-pqxf
github.com/sigstore/sigstorev1.8.12v1.10.4Sigstore legacy TUF client allows for arbitrary file writes with target cache path traversal in github.com/sigstore/sigstore
GO-2026-5952
CVE-2026-49834, GHSA-9vcr-p3rj-q5q6
github.com/sigstore/sigstore-gov0.6.2v1.2.0sigstore-go has a multi-log threshold bypass via single compromised log in github.com/sigstore/sigstore-go
GO-2026-6162
CVE-2026-54787, GHSA-wqqc-jjcq-vfxm
github.com/sigstore/sigstore-gov0.6.2v1.2.1sigstore-go fails to check signature timestamps against a signing key's validity period in github.com/sigstore/sigstore-go
GO-2025-4192
CVE-2025-66564, GHSA-4qg8-fj49-pxjh
github.com/sigstore/timestamp-authorityv1.2.2—Sigstore Timestamp Authority allocates excessive memory during request parsing in github.com/sigstore/timestamp-authority
GO-2026-5763
CVE-2026-39984, GHSA-xm5m-wgh2-rrg3
github.com/sigstore/timestamp-authorityv1.2.2—Sigstore Timestamp Authority has Improper Certificate Validation in verifier in github.com/sigstore/timestamp-authority
GO-2026-5851
CVE-2026-49835, GHSA-9c54-x2g4-v92j
github.com/sigstore/timestamp-authorityv1.2.2—Sigstore Timestamp Authority has OOM due to unbounded metric label cardinality in github.com/sigstore/timestamp-authority
GO-2026-4348
CVE-2026-23991, GHSA-846p-jg2w-w324
github.com/theupdateframework/go-tuf/v2v2.0.1v2.3.1Client DoS via malformed server response in github.com/theupdateframework/go-tuf
GO-2026-4349
CVE-2026-23992, GHSA-fphv-w9fq-2525
github.com/theupdateframework/go-tuf/v2v2.0.1v2.3.1Improper validattion of configured threshold for delegations in github.com/theupdateframework/go-tuf
GO-2026-4377
CVE-2026-24686, GHSA-jqc5-w2xx-5vq4
github.com/theupdateframework/go-tuf/v2v2.0.1v2.4.1Path traversal in TAP 4 multirepo client allows arbitrary file write via repo names in github.com/theupdateframework/go-tuf
GO-2026-5013
CVE-2026-46597
golang.org/x/cryptov0.36.0v0.52.0Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh
GO-2026-5018
CVE-2026-39829
golang.org/x/cryptov0.36.0v0.52.0Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh
GO-2026-5019
CVE-2026-39831
golang.org/x/cryptov0.36.0v0.52.0Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh
GO-2026-5020
CVE-2026-39834
golang.org/x/cryptov0.36.0v0.52.0Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh
GO-2026-5932
golang.org/x/cryptov0.36.0—The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues
GO-2026-6617
CVE-2026-97032
golang.org/x/netv0.38.0v0.60.0HTTP/2 server crash due to HPACK encoder race in net/http
GO-2026-4762
CVE-2026-33186, GHSA-p77j-4mvh-x3m3
google.golang.org/grpcv1.69.4v1.79.3Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc
GO-2026-6061
GHSA-hrxh-6v49-42gf
google.golang.org/grpcv1.69.4v1.82.1Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc
GO-2026-6348
CVE-2026-84304, GHSA-vp52-pcj8-j9qc
google.golang.org/grpcv1.69.4v1.83.1Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc
GO-2026-6443
CVE-2026-84445, GHSA-2v4p-qf9q-27wj
google.golang.org/grpcv1.69.4v1.82.2Server panic via missing authority or Host headers in google.golang.org/grpc

Release integrity

Verdict: verified for slsa-verifier-linux-amd64. The download matches GitHub's recorded digest.

CheckResultDetail
SLSA provenanceverified

Verified means a signature, provenance, or attestation was checked against an identity in slsa-framework/slsa-verifier's own GitHub Actions workflows.

Repository security (OpenSSF Scorecard)

No Scorecard result yet (the OpenSSF public dataset entry is 66 days old (limit 30); the Scorecard CLI fallback was skipped because this shard's weekly budget was used). Results are added as the weekly budget allows.

GitHub Actions workflow audit (zizmor)

10 potential issues in 15 workflow files at this release: 2 high, 3 medium, 5 low severity (medium or high confidence only). Each is a pattern to review, not a confirmed vulnerability.

All findings
SeverityRuleLocationNote
Highdangerous-triggers
use of fundamentally insecure workflow trigger
.github/workflows/e2e.schedule.cli.yml:2this workflow
Highunpinned-uses
unpinned action reference
.github/workflows/release.yml:36this job
Mediumexcessive-permissions
overly broad permissions
.github/workflows/e2e.schedule.installer.yml:13uses read-all permissions
Mediumexcessive-permissions
overly broad permissions
.github/workflows/release.yml:13uses read-all permissions
Mediumexcessive-permissions
overly broad permissions
.github/workflows/release.yml:59this job
Lowself-repository
use GitHub's dedicated self-repository syntax
.github/workflows/e2e.schedule.installer.yml:86this step
Lowself-repository
use GitHub's dedicated self-repository syntax
.github/workflows/e2e.schedule.installer.yml:122this step
Lowself-repository
use GitHub's dedicated self-repository syntax
.github/workflows/e2e.schedule.installer.yml:149this step
Lowself-repository
use GitHub's dedicated self-repository syntax
.github/workflows/e2e.schedule.installer.yml:163this step
Lowself-repository
use GitHub's dedicated self-repository syntax
.github/workflows/e2e.schedule.installer.yml:178this step

Dependencies (1198)

By ecosystem: npm 1066, golang 106, github 16, maven 6, pypi 3, unknown 1.

Licenses (as declared in the SBOM): unknown 1178, MIT 16, Python-2.0 1, ISC 1, Apache-2.0 1, AGPL-3.0-only 1.

npm (1066)
NameVersionLicenseDeclared in
@aashutoshrathi/word-wrap1.2.6actions/installer/package-lock.json
@actions/core1.11.1actions/installer/package-lock.json
@actions/exec1.1.1actions/installer/package-lock.json
@actions/github6.0.1actions/installer/package-lock.json
@actions/http-client2.2.1actions/installer/package-lock.json
@actions/io1.1.3actions/installer/package-lock.json
@actions/tool-cache2.0.2actions/installer/package-lock.json
@arcanis/slice-ansi1.1.1package-lock.json
@aws-crypto/crc323.0.0package-lock.json
@aws-crypto/crc32c3.0.0package-lock.json
@aws-crypto/ie11-detection3.0.0package-lock.json
@aws-crypto/sha1-browser3.0.0package-lock.json
@aws-crypto/sha256-browser3.0.0package-lock.json
@aws-crypto/sha256-js3.0.0package-lock.json
@aws-crypto/supports-web-crypto3.0.0package-lock.json
@aws-crypto/util3.0.0package-lock.json
@aws-sdk/client-codecommit3.565.0package-lock.json
@aws-sdk/client-cognito-identity3.565.0package-lock.json
@aws-sdk/client-ec23.565.0package-lock.json
@aws-sdk/client-ecr3.565.0package-lock.json
@aws-sdk/client-rds3.565.0package-lock.json
@aws-sdk/client-s33.565.0package-lock.json
@aws-sdk/client-sso3.556.0package-lock.json
@aws-sdk/client-sso3.575.0package-lock.json
@aws-sdk/client-sso3.576.0package-lock.json
@aws-sdk/client-sso-oidc3.575.0package-lock.json
@aws-sdk/client-sso-oidc3.576.0package-lock.json
@aws-sdk/client-sts3.565.0package-lock.json
@aws-sdk/client-sts3.575.0package-lock.json
@aws-sdk/client-sts3.576.0package-lock.json
@aws-sdk/core3.556.0package-lock.json
@aws-sdk/core3.575.0package-lock.json
@aws-sdk/core3.576.0package-lock.json
@aws-sdk/credential-provider-cognito-identity3.565.0package-lock.json
@aws-sdk/credential-provider-env3.535.0package-lock.json
@aws-sdk/credential-provider-env3.575.0package-lock.json
@aws-sdk/credential-provider-http3.552.0package-lock.json
@aws-sdk/credential-provider-http3.575.0package-lock.json
@aws-sdk/credential-provider-ini3.565.0package-lock.json
@aws-sdk/credential-provider-ini3.575.0package-lock.json
@aws-sdk/credential-provider-ini3.576.0package-lock.json
@aws-sdk/credential-provider-node3.565.0package-lock.json
@aws-sdk/credential-provider-node3.575.0package-lock.json
@aws-sdk/credential-provider-node3.576.0package-lock.json
@aws-sdk/credential-provider-process3.535.0package-lock.json
@aws-sdk/credential-provider-process3.575.0package-lock.json
@aws-sdk/credential-provider-sso3.565.0package-lock.json
@aws-sdk/credential-provider-sso3.575.0package-lock.json
@aws-sdk/credential-provider-sso3.576.0package-lock.json
@aws-sdk/credential-provider-web-identity3.565.0package-lock.json
@aws-sdk/credential-provider-web-identity3.575.0package-lock.json
@aws-sdk/credential-providers3.565.0package-lock.json
@aws-sdk/middleware-bucket-endpoint3.535.0package-lock.json
@aws-sdk/middleware-expect-continue3.535.0package-lock.json
@aws-sdk/middleware-flexible-checksums3.535.0package-lock.json
@aws-sdk/middleware-host-header3.535.0package-lock.json
@aws-sdk/middleware-host-header3.575.0package-lock.json
@aws-sdk/middleware-location-constraint3.535.0package-lock.json
@aws-sdk/middleware-logger3.535.0package-lock.json
@aws-sdk/middleware-logger3.575.0package-lock.json
@aws-sdk/middleware-recursion-detection3.535.0package-lock.json
@aws-sdk/middleware-recursion-detection3.575.0package-lock.json
@aws-sdk/middleware-sdk-ec23.556.0package-lock.json
@aws-sdk/middleware-sdk-rds3.556.0package-lock.json
@aws-sdk/middleware-sdk-s33.556.0package-lock.json
@aws-sdk/middleware-signing3.556.0package-lock.json
@aws-sdk/middleware-ssec3.537.0package-lock.json
@aws-sdk/middleware-user-agent3.540.0package-lock.json
@aws-sdk/middleware-user-agent3.575.0package-lock.json
@aws-sdk/region-config-resolver3.535.0package-lock.json
@aws-sdk/region-config-resolver3.575.0package-lock.json
@aws-sdk/signature-v4-multi-region3.556.0package-lock.json
@aws-sdk/token-providers3.565.0package-lock.json
@aws-sdk/token-providers3.575.0package-lock.json
@aws-sdk/types3.535.0package-lock.json
@aws-sdk/types3.575.0package-lock.json
@aws-sdk/util-arn-parser3.535.0package-lock.json
@aws-sdk/util-endpoints3.540.0package-lock.json
@aws-sdk/util-endpoints3.575.0package-lock.json
@aws-sdk/util-format-url3.535.0package-lock.json
@aws-sdk/util-locate-window3.568.0package-lock.json
@aws-sdk/util-user-agent-browser3.535.0package-lock.json
@aws-sdk/util-user-agent-browser3.575.0package-lock.json
@aws-sdk/util-user-agent-node3.535.0package-lock.json
@aws-sdk/util-user-agent-node3.575.0package-lock.json
@aws-sdk/util-utf8-browser3.259.0package-lock.json
@aws-sdk/xml-builder3.535.0package-lock.json
@babel/code-frame7.24.2package-lock.json
@babel/helper-validator-identifier7.24.5package-lock.json
@babel/highlight7.24.5package-lock.json
@babel/runtime7.21.0actions/installer/package-lock.json
@babel/runtime-corejs37.24.5package-lock.json
@breejs/later4.2.0package-lock.json
@cdktf/hcl2json0.20.7package-lock.json
@eslint-community/eslint-utils4.4.0actions/installer/package-lock.json
@eslint-community/regexpp4.10.0actions/installer/package-lock.json
@eslint/eslintrc2.1.4actions/installer/package-lock.json
@eslint/js8.57.0actions/installer/package-lock.json
@fastify/busboy2.1.1actions/installer/package-lock.json
@github/browserslist-config1.0.0actions/installer/package-lock.json
@gwhitney/detect-indent7.0.1package-lock.json
@humanwhocodes/config-array0.11.14actions/installer/package-lock.json
@humanwhocodes/module-importer1.0.1actions/installer/package-lock.json
@humanwhocodes/object-schema2.0.3actions/installer/package-lock.json
@isaacs/cliui8.0.2actions/installer/package-lock.json
@kwsites/file-exists1.1.1package-lock.json
@kwsites/promise-deferred1.1.1package-lock.json
@nodelib/fs.scandir2.1.5actions/installer/package-lock.json
@nodelib/fs.stat2.0.5actions/installer/package-lock.json
@nodelib/fs.walk1.2.8actions/installer/package-lock.json
@npmcli/agent2.2.2package-lock.json
@npmcli/fs3.1.1package-lock.json
@octokit/auth-token4.0.0actions/installer/package-lock.json
@octokit/core5.1.0actions/installer/package-lock.json
@octokit/core5.2.0package-lock.json
@octokit/endpoint9.0.6MITactions/installer/package-lock.json
@octokit/graphql7.0.2actions/installer/package-lock.json
@octokit/graphql7.1.0package-lock.json
@octokit/openapi-types20.0.0actions/installer/package-lock.json
@octokit/openapi-types23.0.1MITactions/installer/package-lock.json
@octokit/openapi-types24.2.0MITactions/installer/package-lock.json
@octokit/plugin-paginate-rest11.4.4-cjs.2MITpackage-lock.json
@octokit/plugin-paginate-rest9.2.2actions/installer/package-lock.json
@octokit/plugin-request-log4.0.1package-lock.json
@octokit/plugin-rest-endpoint-methods10.4.1actions/installer/package-lock.json
@octokit/plugin-rest-endpoint-methods13.3.2-cjs.1MITpackage-lock.json
@octokit/request8.4.1MITactions/installer/package-lock.json
@octokit/request-error5.1.1MITactions/installer/package-lock.json
@octokit/rest20.1.2MITpackage-lock.json
@octokit/types12.6.0actions/installer/package-lock.json
@octokit/types13.10.0MITactions/installer/package-lock.json
@octokit/types13.8.0MITactions/installer/package-lock.json
@one-ini/wasm0.1.1package-lock.json
@opentelemetry/api1.8.0package-lock.json
@opentelemetry/api-logs0.51.1package-lock.json
@opentelemetry/context-async-hooks1.24.1package-lock.json
@opentelemetry/core1.24.1package-lock.json
@opentelemetry/exporter-trace-otlp-http0.51.1package-lock.json
@opentelemetry/instrumentation0.51.1package-lock.json
@opentelemetry/instrumentation-bunyan0.38.0package-lock.json
@opentelemetry/instrumentation-http0.51.1package-lock.json
@opentelemetry/otlp-exporter-base0.51.1package-lock.json
@opentelemetry/otlp-transformer0.51.1package-lock.json
@opentelemetry/propagator-b31.24.1package-lock.json
@opentelemetry/propagator-jaeger1.24.1package-lock.json
@opentelemetry/resources1.24.1package-lock.json
@opentelemetry/sdk-logs0.51.1package-lock.json
@opentelemetry/sdk-metrics1.24.1package-lock.json
@opentelemetry/sdk-trace-base1.24.1package-lock.json
@opentelemetry/sdk-trace-node1.24.1package-lock.json
@opentelemetry/semantic-conventions1.24.1package-lock.json
@pkgjs/parseargs0.11.0actions/installer/package-lock.json
@pkgr/core0.1.1actions/installer/package-lock.json
@pnpm/constants6.1.0package-lock.json
@pnpm/error4.0.0package-lock.json
@pnpm/graceful-fs2.0.0package-lock.json
@pnpm/read-project-manifest4.1.1package-lock.json
@pnpm/text.comments-parser1.0.0package-lock.json
@pnpm/types8.9.0package-lock.json
@pnpm/util.lex-comparator1.0.0package-lock.json
@pnpm/write-project-manifest4.1.1package-lock.json
@qnighy/marshal0.1.3package-lock.json
@redis/bloom1.2.0package-lock.json
@redis/client1.5.14package-lock.json
@redis/graph1.1.1package-lock.json
@redis/json1.0.6package-lock.json
@redis/search1.1.6package-lock.json
@redis/time-series1.0.5package-lock.json
@renovatebot/kbpgp3.0.1package-lock.json
@renovatebot/osv-offline1.5.5package-lock.json
@renovatebot/osv-offline-db1.6.0package-lock.json
@renovatebot/pep4403.0.20package-lock.json
@renovatebot/ruby-semver3.0.23package-lock.json
@seald-io/binary-search-tree1.0.3package-lock.json
@seald-io/nedb4.0.4package-lock.json
@sindresorhus/is4.6.0package-lock.json
@smithy/abort-controller2.2.0package-lock.json
@smithy/abort-controller3.0.0package-lock.json
@smithy/chunked-blob-reader2.2.0package-lock.json
@smithy/chunked-blob-reader-native2.2.0package-lock.json
@smithy/config-resolver2.2.0package-lock.json
@smithy/config-resolver3.0.0package-lock.json
@smithy/core1.4.2package-lock.json
@smithy/core2.0.1package-lock.json
@smithy/credential-provider-imds2.3.0package-lock.json
@smithy/credential-provider-imds3.0.0package-lock.json
@smithy/eventstream-codec2.2.0package-lock.json
@smithy/eventstream-serde-browser2.2.0package-lock.json
@smithy/eventstream-serde-config-resolver2.2.0package-lock.json
@smithy/eventstream-serde-node2.2.0package-lock.json
@smithy/eventstream-serde-universal2.2.0package-lock.json
@smithy/fetch-http-handler2.5.0package-lock.json
@smithy/fetch-http-handler3.0.1package-lock.json
@smithy/hash-blob-browser2.2.0package-lock.json
@smithy/hash-node2.2.0package-lock.json
@smithy/hash-node3.0.0package-lock.json
@smithy/hash-stream-node2.2.0package-lock.json
@smithy/invalid-dependency2.2.0package-lock.json
@smithy/invalid-dependency3.0.0package-lock.json
@smithy/is-array-buffer2.2.0package-lock.json
@smithy/is-array-buffer3.0.0package-lock.json
@smithy/md5-js2.2.0package-lock.json
@smithy/middleware-content-length2.2.0package-lock.json
@smithy/middleware-content-length3.0.0package-lock.json
@smithy/middleware-endpoint2.5.1package-lock.json
@smithy/middleware-endpoint3.0.0package-lock.json
@smithy/middleware-retry2.3.1package-lock.json
@smithy/middleware-retry3.0.1package-lock.json
@smithy/middleware-serde2.3.0package-lock.json
@smithy/middleware-serde3.0.0package-lock.json
@smithy/middleware-stack2.2.0package-lock.json
@smithy/middleware-stack3.0.0package-lock.json
@smithy/node-config-provider2.3.0package-lock.json
@smithy/node-config-provider3.0.0package-lock.json
@smithy/node-http-handler2.5.0package-lock.json
@smithy/node-http-handler3.0.0package-lock.json
@smithy/property-provider2.2.0package-lock.json
@smithy/property-provider3.0.0package-lock.json
@smithy/protocol-http3.3.0package-lock.json
@smithy/protocol-http4.0.0package-lock.json
@smithy/querystring-builder2.2.0package-lock.json
@smithy/querystring-builder3.0.0package-lock.json
@smithy/querystring-parser2.2.0package-lock.json
@smithy/querystring-parser3.0.0package-lock.json
@smithy/service-error-classification2.1.5package-lock.json
@smithy/service-error-classification3.0.0package-lock.json
@smithy/shared-ini-file-loader2.4.0package-lock.json
@smithy/shared-ini-file-loader3.0.0package-lock.json
@smithy/signature-v42.3.0package-lock.json
@smithy/signature-v43.0.0package-lock.json
@smithy/smithy-client2.5.1package-lock.json
@smithy/smithy-client3.0.1package-lock.json
@smithy/types2.12.0package-lock.json
@smithy/types3.0.0package-lock.json
@smithy/url-parser2.2.0package-lock.json
@smithy/url-parser3.0.0package-lock.json
@smithy/util-base642.3.0package-lock.json
@smithy/util-base643.0.0package-lock.json
@smithy/util-body-length-browser2.2.0package-lock.json
@smithy/util-body-length-browser3.0.0package-lock.json
@smithy/util-body-length-node2.3.0package-lock.json
@smithy/util-body-length-node3.0.0package-lock.json
@smithy/util-buffer-from2.2.0package-lock.json
@smithy/util-buffer-from3.0.0package-lock.json
@smithy/util-config-provider2.3.0package-lock.json
@smithy/util-config-provider3.0.0package-lock.json
@smithy/util-defaults-mode-browser2.2.1package-lock.json
@smithy/util-defaults-mode-browser3.0.1package-lock.json
@smithy/util-defaults-mode-node2.3.1package-lock.json
@smithy/util-defaults-mode-node3.0.1package-lock.json
@smithy/util-endpoints1.2.0package-lock.json
@smithy/util-endpoints2.0.0package-lock.json
@smithy/util-hex-encoding2.2.0package-lock.json
@smithy/util-hex-encoding3.0.0package-lock.json
@smithy/util-middleware2.2.0package-lock.json
@smithy/util-middleware3.0.0package-lock.json
@smithy/util-retry2.2.0package-lock.json
@smithy/util-retry3.0.0package-lock.json
@smithy/util-stream2.2.0package-lock.json
@smithy/util-stream3.0.1package-lock.json
@smithy/util-uri-escape2.2.0package-lock.json
@smithy/util-uri-escape3.0.0package-lock.json
@smithy/util-utf82.3.0package-lock.json
@smithy/util-utf83.0.0package-lock.json
@smithy/util-waiter2.2.0package-lock.json
@szmarczak/http-timer4.0.6package-lock.json
@thi.ng/api7.2.0package-lock.json
@thi.ng/arrays1.0.3package-lock.json
@thi.ng/checks2.9.11package-lock.json
@thi.ng/compare1.3.34package-lock.json
@thi.ng/equiv1.0.45package-lock.json
@thi.ng/errors1.3.4package-lock.json
@thi.ng/hex1.0.4package-lock.json
@thi.ng/random2.4.8package-lock.json
@thi.ng/zipper1.0.3package-lock.json
@types/bunyan1.8.9package-lock.json
@types/cacheable-request6.0.3package-lock.json
@types/emscripten1.39.12package-lock.json
@types/http-cache-semantics4.0.4package-lock.json
@types/jasmine4.6.4actions/installer/package-lock.json
@types/json-schema7.0.15actions/installer/package-lock.json
@types/json50.0.29actions/installer/package-lock.json
@types/keyv3.1.4package-lock.json
@types/mdast3.0.15package-lock.json
@types/minimist1.2.5package-lock.json
@types/moo0.5.5package-lock.json
@types/node18.19.33actions/installer/package-lock.json
@types/node20.12.12package-lock.json
@types/normalize-package-data2.4.4package-lock.json
@types/responselike1.0.3package-lock.json
@types/semver7.5.8actions/installer/package-lock.json
@types/shimmer1.0.5package-lock.json
@types/treeify1.0.3package-lock.json
@types/unist2.0.10package-lock.json
@types/yauzl2.10.3package-lock.json
@typescript-eslint/eslint-plugin7.5.0actions/installer/package-lock.json
@typescript-eslint/parser7.5.0actions/installer/package-lock.json
@typescript-eslint/scope-manager7.5.0actions/installer/package-lock.json
@typescript-eslint/type-utils7.5.0actions/installer/package-lock.json
@typescript-eslint/types7.5.0actions/installer/package-lock.json
@typescript-eslint/typescript-estree7.5.0actions/installer/package-lock.json
@typescript-eslint/utils7.5.0actions/installer/package-lock.json
@typescript-eslint/visitor-keys7.5.0actions/installer/package-lock.json
@ungap/structured-clone1.2.0actions/installer/package-lock.json
@vercel/ncc0.38.1actions/installer/package-lock.json
@yarnpkg/core4.0.5package-lock.json
@yarnpkg/fslib3.1.0package-lock.json
@yarnpkg/libzip3.1.0package-lock.json
@yarnpkg/parsers3.0.2package-lock.json
@yarnpkg/shell4.0.2package-lock.json
abbrev2.0.0package-lock.json
acorn8.11.3actions/installer/package-lock.json
acorn-import-attributes1.9.5package-lock.json
acorn-jsx5.3.2actions/installer/package-lock.json
adm-zip0.5.12package-lock.json
agent-base7.1.1package-lock.json
agentkeepalive4.5.0package-lock.json
aggregate-error3.1.0package-lock.json
ajv6.12.6actions/installer/package-lock.json
ansi-red0.1.1package-lock.json
ansi-regex5.0.1actions/installer/package-lock.json
ansi-regex6.0.1actions/installer/package-lock.json
ansi-styles3.2.1package-lock.json
ansi-styles4.3.0actions/installer/package-lock.json
ansi-styles6.2.1actions/installer/package-lock.json
ansi-wrap0.1.0package-lock.json
argparse1.0.10package-lock.json
argparse2.0.1Python-2.0actions/installer/package-lock.json
aria-query5.3.0actions/installer/package-lock.json
array-buffer-byte-length1.0.1package-lock.json
array-includes3.1.6actions/installer/package-lock.json
array-union2.1.0actions/installer/package-lock.json
array.prototype.flat1.3.0actions/installer/package-lock.json
array.prototype.flatmap1.3.1actions/installer/package-lock.json
arraybuffer.prototype.slice1.0.3package-lock.json
arrify1.0.1package-lock.json
asn1.js5.4.1package-lock.json
ast-types-flow0.0.7actions/installer/package-lock.json
auth-header1.0.0package-lock.json
autolinker4.0.0package-lock.json
available-typed-arrays1.0.5actions/installer/package-lock.json
available-typed-arrays1.0.7package-lock.json
aws41.12.0package-lock.json
axe-core4.6.3actions/installer/package-lock.json
axobject-query3.1.1actions/installer/package-lock.json
azure-devops-node-api13.0.0package-lock.json
backslash0.2.0package-lock.json
bail1.0.5package-lock.json
balanced-match1.0.2actions/installer/package-lock.json
base64-js1.5.1package-lock.json
before-after-hook2.2.3actions/installer/package-lock.json
better-sqlite39.6.0package-lock.json
bignumber.js9.1.2package-lock.json
bindings1.5.0package-lock.json
bl4.1.0package-lock.json
bn1.0.5package-lock.json
bn.js4.12.0package-lock.json
boolbase1.0.0package-lock.json
boolean3.2.0package-lock.json
bowser2.11.0package-lock.json
brace-expansion1.1.11actions/installer/package-lock.json
brace-expansion2.0.1actions/installer/package-lock.json
braces3.0.3actions/installer/package-lock.json
browserslist4.21.3actions/installer/package-lock.json
buffer5.7.1package-lock.json
buffer-crc320.2.13package-lock.json
buffer-equal-constant-time1.0.1package-lock.json
buffer-from1.1.2package-lock.json
bunyan1.8.15package-lock.json
bzip-deflate1.0.0package-lock.json
cacache18.0.3package-lock.json
cacheable-lookup5.0.4package-lock.json
cacheable-request7.0.4package-lock.json
call-bind1.0.2actions/installer/package-lock.json
call-bind1.0.7package-lock.json
callsites3.1.0actions/installer/package-lock.json
camelcase5.3.1package-lock.json
camelcase-keys6.2.2package-lock.json
caniuse-lite1.0.30001387actions/installer/package-lock.json
chalk2.4.2package-lock.json
chalk3.0.0package-lock.json
chalk4.1.2actions/installer/package-lock.json
changelog-filename-regex2.0.1package-lock.json
character-entities1.2.4package-lock.json
character-entities-legacy1.1.4package-lock.json
character-reference-invalid1.1.4package-lock.json
chownr1.1.4package-lock.json
chownr2.0.0package-lock.json
ci-info3.9.0package-lock.json
cjs-module-lexer1.3.1package-lock.json
clean-git-ref2.0.1package-lock.json
clean-stack2.2.0package-lock.json
clipanion4.0.0-rc.3package-lock.json
clone-response1.0.3package-lock.json
cluster-key-slot1.1.2package-lock.json
coffee-script1.12.7package-lock.json
color-convert1.9.3package-lock.json
color-convert2.0.1actions/installer/package-lock.json
color-name1.1.3package-lock.json
color-name1.1.4actions/installer/package-lock.json
commander11.1.0package-lock.json
commander12.0.0package-lock.json
concat-map0.0.1actions/installer/package-lock.json
concat-stream1.6.2package-lock.json
conventional-commits-detector1.0.3package-lock.json
core-js-pure3.37.1package-lock.json
core-util-is1.0.3package-lock.json
cron-parser4.9.0package-lock.json
cross-spawn7.0.3actions/installer/package-lock.json
css-select5.1.0package-lock.json
css-what6.1.0package-lock.json
damerau-levenshtein1.0.8actions/installer/package-lock.json
dargs7.0.0package-lock.json
data-view-buffer1.0.1package-lock.json
data-view-byte-length1.0.1package-lock.json
data-view-byte-offset1.0.0package-lock.json
debug2.6.9actions/installer/package-lock.json
debug3.2.7actions/installer/package-lock.json
debug4.3.4actions/installer/package-lock.json
decamelize1.2.0package-lock.json
decamelize-keys1.1.1package-lock.json
decompress-response6.0.0package-lock.json
deep-equal2.2.0actions/installer/package-lock.json
deep-equal2.2.3package-lock.json
deep-extend0.6.0package-lock.json
deep-is0.1.4actions/installer/package-lock.json
deepmerge4.3.1package-lock.json
defer-to-connect2.0.1package-lock.json
define-data-property1.1.4package-lock.json
define-properties1.1.4actions/installer/package-lock.json
define-properties1.2.1package-lock.json
deprecation2.3.1actions/installer/package-lock.json
dequal2.0.3actions/installer/package-lock.json
detect-indent6.1.0package-lock.json
detect-libc2.0.3package-lock.json
detect-node2.1.0package-lock.json
diacritics-map0.1.0package-lock.json
diff5.2.0package-lock.json
dir-glob3.0.1actions/installer/package-lock.json
doctrine2.1.0actions/installer/package-lock.json
doctrine3.0.0actions/installer/package-lock.json
dom-serializer2.0.0package-lock.json
domelementtype2.3.0package-lock.json
domhandler5.0.3package-lock.json
domutils3.1.0package-lock.json
dotenv16.4.5package-lock.json
dtrace-provider0.8.8package-lock.json
eastasianwidth0.2.0actions/installer/package-lock.json
ecdsa-sig-formatter1.0.11package-lock.json
editorconfig2.0.0package-lock.json
electron-to-chromium1.4.238actions/installer/package-lock.json
email-addresses5.0.0package-lock.json
emoji-regex10.3.0package-lock.json
emoji-regex8.0.0actions/installer/package-lock.json
emoji-regex9.2.2actions/installer/package-lock.json
emojibase15.3.0package-lock.json
emojibase-regex15.3.0package-lock.json
encoding0.1.13package-lock.json
end-of-stream1.4.4package-lock.json
entities4.5.0package-lock.json
env-paths2.2.1package-lock.json
err-code2.0.3package-lock.json
error-ex1.3.2package-lock.json
es-abstract1.21.1actions/installer/package-lock.json
es-abstract1.23.3package-lock.json
es-define-property1.0.0package-lock.json
es-errors1.3.0package-lock.json
es-get-iterator1.1.3actions/installer/package-lock.json
es-object-atoms1.0.0package-lock.json
es-set-tostringtag2.0.1actions/installer/package-lock.json
es-set-tostringtag2.0.3package-lock.json
es-shim-unscopables1.0.0actions/installer/package-lock.json
es-to-primitive1.2.1actions/installer/package-lock.json
es6-error4.1.1package-lock.json
escalade3.1.1actions/installer/package-lock.json
escape-string-regexp1.0.5actions/installer/package-lock.json
escape-string-regexp4.0.0actions/installer/package-lock.json
eslint8.57.0actions/installer/package-lock.json
eslint-config-prettier8.5.0actions/installer/package-lock.json
eslint-import-resolver-node0.3.6actions/installer/package-lock.json
eslint-module-utils2.7.4actions/installer/package-lock.json
eslint-plugin-escompat3.3.3actions/installer/package-lock.json
eslint-plugin-eslint-comments3.2.0actions/installer/package-lock.json
eslint-plugin-filenames1.3.2actions/installer/package-lock.json
eslint-plugin-github4.10.2actions/installer/package-lock.json
eslint-plugin-i18n-text1.0.1actions/installer/package-lock.json
eslint-plugin-import2.26.0actions/installer/package-lock.json
eslint-plugin-jsx-a11y6.7.1actions/installer/package-lock.json
eslint-plugin-no-only-tests3.0.0actions/installer/package-lock.json
eslint-plugin-prettier5.1.3actions/installer/package-lock.json
eslint-rule-documentation1.0.23actions/installer/package-lock.json
eslint-scope7.2.2actions/installer/package-lock.json
eslint-visitor-keys3.4.3actions/installer/package-lock.json
espree9.6.1actions/installer/package-lock.json
esprima4.0.1package-lock.json
esquery1.4.2actions/installer/package-lock.json
esrecurse4.3.0actions/installer/package-lock.json
estraverse5.3.0actions/installer/package-lock.json
esutils2.0.3actions/installer/package-lock.json
eventemitter34.0.7package-lock.json
expand-range1.8.2package-lock.json
expand-template2.0.3package-lock.json
exponential-backoff3.1.1package-lock.json
extend3.0.2package-lock.json
extend-shallow2.0.1package-lock.json
extract-zip2.0.1package-lock.json
fast-deep-equal3.1.3actions/installer/package-lock.json
fast-diff1.2.0actions/installer/package-lock.json
fast-glob3.3.2actions/installer/package-lock.json
fast-json-stable-stringify2.1.0actions/installer/package-lock.json
fast-levenshtein2.0.6actions/installer/package-lock.json
fast-xml-parser4.2.5package-lock.json
fastq1.13.0actions/installer/package-lock.json
fastq1.17.1package-lock.json
fd-slicer1.1.0package-lock.json
file-entry-cache6.0.1actions/installer/package-lock.json
file-uri-to-path1.0.0package-lock.json
fill-range2.2.4package-lock.json
fill-range7.1.1actions/installer/package-lock.json
find-packages10.0.4package-lock.json
find-up4.1.0package-lock.json
find-up5.0.0actions/installer/package-lock.json
flat-cache3.0.4actions/installer/package-lock.json
flatted3.2.7actions/installer/package-lock.json
for-each0.3.3actions/installer/package-lock.json
for-in1.0.2package-lock.json
foreground-child3.1.1actions/installer/package-lock.json
fs-constants1.0.0package-lock.json
fs-extra11.2.0package-lock.json
fs-minipass2.1.0package-lock.json
fs-minipass3.0.3package-lock.json
fs.realpath1.0.0actions/installer/package-lock.json
function-bind1.1.1actions/installer/package-lock.json
function-bind1.1.2package-lock.json
function.prototype.name1.1.5actions/installer/package-lock.json
function.prototype.name1.1.6package-lock.json
functions-have-names1.2.3actions/installer/package-lock.json
gaxios6.5.0package-lock.json
gcp-metadata6.1.0package-lock.json
generic-pool3.9.0package-lock.json
get-intrinsic1.2.0actions/installer/package-lock.json
get-intrinsic1.2.4package-lock.json
get-stream5.2.0package-lock.json
get-symbol-description1.0.0actions/installer/package-lock.json
get-symbol-description1.0.2package-lock.json
git-raw-commits2.0.11package-lock.json
git-up7.0.0package-lock.json
git-url-parse14.0.0package-lock.json
github-from-package0.0.0package-lock.json
github-url-from-git1.5.0package-lock.json
glob10.3.12actions/installer/package-lock.json
glob10.3.15ISCpackage-lock.json
glob6.0.4package-lock.json
glob7.2.3actions/installer/package-lock.json
glob-parent5.1.2actions/installer/package-lock.json
glob-parent6.0.2actions/installer/package-lock.json
global-agent3.0.0package-lock.json
globals13.19.0actions/installer/package-lock.json
globalthis1.0.3actions/installer/package-lock.json
globalthis1.0.4package-lock.json
globby11.1.0actions/installer/package-lock.json
good-enough-parser1.1.23package-lock.json
google-auth-library9.10.0Apache-2.0package-lock.json
gopd1.0.1actions/installer/package-lock.json
got11.8.6package-lock.json
graceful-fs4.2.11package-lock.json
graph-data-structure3.5.0package-lock.json
grapheme-splitter1.0.4package-lock.json
graphemer1.4.0actions/installer/package-lock.json
gray-matter2.1.1package-lock.json
gtoken7.1.0package-lock.json
handlebars4.7.8package-lock.json
hard-rejection2.1.0package-lock.json
has1.0.3actions/installer/package-lock.json
has-bigints1.0.2actions/installer/package-lock.json
has-flag3.0.0package-lock.json
has-flag4.0.0actions/installer/package-lock.json
has-property-descriptors1.0.0actions/installer/package-lock.json
has-property-descriptors1.0.2package-lock.json
has-proto1.0.1actions/installer/package-lock.json
has-proto1.0.3package-lock.json
has-symbols1.0.3actions/installer/package-lock.json
has-tostringtag1.0.0actions/installer/package-lock.json
has-tostringtag1.0.2package-lock.json
hasown2.0.2package-lock.json
he1.2.0package-lock.json
hosted-git-info2.8.9package-lock.json
hosted-git-info4.1.0package-lock.json
http-cache-semantics4.1.1package-lock.json
http-proxy-agent7.0.2package-lock.json
http2-wrapper1.0.3package-lock.json
https-proxy-agent7.0.4package-lock.json
humanize-ms1.2.1package-lock.json
iced-error0.0.13package-lock.json
iced-lock1.1.0package-lock.json
iced-lock2.0.1package-lock.json
iced-runtime1.0.4package-lock.json
iced-runtime-33.0.5package-lock.json
iconv-lite0.6.3package-lock.json
ieee7541.2.1package-lock.json
ignore5.3.1actions/installer/package-lock.json
immediate3.0.6package-lock.json
import-fresh3.3.0actions/installer/package-lock.json
import-in-the-middle1.7.4package-lock.json
imurmurhash0.1.4actions/installer/package-lock.json
indent-string4.0.0package-lock.json
inflight1.0.6actions/installer/package-lock.json
inherits2.0.4actions/installer/package-lock.json
ini1.3.8package-lock.json
ini4.1.2package-lock.json
install-artifact-from-github1.3.5package-lock.json
internal-slot1.0.5actions/installer/package-lock.json
internal-slot1.0.7package-lock.json
ip-address9.0.5package-lock.json
is-alphabetical1.0.4package-lock.json
is-alphanumerical1.0.4package-lock.json
is-arguments1.1.1actions/installer/package-lock.json
is-array-buffer3.0.1actions/installer/package-lock.json
is-array-buffer3.0.4package-lock.json
is-arrayish0.2.1package-lock.json
is-bigint1.0.4actions/installer/package-lock.json
is-boolean-object1.1.2actions/installer/package-lock.json
is-buffer1.1.6package-lock.json
is-buffer2.0.5package-lock.json
is-callable1.2.7actions/installer/package-lock.json
is-core-module2.10.0actions/installer/package-lock.json
is-core-module2.13.1package-lock.json
is-data-view1.0.1package-lock.json
is-date-object1.0.5actions/installer/package-lock.json
is-decimal1.0.4package-lock.json
is-extendable0.1.1package-lock.json
is-extendable1.0.1package-lock.json
is-extglob2.1.1actions/installer/package-lock.json
is-fullwidth-code-point3.0.0actions/installer/package-lock.json
is-generator-function1.0.10package-lock.json
is-glob4.0.3actions/installer/package-lock.json
is-hexadecimal1.0.4package-lock.json
is-lambda1.0.1package-lock.json
is-map2.0.2actions/installer/package-lock.json
is-map2.0.3package-lock.json
is-negative-zero2.0.2actions/installer/package-lock.json
is-negative-zero2.0.3package-lock.json
is-number2.1.0package-lock.json
is-number4.0.0package-lock.json
is-number7.0.0actions/installer/package-lock.json
is-number-object1.0.7actions/installer/package-lock.json
is-path-inside3.0.3actions/installer/package-lock.json
is-plain-obj1.1.0package-lock.json
is-plain-obj2.1.0package-lock.json
is-plain-object2.0.4package-lock.json
is-regex1.1.4actions/installer/package-lock.json
is-set2.0.2actions/installer/package-lock.json
is-set2.0.3package-lock.json
is-shared-array-buffer1.0.2actions/installer/package-lock.json
is-shared-array-buffer1.0.3package-lock.json
is-ssh1.4.0package-lock.json
is-stream2.0.1package-lock.json
is-string1.0.7actions/installer/package-lock.json
is-symbol1.0.4actions/installer/package-lock.json
is-typed-array1.1.10actions/installer/package-lock.json
is-typed-array1.1.13package-lock.json
is-typedarray1.0.0package-lock.json
is-weakmap2.0.1actions/installer/package-lock.json
is-weakmap2.0.2package-lock.json
is-weakref1.0.2actions/installer/package-lock.json
is-weakset2.0.2actions/installer/package-lock.json
is-weakset2.0.3package-lock.json
is-windows1.0.2package-lock.json
isarray1.0.0package-lock.json
isarray2.0.5actions/installer/package-lock.json
isexe2.0.0actions/installer/package-lock.json
isexe3.1.1package-lock.json
isobject2.1.0package-lock.json
isobject3.0.1package-lock.json
jackspeak2.3.6actions/installer/package-lock.json
jasmine5.1.0actions/installer/package-lock.json
jasmine-core5.1.2actions/installer/package-lock.json
js-tokens4.0.0package-lock.json
js-yaml3.14.1package-lock.json
js-yaml4.1.0MITactions/installer/package-lock.json
jsbn1.1.0package-lock.json
json-bigint1.0.0package-lock.json
json-buffer3.0.1package-lock.json
json-dup-key-validator1.0.3package-lock.json
json-parse-even-better-errors2.3.1package-lock.json
json-schema-traverse0.4.1actions/installer/package-lock.json
json-stable-stringify-without-jsonify1.0.1actions/installer/package-lock.json
json-stringify-pretty-compact3.0.0package-lock.json
json-stringify-safe5.0.1package-lock.json
json51.0.2actions/installer/package-lock.json
json52.2.3package-lock.json
jsonata2.0.5MITpackage-lock.json
jsonc-parser3.2.1package-lock.json
jsonfile6.1.0package-lock.json
jsx-ast-utils3.3.3actions/installer/package-lock.json
jwa2.0.0package-lock.json
jws4.0.0package-lock.json
keybase-ecurve1.0.1package-lock.json
keybase-nacl1.1.4package-lock.json
keyv4.5.4package-lock.json
kind-of3.2.2package-lock.json
kind-of6.0.3package-lock.json
klona2.0.6package-lock.json
language-subtag-registry0.3.22actions/installer/package-lock.json
language-tags1.0.5actions/installer/package-lock.json
lazy-cache2.0.2package-lock.json
levn0.4.1actions/installer/package-lock.json
lie3.1.1package-lock.json
lines-and-columns1.2.4package-lock.json
linkify-it5.0.0package-lock.json
list-item1.1.1package-lock.json
localforage1.10.0package-lock.json
locate-path5.0.0package-lock.json
locate-path6.0.0actions/installer/package-lock.json
lodash4.17.21package-lock.json
lodash.camelcase4.3.0actions/installer/package-lock.json
lodash.kebabcase4.1.1actions/installer/package-lock.json
lodash.merge4.6.2actions/installer/package-lock.json
lodash.snakecase4.1.1actions/installer/package-lock.json
lodash.upperfirst4.3.1actions/installer/package-lock.json
longest-streak2.0.4package-lock.json
lowercase-keys2.0.0package-lock.json
lru-cache10.2.0actions/installer/package-lock.json
lru-cache10.2.2package-lock.json
lru-cache6.0.0actions/installer/package-lock.json
luxon3.4.4package-lock.json
make-fetch-happen13.0.1package-lock.json
map-obj1.0.1package-lock.json
map-obj4.3.0package-lock.json
markdown-it14.1.0package-lock.json
markdown-table2.0.0package-lock.json
markdown-toc1.2.0MITpackage-lock.json
matcher3.0.0package-lock.json
math-random1.0.4package-lock.json
mdast-util-find-and-replace1.1.1package-lock.json
mdast-util-from-markdown0.8.5package-lock.json
mdast-util-to-markdown0.6.5package-lock.json
mdast-util-to-string1.1.0package-lock.json
mdast-util-to-string2.0.0package-lock.json
mdurl2.0.0package-lock.json
meow7.1.1package-lock.json
meow8.1.2package-lock.json
merge21.4.1actions/installer/package-lock.json
micromark2.11.4package-lock.json
micromatch4.0.5actions/installer/package-lock.json
mimic-response1.0.1package-lock.json
mimic-response3.1.0package-lock.json
min-indent1.0.1package-lock.json
minimalistic-assert1.0.1package-lock.json
minimatch3.1.2actions/installer/package-lock.json
minimatch9.0.2package-lock.json
minimatch9.0.3actions/installer/package-lock.json
minimatch9.0.4actions/installer/package-lock.json
minimist1.2.6actions/installer/package-lock.json
minimist1.2.8package-lock.json
minimist-options4.1.0package-lock.json
minipass3.3.6package-lock.json
minipass5.0.0actions/installer/package-lock.json
minipass7.0.4actions/installer/package-lock.json
minipass7.1.1package-lock.json
minipass-collect2.0.1package-lock.json
minipass-fetch3.0.5package-lock.json
minipass-flush1.0.5package-lock.json
minipass-pipeline1.2.4package-lock.json
minipass-sized1.0.3package-lock.json
minizlib2.1.2package-lock.json
mixin-deep1.3.2package-lock.json
mkdirp0.5.6package-lock.json
mkdirp1.0.4package-lock.json
mkdirp-classic0.5.3package-lock.json
module-details-from-path1.0.3package-lock.json
moment2.30.1package-lock.json
moo0.5.2package-lock.json
more-entropy0.0.7package-lock.json
ms2.0.0actions/installer/package-lock.json
ms2.1.2actions/installer/package-lock.json
ms2.1.3package-lock.json
mv2.1.1package-lock.json
nan2.19.0package-lock.json
nanoid3.3.7package-lock.json
napi-build-utils1.0.2package-lock.json
natural-compare1.4.0actions/installer/package-lock.json
ncp2.0.0package-lock.json
negotiator0.6.3package-lock.json
neo-async2.6.2package-lock.json
node-abi3.62.0package-lock.json
node-fetch2.7.0package-lock.json
node-gyp10.1.0package-lock.json
node-html-parser6.1.13package-lock.json
node-releases2.0.6actions/installer/package-lock.json
nodejs0.0.0actions/installer/package-lock.json
nopt7.2.1package-lock.json
normalize-package-data2.5.0package-lock.json
normalize-package-data3.0.3package-lock.json
normalize-url6.1.0package-lock.json
nth-check2.1.1package-lock.json
object-inspect1.12.2actions/installer/package-lock.json
object-inspect1.13.1package-lock.json
object-is1.1.5actions/installer/package-lock.json
object-is1.1.6package-lock.json
object-keys1.1.1actions/installer/package-lock.json
object.assign4.1.4actions/installer/package-lock.json
object.assign4.1.5package-lock.json
object.entries1.1.6actions/installer/package-lock.json
object.fromentries2.0.6actions/installer/package-lock.json
object.pick1.3.0package-lock.json
object.values1.1.5actions/installer/package-lock.json
once1.4.0actions/installer/package-lock.json
openpgp5.11.1package-lock.json
optionator0.9.3actions/installer/package-lock.json
p-all3.0.0package-lock.json
p-cancelable2.1.1package-lock.json
p-filter2.1.0package-lock.json
p-finally1.0.0package-lock.json
p-limit2.3.0package-lock.json
p-limit3.1.0actions/installer/package-lock.json
p-locate4.1.0package-lock.json
p-locate5.0.0actions/installer/package-lock.json
p-map2.1.0package-lock.json
p-map4.0.0package-lock.json
p-queue6.6.2package-lock.json
p-throttle4.1.1package-lock.json
p-timeout3.2.0package-lock.json
p-try2.2.0package-lock.json
parent-module1.0.1actions/installer/package-lock.json
parse-entities2.0.0package-lock.json
parse-json5.2.0package-lock.json
parse-path7.0.0package-lock.json
parse-url8.1.0package-lock.json
path-exists4.0.0actions/installer/package-lock.json
path-is-absolute1.0.1actions/installer/package-lock.json
path-key3.1.1actions/installer/package-lock.json
path-parse1.0.7actions/installer/package-lock.json
path-scurry1.10.2actions/installer/package-lock.json
path-scurry1.11.1package-lock.json
path-type4.0.0actions/installer/package-lock.json
pend1.2.0package-lock.json
pgp-utils0.0.35package-lock.json
picocolors1.0.0actions/installer/package-lock.json
picocolors1.0.1package-lock.json
picomatch2.3.1actions/installer/package-lock.json
possible-typed-array-names1.0.0package-lock.json
prebuild-install7.1.2package-lock.json
prelude-ls1.2.1actions/installer/package-lock.json
prettier3.2.5actions/installer/package-lock.json
prettier-linter-helpers1.0.0actions/installer/package-lock.json
proc-log3.0.0package-lock.json
proc-log4.2.0package-lock.json
process-nextick-args2.0.1package-lock.json
progress1.1.8package-lock.json
promise-retry2.0.1package-lock.json
protocols2.0.1package-lock.json
pump3.0.0package-lock.json
punycode2.1.1actions/installer/package-lock.json
punycode.js2.3.1package-lock.json
purepack1.0.6package-lock.json
qs6.12.1package-lock.json
queue-microtask1.2.3actions/installer/package-lock.json
quick-lru4.0.1package-lock.json
quick-lru5.1.1package-lock.json
randomatic3.1.1package-lock.json
rc1.2.8package-lock.json
re21.20.11package-lock.json
read-pkg5.2.0package-lock.json
read-pkg-up7.0.1package-lock.json
read-yaml-file2.1.0package-lock.json
readable-stream2.3.8package-lock.json
readable-stream3.6.2package-lock.json
redent3.0.0package-lock.json
redis4.6.13package-lock.json
regenerator-runtime0.13.11actions/installer/package-lock.json
regenerator-runtime0.14.1package-lock.json
regexp.prototype.flags1.4.3actions/installer/package-lock.json
regexp.prototype.flags1.5.2package-lock.json
remark13.0.0package-lock.json
remark-github10.1.0package-lock.json
remark-parse9.0.0package-lock.json
remark-stringify9.0.1package-lock.json
remarkable1.7.4package-lock.json
renovate37.374.1AGPL-3.0-onlypackage-lock.json
repeat-element1.1.4package-lock.json
repeat-string1.6.1package-lock.json
require-in-the-middle7.3.0package-lock.json
resolve1.22.1actions/installer/package-lock.json
resolve1.22.8package-lock.json
resolve-alpn1.2.1package-lock.json
resolve-from4.0.0actions/installer/package-lock.json
responselike2.0.1package-lock.json
retry0.12.0package-lock.json
reusify1.0.4actions/installer/package-lock.json
rimraf2.4.5package-lock.json
rimraf3.0.2actions/installer/package-lock.json
roarr2.15.4package-lock.json
run-parallel1.2.0actions/installer/package-lock.json
safe-array-concat1.1.2package-lock.json
safe-buffer5.1.2package-lock.json
safe-json-stringify1.2.0package-lock.json
safe-regex-test1.0.0actions/installer/package-lock.json
safe-regex-test1.0.3package-lock.json
safe-stable-stringify2.4.3package-lock.json
safer-buffer2.1.2package-lock.json
sax1.3.0package-lock.json
semver5.7.2package-lock.json
semver6.3.1actions/installer/package-lock.json
semver7.6.0actions/installer/package-lock.json
semver7.6.2package-lock.json
semver-compare1.0.0package-lock.json
semver-stable3.0.0package-lock.json
semver-utils1.1.4package-lock.json
serialize-error7.0.1package-lock.json
set-function-length1.2.2package-lock.json
set-function-name2.0.2package-lock.json
set-getter0.1.1package-lock.json
setup-slsa-verifier0.0.1actions/installer/package-lock.json
shebang-command2.0.0actions/installer/package-lock.json
shebang-regex3.0.0actions/installer/package-lock.json
shimmer1.2.1package-lock.json
shlex2.1.2package-lock.json
side-channel1.0.4actions/installer/package-lock.json
side-channel1.0.6package-lock.json
signal-exit3.0.7package-lock.json
signal-exit4.0.2actions/installer/package-lock.json
signal-exit4.1.0package-lock.json
simple-concat1.0.1package-lock.json
simple-get4.0.1package-lock.json
simple-git3.24.0package-lock.json
slash3.0.0actions/installer/package-lock.json
slugify1.6.6package-lock.json
smart-buffer4.2.0package-lock.json
socks2.8.3package-lock.json
socks-proxy-agent8.0.3package-lock.json
sort-keys4.2.0package-lock.json
source-map0.6.1package-lock.json
source-map-support0.5.21package-lock.json
spdx-correct3.2.0package-lock.json
spdx-exceptions2.5.0package-lock.json
spdx-expression-parse3.0.1package-lock.json
spdx-license-ids3.0.17package-lock.json
split23.2.2package-lock.json
sprintf-js1.0.3package-lock.json
sprintf-js1.1.3package-lock.json
ssri10.0.6package-lock.json
stop-iteration-iterator1.0.0actions/installer/package-lock.json
string-width4.2.3actions/installer/package-lock.json
string-width5.1.2actions/installer/package-lock.json
string.prototype.trim1.2.9package-lock.json
string.prototype.trimend1.0.6actions/installer/package-lock.json
string.prototype.trimend1.0.8package-lock.json
string.prototype.trimstart1.0.6actions/installer/package-lock.json
string.prototype.trimstart1.0.8package-lock.json
string_decoder1.1.1package-lock.json
strip-ansi6.0.1actions/installer/package-lock.json
strip-ansi7.0.1actions/installer/package-lock.json
strip-ansi7.1.0package-lock.json
strip-bom3.0.0actions/installer/package-lock.json
strip-bom4.0.0package-lock.json
strip-color0.1.0package-lock.json
strip-comments-strings1.2.0package-lock.json
strip-indent3.0.0package-lock.json
strip-json-comments2.0.1package-lock.json
strip-json-comments3.1.1actions/installer/package-lock.json
strnum1.0.5package-lock.json
supports-color5.5.0package-lock.json
supports-color7.2.0actions/installer/package-lock.json
svg-element-attributes1.3.1actions/installer/package-lock.json
synckit0.8.8actions/installer/package-lock.json
tar6.2.1package-lock.json
tar-fs2.1.3MITpackage-lock.json
tar-stream2.2.0package-lock.json
text-table0.2.0actions/installer/package-lock.json
through22.0.5package-lock.json
through24.0.2package-lock.json
through2-concurrent2.0.0package-lock.json
tinylogic2.0.0package-lock.json
to-object-path0.3.0package-lock.json
to-regex-range5.0.1actions/installer/package-lock.json
toml2.3.6package-lock.json
toml-eslint-parser0.9.3package-lock.json
tr460.0.3package-lock.json
traverse0.6.9package-lock.json
treeify1.1.0package-lock.json
trim-newlines3.0.1package-lock.json
triplesec4.0.3package-lock.json
trough1.0.5package-lock.json
ts-api-utils1.3.0actions/installer/package-lock.json
tsconfig-paths3.14.1actions/installer/package-lock.json
tslib1.14.1package-lock.json
tslib2.6.2actions/installer/package-lock.json
tunnel0.0.6actions/installer/package-lock.json
tunnel-agent0.6.0package-lock.json
tweetnacl0.13.3package-lock.json
tweetnacl1.0.3package-lock.json
typanion3.14.0package-lock.json
type-check0.4.0actions/installer/package-lock.json
type-fest0.13.1package-lock.json
type-fest0.18.1package-lock.json
type-fest0.20.2actions/installer/package-lock.json
type-fest0.6.0package-lock.json
type-fest0.8.1package-lock.json
typed-array-buffer1.0.2package-lock.json
typed-array-byte-length1.0.1package-lock.json
typed-array-byte-offset1.0.2package-lock.json
typed-array-length1.0.4actions/installer/package-lock.json
typed-array-length1.0.6package-lock.json
typed-rest-client1.8.11package-lock.json
typedarray0.0.6package-lock.json
typedarray-to-buffer3.1.5package-lock.json
typedarray.prototype.slice1.0.3package-lock.json
typescript5.4.3actions/installer/package-lock.json
typescript-eslint7.5.0actions/installer/package-lock.json
uc.micro2.1.0package-lock.json
uglify-js3.17.4package-lock.json
uint64be1.0.1package-lock.json
unbox-primitive1.0.2actions/installer/package-lock.json
underscore1.13.6package-lock.json
undici5.29.0MITactions/installer/package-lock.json
undici-types5.26.5actions/installer/package-lock.json
unified9.2.2package-lock.json
unique-filename3.0.0package-lock.json
unique-slug4.0.0package-lock.json
unist-util-is4.1.0package-lock.json
unist-util-stringify-position2.0.3package-lock.json
unist-util-visit2.0.3package-lock.json
unist-util-visit-parents3.1.1package-lock.json
universal-user-agent6.0.1actions/installer/package-lock.json
universalify2.0.1package-lock.json
upath2.0.1package-lock.json
update-browserslist-db1.0.5actions/installer/package-lock.json
uri-js4.4.1actions/installer/package-lock.json
url-join4.0.1package-lock.json
util0.12.5package-lock.json
util-deprecate1.0.2package-lock.json
uuid9.0.1package-lock.json
validate-npm-package-license3.0.4package-lock.json
validate-npm-package-name5.0.1package-lock.json
vfile4.2.1package-lock.json
vfile-message2.0.4package-lock.json
vuln-vects1.1.0package-lock.json
webidl-conversions3.0.1package-lock.json
whatwg-url5.0.0package-lock.json
which2.0.2actions/installer/package-lock.json
which4.0.0package-lock.json
which-boxed-primitive1.0.2actions/installer/package-lock.json
which-collection1.0.1actions/installer/package-lock.json
which-collection1.0.2package-lock.json
which-typed-array1.1.15package-lock.json
which-typed-array1.1.9actions/installer/package-lock.json
wordwrap1.0.0package-lock.json
wrap-ansi7.0.0actions/installer/package-lock.json
wrap-ansi8.1.0actions/installer/package-lock.json
wrappy1.0.2actions/installer/package-lock.json
write-file-atomic3.0.3package-lock.json
write-file-atomic5.0.1package-lock.json
write-yaml-file4.2.0package-lock.json
xmldoc1.3.0package-lock.json
xtend4.0.2package-lock.json
yallist4.0.0actions/installer/package-lock.json
yargs-parser18.1.3package-lock.json
yargs-parser20.2.9package-lock.json
yauzl2.10.0package-lock.json
yocto-queue0.1.0actions/installer/package-lock.json
zod3.23.8MITpackage-lock.json
zwitch1.0.5package-lock.json
golang (106)
NameVersionLicenseDeclared in
github.com/asaskevich/govalidatorv0.0.0-20230301143203-a9d515a09cc2go.mod
github.com/blang/semverv3.5.1+incompatiblego.mod
github.com/common-nighthawk/go-figurev0.0.0-20210622060536-734e95fb86bego.mod
github.com/containerd/stargz-snapshotter/estargzv0.16.3go.mod
github.com/cyberphone/json-canonicalizationv0.0.0-20231011164504-785e29786b46go.mod
github.com/digitorus/pkcs7v0.0.0-20230818184609-3a137a874352go.mod
github.com/digitorus/timestampv0.0.0-20231217203849-220c5c2851b7go.mod
github.com/docker/cliv27.5.0+incompatiblego.mod
github.com/docker/distributionv2.8.3+incompatiblego.mod
github.com/docker/docker-credential-helpersv0.8.2go.mod
github.com/docker/gov1.5.1-1go.mod
github.com/dustin/go-humanizev1.0.1go.mod
github.com/fsnotify/fsnotifyv1.7.0go.mod
github.com/go-chi/chiv4.1.2+incompatiblego.mod
github.com/go-jose/go-jose/v4v4.0.5go.mod
github.com/go-logr/logrv1.4.2go.mod
github.com/go-logr/stdrv1.2.2go.mod
github.com/go-openapi/analysisv0.23.0go.mod
github.com/go-openapi/errorsv0.22.0go.mod
github.com/go-openapi/jsonpointerv0.21.0go.mod
github.com/go-openapi/jsonreferencev0.21.0go.mod
github.com/go-openapi/loadsv0.22.0go.mod
github.com/go-openapi/runtimev0.28.0go.mod
github.com/go-openapi/specv0.21.0go.mod
github.com/go-openapi/strfmtv0.23.0go.mod
github.com/go-openapi/swagv0.23.0go.mod
github.com/go-openapi/validatev0.24.0go.mod
github.com/golang/snappyv0.0.4go.mod
github.com/google/certificate-transparency-gov1.2.1go.mod
github.com/google/go-cmpv0.6.0go.mod
github.com/google/go-containerregistryv0.20.3go.mod
github.com/google/trillianv1.7.1go.mod
github.com/google/uuidv1.6.0go.mod
github.com/gorilla/muxv1.8.1go.mod
github.com/hashicorp/go-cleanhttpv0.5.2go.mod
github.com/hashicorp/go-retryablehttpv0.7.7go.mod
github.com/hashicorp/hclv1.0.1-vault-5go.mod
github.com/in-toto/attestationv1.1.0go.mod
github.com/in-toto/in-toto-golangv0.9.0go.mod
github.com/inconshreveable/mousetrapv1.1.0go.mod
github.com/jedisct1/go-minisignv0.0.0-20230811132847-661be99b8267go.mod
github.com/josharian/internv1.0.0go.mod
github.com/klauspost/compressv1.17.11go.mod
github.com/letsencrypt/boulderv0.0.0-20240620165639-de9c06129becgo.mod
github.com/magiconair/propertiesv1.8.7go.mod
github.com/mailru/easyjsonv0.7.7go.mod
github.com/mitchellh/go-homedirv1.1.0go.mod
github.com/mitchellh/mapstructurev1.5.0go.mod
github.com/nozzle/throttlerv0.0.0-20180817012639-2ea982251481go.mod
github.com/oklog/ulidv1.3.1go.mod
github.com/opencontainers/go-digestv1.0.0go.mod
github.com/opencontainers/image-specv1.1.0go.mod
github.com/opentracing/opentracing-gov1.2.0go.mod
github.com/pelletier/go-toml/v2v2.2.2go.mod
github.com/pkg/errorsv0.9.1go.mod
github.com/sagikazarmark/locaferov0.4.0go.mod
github.com/sagikazarmark/slog-shimv0.1.0go.mod
github.com/sassoftware/relicv7.2.1+incompatiblego.mod
github.com/secure-systems-lab/go-securesystemslibv0.9.0go.mod
github.com/shibumi/go-pathspecv1.3.0go.mod
github.com/sigstore/cosign/v2v2.4.1go.mod
github.com/sigstore/fulciov1.6.5go.mod
github.com/sigstore/protobuf-specsv0.3.3go.mod
github.com/sigstore/rekorv1.3.8go.mod
github.com/sigstore/sigstorev1.8.12go.mod
github.com/sigstore/sigstore-gov0.6.2go.mod
github.com/sigstore/timestamp-authorityv1.2.2go.mod
github.com/sirupsen/logrusv1.9.3go.mod
github.com/slsa-framework/slsa-github-generatorv1.10.0go.mod
github.com/sourcegraph/concv0.3.0go.mod
github.com/spf13/aferov1.11.0go.mod
github.com/spf13/castv1.7.0go.mod
github.com/spf13/cobrav1.8.1go.mod
github.com/spf13/pflagv1.0.5go.mod
github.com/spf13/viperv1.19.0go.mod
github.com/subosito/gotenvv1.6.0go.mod
github.com/syndtr/goleveldbv1.0.1-0.20220721030215-126854af5e6dgo.mod
github.com/theupdateframework/go-tufv0.7.0go.mod
github.com/theupdateframework/go-tuf/v2v2.0.1go.mod
github.com/titanous/rocacheckv0.0.0-20171023193734-afe73141d399go.mod
github.com/transparency-dev/merklev0.0.2go.mod
github.com/vbatts/tar-splitv0.11.6go.mod
go.mongodb.org/mongo-driverv1.14.0go.mod
go.opentelemetry.io/auto/sdkv1.1.0go.mod
go.opentelemetry.io/otelv1.33.0go.mod
go.opentelemetry.io/otel/metricv1.33.0go.mod
go.opentelemetry.io/otel/tracev1.33.0go.mod
go.uber.org/multierrv1.11.0go.mod
go.uber.org/zapv1.27.0go.mod
golang.org/x/cryptov0.36.0go.mod
golang.org/x/expv0.0.0-20250606033433-dcc06ee1d476go.mod
golang.org/x/modv0.25.0go.mod
golang.org/x/netv0.38.0go.mod
golang.org/x/syncv0.15.0go.mod
golang.org/x/sysv0.31.0go.mod
golang.org/x/termv0.30.0go.mod
golang.org/x/textv0.23.0go.mod
google.golang.org/genproto/googleapis/apiv0.0.0-20241209162323-e6fa225c2576go.mod
google.golang.org/genproto/googleapis/rpcv0.0.0-20250102185135-69823020774dgo.mod
google.golang.org/grpcv1.69.4go.mod
google.golang.org/protobufv1.36.3go.mod
gopkg.in/ini.v1v1.67.0go.mod
gopkg.in/yaml.v3v3.0.1go.mod
k8s.io/klog/v2v2.130.1go.mod
sigs.k8s.io/release-utilsv0.9.0go.mod
sigs.k8s.io/yamlv1.4.0go.mod
github (16)
NameVersionLicenseDeclared in
actions/checkoutv4.2.2.github/workflows/codeql-analysis.yml
actions/dependency-review-actionv4.5.0.github/workflows/depsreview.yml
actions/download-artifactv4.1.8.github/workflows/e2e.schedule.cli.yml
actions/setup-gov5.3.0.github/workflows/codeql-analysis.yml
actions/setup-nodev4.1.0.github/workflows/pre-submit.actions.yml
actions/upload-artifactv4.6.0.github/workflows/pre-submit.actions.yml
actionsdesk/lfs-warningv3.3.github/workflows/pre-submit.lfs.yml
github/codeql-action/analyzev3.28.1.github/workflows/codeql-analysis.yml
github/codeql-action/autobuildv3.28.1.github/workflows/codeql-analysis.yml
github/codeql-action/initv3.28.1.github/workflows/codeql-analysis.yml
github/codeql-action/upload-sarifv3.28.1.github/workflows/scorecards.yml
golangci/golangci-lint-actionv6.2.0.github/workflows/pre-submit.lint.yml
ossf/scorecard-actionv2.4.0.github/workflows/scorecards.yml
slsa-framework/slsa-github-generator/.github/workflows/builder_go_slsa3.ymlv2.0.0.github/workflows/release.yml
slsa-framework/slsa-verifier/actions/installerv2.6.0.github/workflows/release.yml
thehanimo/pr-title-checkerv1.4.3.github/workflows/pr-title.yml
maven (6)
NameVersionLicenseDeclared in
maven-core3.9.9experimental/maven-plugin/pom.xml
maven-plugin-annotations3.15.1experimental/maven-plugin/pom.xml
maven-plugin-api3.9.9experimental/maven-plugin/pom.xml
maven-project2.2.1experimental/maven-plugin/pom.xml
mojo-executor2.4.0experimental/maven-plugin/pom.xml
slsa-verification-plugin0.0.1experimental/maven-plugin/pom.xml
pypi (3)
NameVersionLicenseDeclared in
pathspec0.12.1requirements-lint.txt
pyyaml6.0.2requirements-lint.txt
yamllint1.35.1requirements-lint.txt
unknown (1)
NameVersionLicenseDeclared in
./actions/installerUNKNOWN.github/workflows/e2e.schedule.installer.yml

History

WeekVersionDependenciesCriticalHighMediumLowUnknownChanges
2026-11-02v2.7.111981911698164+1035 · 132 new advisories
2026-11-01v2.7.11639344064—

SBOM minimum elements

Scored by sbomlyze on the generated source SBOM. A source SBOM usually lacks supplier and hash data, so these scores mostly reflect what the project's manifests declare.

StandardScoreChecks passedFailed checks
NTIA 2021715/7Supplier Name, Dependency Relationship
CISA 2025505/10Software Producer, Dependency Relationship, License Information, Component Hash, SBOM Author
BSI TR-03183444/9Component Creator, Distribution Licences, SHA-512 Hash, Dependency Relationship, SBOM Creator Contact

Evidence

Downloads for this week: CycloneDX SBOM · Grype report · sbomlyze diff from last week

Permanent copy of the raw SBOM, Grype, OSV-Scanner, and govulncheck output and release checks: release report-2026-11-02, folder supply-chain-shard-*/slsa-framework__slsa-verifier/.

23 manifests and lockfiles scanned

.github/workflows/codeql-analysis.yml, .github/workflows/depsreview.yml, .github/workflows/e2e.schedule.cli.yml, .github/workflows/e2e.schedule.installer.yml, .github/workflows/pr-title.yml, .github/workflows/pre-submit.actions.yml, .github/workflows/pre-submit.cli.yml, .github/workflows/pre-submit.e2e.yml, .github/workflows/pre-submit.lfs.yml, .github/workflows/pre-submit.lint.yml, .github/workflows/pre-submit.references.yml, .github/workflows/release.yml, .github/workflows/scorecards.yml, .github/workflows/update-actions-dist-post-commit.yml, actions/installer/action.yml, actions/installer/package-lock.json, actions/installer/package.json, experimental/maven-plugin/pom.xml, go.mod, go.sum, package-lock.json, package.json, requirements-lint.txt

Full JSON for this project · Atom feed of weekly changes

Badges

shields.io endpoints refreshed with each weekly scan. They report this week's result for the latest release, nothing more.

[![release verification](https://img.shields.io/endpoint?url=https%3A%2F%2Frezmoss.github.io%2Fawesome-security-pipeline%2Fbadges%2Fslsa-framework%2Fslsa-verifier%2Frelease.json)](https://rezmoss.github.io/awesome-security-pipeline/projects/slsa-framework/slsa-verifier/index.html)
[![vulnerable code in binary](https://img.shields.io/endpoint?url=https%3A%2F%2Frezmoss.github.io%2Fawesome-security-pipeline%2Fbadges%2Fslsa-framework%2Fslsa-verifier%2Fin-binary.json)](https://rezmoss.github.io/awesome-security-pipeline/projects/slsa-framework/slsa-verifier/index.html)

How this report is made

Every Sunday a GitHub Actions workflow resolves each catalog tool to its latest release and runs the checks below. Every tool is installed from its own latest release and verified against its published checksum or digest. Nothing from the scanned projects is built or executed; release binaries are analyzed as files.

How the weekly supply-chain report is producedEvery Sunday the catalog's tools are resolved to their latest release. Manifests and workflows go to Syft, Grype, OSV-Scanner, sbomlyze, and zizmor; the release binary and its signatures go to govulncheck, Cosign, slsa-verifier, and GitHub attestation verification; the repository goes to OpenSSF Scorecard. Results are compared with the previous week and published here.Catalog78 tools in READMELatest releaseGitHub API, every SundayManifests & workflowssparse checkout, no testsRelease binaryLinux amd64 + signaturesRepositoryGitHub & OpenSSF dataSyftSBOMGrype + OSV-Scannerknown advisoriessbomlyzediff + minimum elementszizmorworkflow auditgovulncheckvulnerable code in binaryCosign · slsa-verifier · ghrelease verificationOpenSSF Scorecardrepository practicesCompare with last weekdata branch historyThis reportoverview + project pages
ToolWhat it does hereVersion this week
SyftGenerates a CycloneDX SBOM from each release's manifests and lockfiles.1.55.0
GrypeMatches the SBOM against known vulnerabilities.0.121.0
OSV-ScannerChecks the same files against the OSV database to confirm or add matches.2.7.0
govulncheckFor Go tools, finds which advisories have vulnerable code compiled into the released Linux binary.1.9.0
zizmorAudits the project's GitHub Actions workflows for injection, unpinned actions, and excessive permissions.1.31.1
OpenSSF ScorecardScores repository security practices such as code review, branch protection, and pinned dependencies.5.6.0
CosignVerifies Sigstore signatures on the release binary or its checksums file.3.1.4
slsa-verifierVerifies SLSA build provenance published with the release.2.7.1
GitHub CLI attestationsVerifies GitHub artifact attestations for the release binary.—
sbomlyzeDiffs each SBOM against last week and scores NTIA, CISA, and BSI minimum elements. Maintained by this repository's maintainer.0.6.0