snyk-cli

Find and fix vulnerabilities in dependencies

snyk/cli · Software Composition Analysis (SCA) · scanned v1.1308.3 (released 2026-10-23) · commit 4a83f28e6efc · last scan 2026-11-02

The scan method changed on 2026-11-02. npm development dependencies and npm-shrinkwrap.json are now scanned; matches on GitHub Actions referenced by a moving tag and on npm packages the repository defines itself are no longer counted; directories such as integration-tests and test-fixtures are excluded as fixtures. Most differences from the previous week below come from that change, not from the projects. Details.

Changes since last week

1176 added; 166 new advisories; 5 resolved; 1 license changes.

Added (1176)

@alcalzone/ansi-tokenize@0.1.3, @ampproject/remapping@2.2.0, @ampproject/remapping@2.3.0, @babel/code-frame@7.18.6, @babel/code-frame@7.23.5, @babel/compat-data@7.20.14, @babel/compat-data@7.23.5, @babel/core@7.20.12, @babel/core@7.24.0, @babel/generator@7.18.2, @babel/generator@7.20.14, @babel/generator@7.23.6, @babel/generator@7.27.3, @babel/helper-compilation-targets@7.20.7, @babel/helper-compilation-targets@7.23.6, @babel/helper-environment-visitor@7.18.9, @babel/helper-environment-visitor@7.22.20, @babel/helper-function-name@7.19.0, @babel/helper-function-name@7.23.0, @babel/helper-hoist-variables@7.18.6, @babel/helper-hoist-variables@7.22.5, @babel/helper-module-imports@7.18.6, @babel/helper-module-imports@7.22.15, @babel/helper-module-transforms@7.20.11, @babel/helper-module-transforms@7.23.3, @babel/helper-plugin-utils@7.20.2, @babel/helper-plugin-utils@7.24.0, @babel/helper-simple-access@7.20.2, @babel/helper-simple-access@7.22.5, @babel/helper-split-export-declaration@7.18.6, @babel/helper-split-export-declaration@7.22.6, @babel/helper-string-parser@7.19.4, @babel/helper-string-parser@7.27.1, @babel/helper-validator-identifier@7.19.1, @babel/helper-validator-identifier@7.27.1, @babel/helper-validator-option@7.18.6, @babel/helper-validator-option@7.23.5, @babel/helpers@7.20.13, @babel/helpers@7.24.0, @babel/highlight@7.18.6, @babel/highlight@7.23.4, @babel/parser@7.16.4, @babel/parser@7.18.4, @babel/parser@7.20.15, @babel/parser@7.24.0, @babel/parser@7.27.4, @babel/plugin-syntax-async-generators@7.8.4, @babel/plugin-syntax-bigint@7.8.3, @babel/plugin-syntax-class-properties@7.12.13, @babel/plugin-syntax-import-meta@7.10.4, @babel/plugin-syntax-json-strings@7.8.3, @babel/plugin-syntax-jsx@7.18.6, @babel/plugin-syntax-jsx@7.23.3, @babel/plugin-syntax-logical-assignment-operators@7.10.4, @babel/plugin-syntax-nullish-coalescing-operator@7.8.3, @babel/plugin-syntax-numeric-separator@7.10.4, @babel/plugin-syntax-object-rest-spread@7.8.3, @babel/plugin-syntax-optional-catch-binding@7.8.3, @babel/plugin-syntax-optional-chaining@7.8.3, @babel/plugin-syntax-top-level-await@7.14.5, @babel/plugin-syntax-typescript@7.20.0, @babel/plugin-syntax-typescript@7.23.3, @babel/polyfill@7.12.1, @babel/template@7.20.7, @babel/template@7.24.0, @babel/traverse@7.20.13, @babel/traverse@7.24.0, @babel/types@7.18.4, @babel/types@7.20.7, @babel/types@7.24.0, @babel/types@7.27.3, @base2/pretty-print-object@1.0.1, @bcoe/v8-coverage@0.2.3, @cspotcode/source-map-support@0.8.1, @discoveryjs/json-ext@0.5.3, @esbuild/aix-ppc64@0.28.1, @esbuild/android-arm@0.28.1, @esbuild/android-arm64@0.28.1, @esbuild/android-x64@0.28.1, @esbuild/darwin-arm64@0.28.1, @esbuild/darwin-x64@0.28.1, @esbuild/freebsd-arm64@0.28.1, @esbuild/freebsd-x64@0.28.1, @esbuild/linux-arm@0.28.1, @esbuild/linux-arm64@0.28.1, @esbuild/linux-ia32@0.28.1, @esbuild/linux-loong64@0.28.1, @esbuild/linux-mips64el@0.28.1, @esbuild/linux-ppc64@0.28.1, @esbuild/linux-riscv64@0.28.1, @esbuild/linux-s390x@0.28.1, @esbuild/linux-x64@0.28.1, @esbuild/netbsd-arm64@0.28.1, @esbuild/netbsd-x64@0.28.1, @esbuild/openbsd-arm64@0.28.1, @esbuild/openbsd-x64@0.28.1, @esbuild/openharmony-arm64@0.28.1, @esbuild/sunos-x64@0.28.1, @esbuild/win32-arm64@0.28.1, @esbuild/win32-ia32@0.28.1, @esbuild/win32-x64@0.28.1, @hutson/parse-repository-url@5.0.0, @isaacs/cliui@8.0.2, @isaacs/ts-node-temp-fork-for-pr-2009@10.9.7, @istanbuljs/load-nyc-config@1.1.0, @istanbuljs/schema@0.1.3, @jest/console@29.4.1, @jest/console@29.7.0, @jest/core@29.4.1, @jest/core@29.7.0, @jest/environment@29.4.1, @jest/environment@29.7.0, @jest/expect@29.4.1, @jest/expect@29.7.0, @jest/expect-utils@29.4.1, @jest/expect-utils@29.7.0, @jest/fake-timers@29.4.1, @jest/fake-timers@29.7.0, @jest/globals@29.4.1, @jest/globals@29.7.0, @jest/reporters@29.4.1, @jest/reporters@29.7.0, @jest/schemas@29.4.0, @jest/schemas@29.6.3, @jest/source-map@29.2.0, @jest/source-map@29.6.3, @jest/test-result@29.4.1, @jest/test-result@29.7.0, @jest/test-sequencer@29.4.1, @jest/test-sequencer@29.7.0, @jest/transform@29.4.1, @jest/transform@29.7.0, @jest/types@29.4.1, @jest/types@29.6.3, @jridgewell/gen-mapping@0.1.1, @jridgewell/gen-mapping@0.3.2, @jridgewell/gen-mapping@0.3.5, @jridgewell/resolve-uri@3.1.0, @jridgewell/set-array@1.1.2, @jridgewell/set-array@1.2.1, @jridgewell/sourcemap-codec@1.4.14, @jridgewell/trace-mapping@0.3.17, @jridgewell/trace-mapping@0.3.25, @jridgewell/trace-mapping@0.3.9, @npmcli/agent@2.2.2, @npmcli/fs@3.1.1, @npmcli/git@5.0.7, @npmcli/installed-package-contents@2.1.0, @npmcli/node-gyp@3.0.0, @npmcli/package-json@5.1.1, @npmcli/promise-spawn@7.0.2, @npmcli/redact@1.1.0, @npmcli/run-script@7.0.4, @octokit/auth-token@2.4.5, @octokit/core@3.5.1, @octokit/endpoint@6.0.12, @octokit/graphql@4.6.4, @octokit/openapi-types@12.11.0, @octokit/plugin-paginate-rest@1.1.2, @octokit/plugin-paginate-rest@2.21.3, @octokit/plugin-request-log@1.0.4, @octokit/plugin-rest-endpoint-methods@2.4.0, @octokit/plugin-rest-endpoint-methods@5.16.2, @octokit/request@5.6.1, @octokit/request-error@1.2.1, @octokit/request-error@2.1.0, @octokit/rest@16.43.2, @octokit/rest@18.12.0, @octokit/types@2.16.2, @octokit/types@6.41.0, @pkgjs/parseargs@0.11.0, @roberts_lando/vfs@0.3.3, @sigstore/bundle@2.3.2, @sigstore/core@1.1.0, @sigstore/protobuf-specs@0.3.2, @sigstore/sign@2.3.2, @sigstore/tuf@2.3.4, @sigstore/verify@1.2.1, @sinclair/typebox@0.25.21, @sinclair/typebox@0.27.8, @sinonjs/commons@1.8.3, @sinonjs/commons@2.0.0, @sinonjs/commons@3.0.1, @sinonjs/fake-timers@10.0.2, @sinonjs/fake-timers@10.3.0, @sinonjs/formatio@2.0.0, @sinonjs/formatio@3.2.2, @sinonjs/samsam@3.3.3, @sinonjs/text-encoding@0.7.1, @tapjs/after@1.1.24, @tapjs/after-each@2.0.1, @tapjs/asserts@2.0.1, @tapjs/before@2.0.1, @tapjs/before-each@2.0.1, @tapjs/config@3.0.1, @tapjs/core@2.0.1, @tapjs/error-serdes@2.0.1, @tapjs/filter@2.0.1, @tapjs/fixture@2.0.1, @tapjs/intercept@2.0.1, @tapjs/mock@2.0.1, @tapjs/node-serialize@2.0.1, @tapjs/processinfo@3.1.7, @tapjs/reporter@2.0.1, @tapjs/run@2.0.2, @tapjs/snapshot@2.0.1, @tapjs/spawn@2.0.1, @tapjs/stack@2.0.1, @tapjs/stdin@2.0.1, @tapjs/test@2.0.1, @tapjs/typescript@1.4.6, @tapjs/worker@2.0.1, @tsconfig/node10@1.0.9, @tsconfig/node12@1.0.11, @tsconfig/node14@1.0.3, @tsconfig/node16@1.0.3, @tsconfig/node18@18.2.4, @tsconfig/node20@20.1.4, @tufjs/canonical-json@2.0.0, @tufjs/models@2.0.1, @types/babel__core@7.20.0, @types/babel__core@7.20.5, @types/babel__generator@7.6.4, @types/babel__generator@7.6.8, @types/babel__template@7.4.1, @types/babel__template@7.4.4, @types/babel__traverse@7.18.3, @types/babel__traverse@7.20.5, @types/body-parser@1.19.1, @types/connect@3.4.35, @types/cross-spawn@6.0.2, @types/eslint@7.28.0, @types/eslint-scope@3.7.1, @types/estree@0.0.48, @types/estree@0.0.50, @types/express@4.17.13, @types/express-serve-static-core@4.17.24, @types/fs-extra@9.0.12, @types/graceful-fs@4.1.6, @types/graceful-fs@4.1.9, @types/istanbul-lib-coverage@2.0.3, @types/istanbul-lib-coverage@2.0.4, @types/istanbul-lib-report@3.0.0, @types/istanbul-reports@3.0.1, @types/jest@29.5.12, @types/jest-json-schema@6.1.5, @types/json-schema@7.0.9, @types/mime@1.3.2, @types/minimist@1.2.2, @types/needle@3.3.0, @types/node@14.17.10, @types/node@18.11.19, @types/normalize-package-data@2.4.1, @types/parse-json@4.0.0, @types/prettier@2.7.2, @types/qs@6.9.7, @types/range-parser@1.2.4, @types/serve-static@1.13.10, @types/sinon@7.5.2, @types/stack-utils@2.0.1, @types/stack-utils@2.0.3, @types/yargs@17.0.22, @types/yargs@17.0.32, @types/yargs-parser@21.0.0, @types/yargs-parser@21.0.3, @typescript-eslint/eslint-plugin@4.30.0, @typescript-eslint/experimental-utils@4.30.0, @typescript-eslint/experimental-utils@4.31.0, @typescript-eslint/parser@4.30.0, @typescript-eslint/scope-manager@4.30.0, @typescript-eslint/scope-manager@4.31.0, @typescript-eslint/types@4.30.0, @typescript-eslint/types@4.31.0, @typescript-eslint/typescript-estree@4.30.0, @typescript-eslint/typescript-estree@4.31.0, @typescript-eslint/visitor-keys@4.30.0, @typescript-eslint/visitor-keys@4.31.0, @vue/compiler-core@3.2.4, @vue/compiler-dom@3.2.4, @vue/compiler-sfc@3.2.4, @vue/compiler-ssr@3.2.4, @vue/shared@3.2.4, @webassemblyjs/ast@1.11.1, @webassemblyjs/floating-point-hex-parser@1.11.1, @webassemblyjs/helper-api-error@1.11.1, @webassemblyjs/helper-buffer@1.11.1, @webassemblyjs/helper-numbers@1.11.1, @webassemblyjs/helper-wasm-bytecode@1.11.1, @webassemblyjs/helper-wasm-section@1.11.1, @webassemblyjs/ieee754@1.11.1, @webassemblyjs/leb128@1.11.1, @webassemblyjs/utf8@1.11.1, @webassemblyjs/wasm-edit@1.11.1, @webassemblyjs/wasm-gen@1.11.1, @webassemblyjs/wasm-opt@1.11.1, @webassemblyjs/wasm-parser@1.11.1, @webassemblyjs/wast-printer@1.11.1, @webpack-cli/configtest@1.0.4, @webpack-cli/info@1.3.0, @webpack-cli/serve@1.5.2, @xtuc/ieee754@1.2.0, @xtuc/long@4.2.2, @yao-pkg/pkg@6.24.0, @yao-pkg/pkg-fetch@3.6.7, abbrev@2.0.0, abort-controller@3.0.0, accepts@1.3.7, acorn@7.4.1, acorn@8.11.3, acorn@8.4.1, acorn-import-assertions@1.7.6, acorn-jsx@5.3.2, acorn-walk@8.3.2, add-stream@1.0.0, agent-base@4.3.0, agent-base@7.1.1, ajv@6.12.6, ajv@6.14.0, ajv@8.18.0, ajv-draft-04@1.0.0, ajv-formats@2.1.1, ajv-keywords@3.5.2, ansi-escapes@4.3.2, ansi-escapes@6.2.1, ansi-regex@6.0.1, ansi-styles@5.2.0, ansi-styles@6.2.1, anti-trojan-source@1.4.1, anymatch@3.1.2, anymatch@3.1.3, arg@4.1.3, array-differ@3.0.0, array-flatten@1.1.1, array-from@2.1.1, array-ify@1.0.0, array-union@2.1.0, array-union@3.0.1, arrify@1.0.1, arrify@2.0.1, astral-regex@1.0.0, async-hook-domain@4.0.1, async-retry@1.2.3, asynckit@0.4.0, at-least-node@1.0.0, atob-lite@2.0.0, auto-bind@5.0.1, babel-jest@29.4.1, babel-jest@29.7.0, babel-plugin-istanbul@6.1.1, babel-plugin-jest-hoist@29.4.0, babel-plugin-jest-hoist@29.6.3, babel-preset-current-node-syntax@1.0.1, babel-preset-jest@29.4.0, babel-preset-jest@29.6.3, before-after-hook@2.2.2, big.js@5.2.2, binary-extensions@2.2.0, bluebird@3.7.2, body-parser@1.19.0, brace-expansion@1.1.11, braces@3.0.2, browserslist@4.21.5, browserslist@4.23.0, bs-logger@0.2.6, bser@2.1.1, btoa-lite@1.0.0, buffer-equal-constant-time@1.0.1, bytes@3.1.0, c8@9.1.0, cacache@18.0.3, call-bind@1.0.2, call-bind-apply-helpers@1.0.2, callsites@3.1.0, camelcase@5.3.1, camelcase@6.3.0, camelcase-keys@7.0.2, caniuse-lite@1.0.30001450, caniuse-lite@1.0.30001597, chalk@5.3.0, char-regex@1.0.2, chardet@0.7.0, chokidar@3.6.0, chownr@1.1.4, chownr@2.0.0, chrome-trace-event@1.0.3, ci-info@2.0.0, ci-info@3.2.0, ci-info@3.7.1, cjs-module-lexer@1.2.2, cjs-module-lexer@1.2.3, cli-boxes@3.0.0, cli-cursor@4.0.0, cli-truncate@3.1.0, cli-width@3.0.0, cliui@7.0.4, cliui@8.0.1, clone-deep@4.0.1, co@4.6.0, code-excerpt@4.0.0, collect-v8-coverage@1.0.1, collect-v8-coverage@1.0.2, colorette@1.3.0, colors@1.4.0, combined-stream@1.0.8, commander@2.20.3, commander@7.2.0, commander@9.5.0, compare-func@2.0.0, consolidate@0.16.0, content-disposition@0.5.3, content-type@1.0.4, conventional-changelog@5.1.0, conventional-changelog-angular@7.0.0, conventional-changelog-atom@4.0.0, conventional-changelog-cli@4.1.0, conventional-changelog-codemirror@4.0.0, conventional-changelog-conventionalcommits@7.0.2, conventional-changelog-core@7.0.0, conventional-changelog-ember@4.0.0, conventional-changelog-eslint@5.0.0, conventional-changelog-express@4.0.0, conventional-changelog-jquery@5.0.0, conventional-changelog-jshint@4.0.0, conventional-changelog-preset-loader@4.1.0, conventional-changelog-writer@7.0.1, conventional-commits-filter@4.0.0, conventional-commits-parser@5.0.0, convert-source-map@1.9.0, convert-source-map@2.0.0, convert-to-spaces@2.0.1, cookie@0.4.0, cookie-signature@1.0.6, copy-webpack-plugin@9.0.1, core-js@2.6.12, cosmiconfig@7.0.0, create-jest@29.7.0, create-require@1.1.1, cross-spawn@6.0.5, cross-spawn@6.0.6, cross-spawn@7.0.3, cssesc@3.0.0, danger@10.9.0, dargs@8.1.0, debug@2.6.9, debug@3.1.0, debug@3.2.7, decamelize@1.2.0, decamelize@5.0.1, decamelize-keys@1.1.0, decode-uri-component@0.2.0, decompress-response@6.0.0, dedent@0.7.0, dedent@1.5.1, deep-extend@0.6.0, deep-is@0.1.3, deepmerge@4.3.0, deepmerge@4.3.1, delayed-stream@1.0.0, depcheck@1.4.3, depd@1.1.2, deprecation@2.3.1, deps-regex@0.1.4, destroy@1.0.4, detect-libc@2.0.4, detect-newline@3.1.0, diff@3.5.0, diff@4.0.2, diff@5.2.0, diff-sequences@27.4.0, diff-sequences@29.3.1, diff-sequences@29.6.3, dir-glob@3.0.1, doctrine@3.0.0, dunder-proto@1.0.1, duplexer2@0.1.4, eastasianwidth@0.2.0, ecdsa-sig-formatter@1.0.11, ee-first@1.1.1, electron-to-chromium@1.4.286, electron-to-chromium@1.4.701, emittery@0.13.1, emoji-regex@8.0.0, emoji-regex@9.2.2, emojis-list@3.0.0, encodeurl@1.0.2, encoding@0.1.13, enhanced-resolve@5.15.0, envinfo@7.8.1, err-code@2.0.3, error-ex@1.3.2, es-abstract@1.18.5, es-define-property@1.0.1, es-errors@1.3.0, es-module-lexer@0.9.3, es-object-atoms@1.1.1, es-to-primitive@1.2.1, es6-promise@4.2.8, es6-promisify@5.0.0, esbuild@0.28.1, escalade@3.1.1, escape-html@1.0.3, escape-string-regexp@2.0.0, eslint@6.8.0, eslint-config-prettier@6.15.0, eslint-plugin-anti-trojan-source@1.1.1, eslint-plugin-jest@24.4.0, eslint-scope@5.1.1, eslint-utils@1.4.3, eslint-utils@3.0.0, eslint-visitor-keys@1.3.0, eslint-visitor-keys@2.1.0, espree@6.2.1, esquery@1.4.0, esrecurse@4.3.0, estraverse@4.3.0, estraverse@5.2.0, estree-walker@2.0.2, esutils@2.0.3, etag@1.8.1, event-target-shim@5.0.1, events@3.3.0, events-to-array@2.0.3, execa@1.0.0, exit@0.1.2, expand-template@2.0.3, expand-tilde@2.0.2, expect@29.4.1, expect@29.7.0, exponential-backoff@3.1.1, express@4.17.1, extend-shallow@2.0.1, external-editor@3.1.0, fast-deep-equal@3.1.3, fast-glob@3.3.1, fast-json-patch@3.1.0, fast-json-stable-stringify@2.1.0, fast-levenshtein@2.0.6, fast-uri@3.0.6, fastest-levenshtein@1.0.12, fb-watchman@2.0.2, fdir@6.4.5, figures@3.2.0, file-entry-cache@5.0.1, fill-keys@1.0.2, fill-range@7.0.1, filter-obj@1.1.0, finalhandler@1.1.2, find-up@4.1.0, find-up@5.0.0, find-up@6.3.0, find-yarn-workspace-root@2.0.0, flat-cache@2.0.1, flatted@2.0.2, foreground-child@3.1.1, form-data@2.5.1, forwarded@0.2.0, fresh@0.5.2, fromentries@1.3.2, fs-exists-sync@0.1.0, fs-extra@11.3.4, fs-extra@7.0.1, fs-extra@9.1.0, fs-minipass@2.1.0, fs-minipass@3.0.3, fsevents@2.3.2, function-bind@1.1.2, function-loop@4.0.0, functional-red-black-tree@1.0.1, generic-names@2.0.1, gensync@1.0.0-beta.2, get-caller-file@2.0.5, get-intrinsic@1.3.0, get-npm-tarball-url@2.0.2, get-package-type@0.1.0, get-proto@1.0.1, get-stdin@6.0.0, get-stream@4.1.0, git-config-path@1.0.1, git-raw-commits@4.0.0, git-semver-tags@7.0.1, github-from-package@0.0.0, gitlab@10.2.1, glob@10.4.1, glob-parent@6.0.2, glob-to-regexp@0.4.1, globals@11.12.0, globals@12.4.0, globby@11.1.0, globby@12.2.0, gopd@1.2.0, graceful-fs@4.2.10, handlebars@4.7.8, hard-rejection@2.1.0, has-bigints@1.0.1, has-flag@2.0.0, has-symbols@1.1.0, has-tostringtag@1.0.2, hash-sum@2.0.0, hasown@2.0.2, hasurl@1.0.0, homedir-polyfill@1.0.3, hosted-git-info@2.8.9, hosted-git-info@7.0.1, hosted-git-info@7.0.2, html-escaper@2.0.2, http-cache-semantics@4.1.1, http-errors@1.7.2, http-errors@1.7.3, http-proxy-agent@2.1.0, http-proxy-agent@7.0.2, https-proxy-agent@2.2.4, https-proxy-agent@7.0.4, humps@2.0.1, hyperlinker@1.0.0, iconv-lite@0.4.24, icss-replace-symbols@1.1.0, icss-utils@5.1.0, ignore@4.0.6, ignore@5.2.4, ignore-walk@6.0.5, import-fresh@3.3.0, import-local@3.0.2, import-local@3.1.0, indent-string@5.0.0, inherits@2.0.3, ini@1.3.8, ink@4.4.1, inquirer@7.3.3, internal-slot@1.0.3, interpret@2.2.0, into-stream@9.1.0, invariant@2.2.4, ip-address@9.0.5, ipaddr.js@1.9.1, is-actual-promise@1.0.2, is-arrayish@0.2.1, is-bigint@1.0.4, is-binary-path@2.1.0, is-boolean-object@1.1.2, is-callable@1.2.4, is-ci@2.0.0, is-ci@3.0.1, is-core-module@2.11.0, is-core-module@2.16.1, is-date-object@1.0.5, is-extendable@0.1.1, is-fullwidth-code-point@3.0.0, is-fullwidth-code-point@4.0.0, is-generator-fn@2.1.0, is-lambda@1.0.1, is-lower-case@2.0.2, is-negative-zero@2.0.1, is-number-object@1.0.6, is-object@1.0.2, is-plain-obj@1.1.0, is-plain-object@2.0.4, is-plain-object@5.0.0, is-regex@1.1.4, is-stream@1.1.0, is-string@1.0.7, is-symbol@1.0.4, is-text-path@2.0.0, is-upper-case@2.0.2, isarray@0.0.1, isexe@3.1.1, isobject@3.0.1, istanbul-lib-coverage@3.2.0, istanbul-lib-instrument@5.2.1, istanbul-lib-instrument@6.0.2, istanbul-lib-report@3.0.0, istanbul-lib-report@3.0.1, istanbul-lib-source-maps@4.0.1, istanbul-reports@3.1.5, istanbul-reports@3.1.6, jackspeak@3.1.2, jest@29.4.1, jest@29.7.0, jest-changed-files@29.4.0, jest-changed-files@29.7.0, jest-circus@29.4.1, jest-circus@29.7.0, jest-cli@29.4.1, jest-cli@29.7.0, jest-config@29.4.1, jest-config@29.7.0, jest-diff@27.4.6, jest-diff@29.4.1, jest-diff@29.7.0, jest-docblock@29.2.0, jest-docblock@29.7.0, jest-each@29.4.1, jest-each@29.7.0, jest-environment-node@29.4.1, jest-environment-node@29.7.0, jest-get-type@27.4.0, jest-get-type@29.2.0, jest-get-type@29.6.3, jest-haste-map@29.4.1, jest-haste-map@29.7.0, jest-json-schema@6.1.0, jest-junit@16.0.0, jest-leak-detector@29.4.1, jest-leak-detector@29.7.0, jest-matcher-utils@27.4.6, jest-matcher-utils@29.4.1, jest-matcher-utils@29.7.0, jest-message-util@29.4.1, jest-message-util@29.7.0, jest-mock@29.4.1, jest-mock@29.7.0, jest-pnp-resolver@1.2.3, jest-regex-util@29.2.0, jest-regex-util@29.6.3, jest-resolve@29.4.1, jest-resolve@29.7.0, jest-resolve-dependencies@29.4.1, jest-resolve-dependencies@29.7.0, jest-runner@29.4.1, jest-runner@29.7.0, jest-runtime@29.4.1, jest-runtime@29.7.0, jest-snapshot@29.4.1, jest-snapshot@29.7.0, jest-util@29.4.1, jest-util@29.7.0, jest-validate@29.4.1, jest-validate@29.7.0, jest-watcher@29.4.1, jest-watcher@29.7.0, jest-worker@27.4.6, jest-worker@29.4.1, jest-worker@29.7.0, js-tokens@4.0.0, js-yaml@3.14.1, jsbn@1.1.0, jsesc@2.5.2, jsesc@3.1.0, json-parse-better-errors@1.0.2, json-parse-even-better-errors@2.3.1, json-parse-even-better-errors@3.0.1, json-parse-even-better-errors@3.0.2, json-schema-traverse@0.4.1, json-schema-traverse@1.0.0, json-stable-stringify-without-jsonify@1.0.1, json5@1.0.1, json5@2.2.3, jsonfile@4.0.0, jsonfile@6.1.0, jsonparse@1.3.1, jsonpointer@5.0.1, JSONStream@1.3.5, jsonwebtoken@8.5.1, just-extend@4.2.1, jwa@1.4.1, jws@3.2.2, kind-of@6.0.3, klaw-sync@6.0.0, kleur@3.0.3, ky@0.12.0, ky-universal@0.3.0, leven@3.1.0, levn@0.3.0, li@1.3.0, lines-and-columns@1.1.6, lines-and-columns@1.2.4, lines-and-columns@2.0.4, load-json-file@4.0.0, loader-runner@4.2.0, loader-utils@1.4.0, loader-utils@2.0.1, locate-path@5.0.0, locate-path@6.0.0, locate-path@7.2.0, lodash.find@4.6.0, lodash.includes@4.3.0, lodash.isboolean@3.0.3, lodash.isinteger@4.0.4, lodash.isnumber@3.0.3, lodash.isplainobject@4.0.6, lodash.isstring@4.0.1, lodash.mapvalues@4.6.0, lodash.memoize@4.1.2, lodash.once@4.1.1, lodash.set@4.3.2, lolex@2.7.5, lolex@5.1.2, loose-envify@1.4.0, lru-cache@10.1.0, lru-cache@10.2.2, macos-release@2.5.0, magic-string@0.25.7, make-dir@4.0.0, make-error@1.3.6, make-fetch-happen@13.0.1, makeerror@1.0.12, map-obj@1.0.1, map-obj@4.2.1, math-intrinsics@1.1.0, media-typer@0.3.0, memfs-or-file-map-to-github-branch@1.2.1, memorystream@0.3.1, meow@10.1.5, meow@12.1.1, merge-descriptors@1.0.1, merge-source-map@1.1.0, methods@1.1.2, micromatch@4.0.5, mime@1.6.0, mime-db@1.49.0, mime-types@2.1.32, mimic-response@3.1.0, min-indent@1.0.1, minimatch@3.1.2, minimatch@9.0.4, minimist-options@4.1.0, minipass@3.3.6, minipass@5.0.0, minipass@7.1.2, minipass-collect@2.0.1, minipass-fetch@3.0.5, minipass-flush@1.0.5, minipass-json-stream@1.0.1, minipass-pipeline@1.2.4, minipass-sized@1.0.3, minizlib@2.1.2, mkdirp@0.5.5, mkdirp@1.0.4, mkdirp@3.0.1, mkdirp-classic@0.5.3, mock-fs@4.14.0, module-not-found-error@1.0.1, ms@2.0.0, ms@2.1.1, multimatch@5.0.0, multistream@4.1.0, mute-stream@0.0.8, nanoid@3.1.25, napi-build-utils@2.0.0, natural-compare@1.4.0, needle@2.9.1, negotiator@0.6.2, negotiator@0.6.3, neo-async@2.6.2, nice-try@1.0.5, nise@1.5.3, node-abi@3.75.0, node-cleanup@2.1.2, node-fetch@2.7.0, node-gyp@10.1.0, node-int64@0.4.0, node-loader@2.0.0, node-releases@2.0.10, node-releases@2.0.14, nopt@7.2.1, normalize-package-data@2.5.0, normalize-package-data@3.0.3, normalize-package-data@6.0.0, normalize-package-data@6.0.1, normalize-path@3.0.0, normalize-registry-url@1.0.0, npm-bundled@3.0.1, npm-install-checks@6.3.0, npm-normalize-package-bin@3.0.1, npm-package-arg@11.0.2, npm-packlist@8.0.2, npm-pick-manifest@9.0.1, npm-registry-fetch@16.2.1, npm-run-all@4.1.5, npm-run-path@2.0.2, object-inspect@1.11.0, object.assign@4.1.2, octokit-pagination-methods@1.1.0, on-finished@2.3.0, opener@1.5.2, optionator@0.8.3, os-name@3.1.0, os-tmpdir@1.0.2, override-require@1.1.1, p-finally@1.0.0, p-limit@2.3.0, p-limit@3.1.0, p-limit@4.0.0, p-locate@4.1.0, p-locate@5.0.0, p-locate@6.0.0, p-try@2.2.0, pacote@17.0.7, parent-module@1.0.1, parse-diff@0.7.1, parse-git-config@2.0.3, parse-github-url@1.0.2, parse-json@4.0.0, parse-json@5.2.0, parse-json@7.1.1, parse-passwd@1.0.0, parseurl@1.3.3, patch-console@2.0.0, patch-package@6.5.0, path-exists@4.0.0, path-exists@5.0.0, path-key@2.0.1, path-parse@1.0.7, path-scurry@1.11.1, path-to-regexp@0.1.7, path-to-regexp@1.8.0, path-type@3.0.0, path-type@4.0.0, picocolors@1.0.0, picocolors@1.1.1, picomatch@2.3.1, picomatch@4.0.4, pidtree@0.3.1, pify@3.0.0, pinpoint@1.1.0, pirates@4.0.5, pkg-dir@4.2.0, please-upgrade-node@3.2.0, polite-json@4.0.1, portfinder@1.0.38, postcss@8.3.6, postcss-modules@4.2.2, postcss-modules-extract-imports@3.0.0, postcss-modules-local-by-default@4.0.0, postcss-modules-scope@3.0.0, postcss-modules-values@4.0.0, postcss-selector-parser@6.0.6, postcss-value-parser@4.1.0, postject@1.0.0-alpha.6, prebuild-install@7.1.3, prelude-ls@1.1.2, prettier@3.3.3, pretty-format@27.4.6, pretty-format@29.4.1, pretty-format@29.7.0, prettyjson@1.2.1, prismjs@1.29.0, prismjs-terminal@1.2.3, proc-log@3.0.0, proc-log@4.2.0, process-on-spawn@1.0.0, progress@2.0.3, promise-inflight@1.0.1, promise-retry@2.0.1, prompts@2.4.2, proxy-addr@2.0.7, proxyquire@1.8.0, pure-rand@6.0.4, qs@6.7.0, query-ast@1.0.4, query-string@6.14.1, quick-lru@5.1.1, randombytes@2.1.0, range-parser@1.2.1, raw-body@2.4.0, rc@1.2.8, react@18.3.1, react-dom@18.3.1, react-element-to-jsx-string@15.0.0, react-is@17.0.2, react-is@18.1.0, react-is@18.2.0, react-reconciler@0.29.2, read-package-json@7.0.1, read-package-json-fast@3.0.2, read-pkg@3.0.0, read-pkg@6.0.0, read-pkg@8.1.0, read-pkg-up@10.1.0, read-pkg-up@8.0.0, readable-stream@2.3.7, readdirp@3.6.0, readline-sync@1.4.10, rechoir@0.7.1, redent@4.0.0, regenerator-runtime@0.13.9, regexpp@2.0.1, regexpp@3.2.0, require-directory@2.1.1, require-from-string@2.0.2, require-package-name@2.0.1, resolve@1.1.7, resolve@1.22.1, resolve@1.22.12, resolve-cwd@3.0.0, resolve-from@4.0.0, resolve-from@5.0.0, resolve-import@1.4.5, resolve.exports@2.0.0, resolve.exports@2.0.3, restore-cursor@4.0.0, retry@0.12.0, rimraf@2.6.3, rimraf@4.1.2, rimraf@5.0.7, run-async@2.4.1, rxjs@6.6.7, samsam@1.3.0, sass@1.38.0, scheduler@0.23.2, schema-utils@3.1.1, scss-parser@1.0.5, semver@6.3.0, semver@7.3.8, semver@7.6.2, semver@7.7.2, send@0.17.1, serialize-javascript@6.0.0, serve-static@1.14.1, setprototypeof@1.1.1, shallow-clone@3.0.1, shebang-command@1.2.0, shebang-regex@1.0.0, shell-quote@1.7.2, side-channel@1.0.4, signal-exit@4.1.0, sigstore@2.3.1, simple-concat@1.0.1, simple-get@4.0.1, sinon@4.5.0, sisteransi@1.0.5, slash@2.0.0, slash@3.0.0, slash@4.0.0, slice-ansi@2.1.0, slice-ansi@5.0.0, slice-ansi@6.0.0, smart-buffer@4.2.0, socks@2.8.3, socks-proxy-agent@8.0.3, source-list-map@2.0.1, source-map@0.7.3, source-map@0.7.4, source-map-js@0.6.2, source-map-support@0.5.13, sourcemap-codec@1.4.8, spdx-correct@3.1.1, spdx-exceptions@2.3.0, spdx-expression-parse@3.0.1, spdx-expression-validate@2.0.0, spdx-license-ids@3.0.10, split-on-first@1.1.0, split2@4.2.0, ssri@10.0.6, stack-utils@2.0.6, statuses@1.5.0, stream-meter@1.0.4, strict-uri-encode@2.0.0, string-hash@1.1.3, string-length@4.0.2, string-length@6.0.0, string-width@4.2.3, string-width@5.1.2, string.prototype.padend@3.1.2, string.prototype.trimend@1.0.4, string.prototype.trimstart@1.0.4, strip-ansi@7.1.0, strip-bom@3.0.0, strip-bom@4.0.0, strip-eof@1.0.0, strip-indent@4.0.0, strip-json-comments@2.0.1, strip-json-comments@3.1.1, supports-color@8.1.1, supports-hyperlinks@1.0.1, supports-preserve-symlinks-flag@1.0.0, sync-content@1.0.2, table@5.4.6, tap@19.0.2, tap-parser@16.0.1, tap-yaml@2.2.2, tapable@2.2.1, tar@6.2.1, tar-fs@2.1.1, tar-fs@3.1.3, tcompare@7.0.1, temp-dir@3.0.0, tempfile@5.0.0, terser@5.7.1, terser-webpack-plugin@5.1.4, test-exclude@6.0.0, text-extensions@2.4.0, text-table@0.2.0, through@2.3.8, tinyglobby@0.2.14, tmp@0.0.33, tmpl@1.0.5, to-fast-properties@2.0.0, toidentifier@1.0.0, tr46@0.0.3, tr46@1.0.1, trim-newlines@4.1.1, trivial-deferred@2.0.0, ts-jest@29.0.5, ts-jest@29.1.2, ts-loader@9.5.1, ts-node@10.9.2, tshy@1.14.0, tsutils@3.21.0, tuf-js@2.2.1, tunnel-agent@0.6.0, type-check@0.3.2, type-detect@4.0.8, type-fest@0.12.0, type-fest@0.21.3, type-fest@0.8.1, type-fest@1.4.0, type-fest@3.13.1, type-fest@4.9.0, type-is@1.6.18, typescript@4.9.5, typescript@5.4.5, uglify-js@3.17.4, unbox-primitive@1.0.1, undici@7.29.0, unique-filename@3.0.0, unique-slug@4.0.0, universal-url@2.0.0, universal-user-agent@4.0.1, universal-user-agent@6.0.0, universalify@0.1.2, universalify@2.0.0, unpipe@1.0.0, unzipper@0.12.3, update-browserslist-db@1.0.10, update-browserslist-db@1.0.13, uri-js@4.4.1, utils-merge@1.0.1, uuid@8.3.2, v8-compile-cache@2.3.0, v8-compile-cache-lib@3.0.1, v8-to-istanbul@9.0.1, v8-to-istanbul@9.2.0, validate-npm-package-license@3.0.4, validate-npm-package-name@5.0.1, vary@1.1.2, vscode-jsonrpc@8.1.0, walk-up-path@3.0.1, walker@1.0.8, watchpack@2.2.0, webidl-conversions@3.0.1, webidl-conversions@4.0.2, webpack@5.54.0, webpack-cli@4.8.0, webpack-license-plugin@4.2.0, webpack-merge@5.8.0, webpack-sources@2.3.1, webpack-sources@3.2.0, whatwg-url@5.0.0, whatwg-url@7.1.0, which@1.3.1, which@4.0.0, which-boxed-primitive@1.0.2, widest-line@4.0.1, wildcard@2.0.0, windows-release@3.3.3, word-wrap@1.2.3, wordwrap@1.0.0, wrap-ansi@7.0.0, wrap-ansi@8.1.0, write@1.0.3, write-file-atomic@4.0.2, write-file-atomic@5.0.0, ws@8.17.0, xml@1.0.1, y18n@5.0.8, yaml@2.4.2, yaml-types@0.3.0, yargs@16.2.0, yargs@17.6.2, yargs@17.7.2, yargs-parser@20.2.9, yargs-parser@21.1.1, yn@3.1.1, yocto-queue@0.1.0, yocto-queue@1.0.0, yoga-wasm-web@0.3.3

New advisories (166)

• C GHSA-23hp-3jrh-7fpw in tar@6.2.1
• H GHSA-25h7-pfq9-p65f in flatted@2.0.2
• H GHSA-27r3-jxmh-p828 in body-parser@1.19.0
• H GHSA-2883-xcg3-v3hh in js-yaml@3.14.1
• H GHSA-28wg-ghj8-5hjv in nanoid@3.1.25
• M GHSA-2g4f-4pwh-qvx6 in ajv@6.12.6
• L GHSA-2gqq-gqf2-x968 in undici@7.29.0
• M GHSA-2jfj-6hjv-fm6j in undici@7.29.0
• H GHSA-2m5v-pch6-74hx in undici@7.29.0
• M GHSA-2qvq-rjwj-gvw9 in handlebars@4.7.8
• H GHSA-2v37-7h3g-55p8 in nanoid@3.1.25
• C GHSA-2w6w-674q-4c4q in handlebars@4.7.8
• L GHSA-333x-w4r6-6crp in fast-uri@3.0.6
• H GHSA-34x7-hfp2-rc4v in tar@6.2.1
• H GHSA-37ch-88jc-xwx2 in path-to-regexp@0.1.7
• L GHSA-38r7-794h-5758 in webpack@5.54.0
• H GHSA-395f-4hp3-45gv in shell-quote@1.7.2
• M GHSA-3g3m-2fjr-6pw4 in glob@10.4.1
• H GHSA-3h5v-q93c-6h6q in ws@8.17.0
• H GHSA-3jxr-9vmj-r5cp in brace-expansion@1.1.11
• H GHSA-3mfm-83xf-c92r in handlebars@4.7.8
• H GHSA-3ppc-4f35-3m26 in minimatch@9.0.4
• H GHSA-3rfm-jhwj-7488 in loader-utils@2.0.1
• M GHSA-3v7f-55p6-f55p in picomatch@2.3.1
• M GHSA-3wwx-pv8p-q78v in undici@7.29.0
• M GHSA-3x93-p86w-5jvh in danger@10.9.0
• H GHSA-3xgq-45jj-v275 in cross-spawn@7.0.3
• M GHSA-3xpg-4rpp-hhhm in undici@7.29.0
• L GHSA-442j-39wm-28r2 in handlebars@4.7.8
• M GHSA-48c2-rrv3-qjmp in yaml@2.4.2
• H GHSA-4c8g-83qw-93j6 in fast-uri@3.0.6
• M GHSA-4mjr-xmp4-gh2g in qs@6.7.0
• M GHSA-4qv8-2p9j-2685 in undici@7.29.0
• M GHSA-4vvj-4cpr-p986 in webpack@5.54.0
• H GHSA-4w7w-5xrc-9h26 in undici@7.29.0
• H GHSA-4wf5-vphf-c2xc in terser@5.7.1
• L GHSA-4x5r-pxfx-6jf8 in @babel/core@7.24.0
• H GHSA-52cp-r559-cp3m in js-yaml@3.14.1
• L GHSA-52f5-9888-hmc6 in tmp@0.0.33
• H GHSA-52v5-jr5w-gjxr in sigstore@2.3.1
• M GHSA-55wc-3pg8-jfw6 in undici@7.29.0
• M GHSA-58qx-3vcg-4xpx in ws@8.17.0
• H GHSA-5c6j-r48x-rmvq in serialize-javascript@6.0.0
• H GHSA-5j98-mcp5-4vw2 in glob@10.4.1
• H GHSA-5p4m-2wfm-xmqj in js-yaml@3.14.1
• C GHSA-67hx-6x53-jw92 in @babel/traverse@7.20.13
• H GHSA-6g55-p6wh-862q in postcss@8.3.6
• H GHSA-6j4f-fj2g-mc7p in brace-expansion@1.1.11
• M GHSA-6pq8-jhm2-2vcw in qs@6.7.0
• M GHSA-6rw7-vpxm-498p in qs@6.7.0
• L GHSA-73rr-hh4g-fpgx in diff@5.2.0
• H GHSA-73wf-gq98-2v4g in browserslist@4.23.0
• C GHSA-76p3-8jx3-jpfq in loader-utils@2.0.1
• M GHSA-76p7-773f-r4q5 in serialize-javascript@6.0.0
• M GHSA-7fh5-64p2-3v2j in postcss@8.3.6
• H GHSA-7p8r-x3mc-p8w7 in fast-uri@3.0.6
• H GHSA-7r86-cg39-jmmj in minimatch@9.0.4
• M GHSA-7rx3-28cr-v5wh in handlebars@4.7.8
• H GHSA-83g3-92jg-28cx in tar@6.2.1
• L GHSA-8436-99hf-9mmv in undici@7.29.0
• H GHSA-869p-cjfg-cm3x in jws@3.2.2
• H GHSA-8cf7-32gw-wr33 in jsonwebtoken@8.5.1
• H GHSA-8cj5-5rvv-wf4v in tar-fs@2.1.1
• L GHSA-8fgc-7cc6-rx7x in webpack@5.54.0
• H GHSA-8g77-54rh-46hx in parse-git-config@2.0.3
• H GHSA-8gh8-hqwg-xf34 in fast-json-patch@3.1.0
• H GHSA-8qq5-rm4j-mr97 in tar@6.2.1
• C GHSA-8r5x-fm3f-whwj in handlebars@4.7.8
• H GHSA-8x88-c5mf-7j5w in tar@6.2.1
• M GHSA-952p-6rrq-rcjv in micromatch@4.0.5
• M GHSA-968p-4wvh-cqc8 in @babel/helpers@7.24.0
• H GHSA-96hv-2xvq-fx4p in ws@8.17.0
• H GHSA-9c47-m6qq-7p4h in json5@1.0.1
• H GHSA-9cx6-37pm-9jff in handlebars@4.7.8
• M GHSA-9fm3-97px-rjf6 in undici@7.29.0
• H GHSA-9ppj-qmqm-q256 in tar@6.2.1
• H GHSA-9wv6-86v2-598j in path-to-regexp@1.8.0
• H GHSA-c2c7-rcm5-vvqj in picomatch@2.3.1
• H GHSA-c2qf-rxjj-qqgw in semver@7.3.8
• H GHSA-c83g-rgw3-j3cx in browserslist@4.23.0
• L GHSA-cm22-4g7w-348p in serve-static@1.14.1
• H GHSA-f65p-4m7j-42xc in fast-uri@3.0.6
• M GHSA-f72v-6w45-q472 in undici@7.29.0
• M GHSA-f886-m6hf-6m8v in brace-expansion@1.1.11
• C GHSA-fjxv-7rqg-78g4 in form-data@2.5.1
• M GHSA-fxqj-rqcc-2cmp in postcss@8.3.6
• C GHSA-g4rg-993r-mgx7 in shell-quote@1.7.2
• L GHSA-gcqx-w48m-w2h4 in deepmerge@4.3.1
• H GHSA-grv7-fg5c-xmjg in braces@3.0.2
• M GHSA-gvwx-54wh-qm9j in tar@6.2.1
• M GHSA-h3mg-xc3c-68pw in ip-address@9.0.5
• M GHSA-h5c3-5r3r-rr8q in @octokit/plugin-paginate-rest@2.21.3
• M GHSA-h67p-54hq-rp68 in js-yaml@3.14.1
• C GHSA-hc6q-2mpp-qw7j in webpack@5.54.0
• H GHSA-hhq3-ff78-jv3g in loader-utils@2.0.1
• M GHSA-hjrf-2m68-5959 in jsonwebtoken@8.5.1
• H GHSA-hmw2-7cc7-3qxx in form-data@2.5.1
• H GHSA-hrpp-h998-j3pp in qs@6.7.0
• M GHSA-hrr3-gc8f-f4qj in fast-uri@3.0.6
• M GHSA-j6r3-76f7-8jcv in ip-address@9.0.5
• M GHSA-j8xg-fqg3-53r7 in word-wrap@1.2.3
• M GHSA-jfc7-64v2-mr8c in @sigstore/core@1.1.0
• C GHSA-jqcg-44mw-7w3h in proxy-addr@2.0.7
• H GHSA-jqff-g426-hqxp in fast-uri@3.0.6
• L GHSA-m5mm-p8h7-m29v in serialize-javascript@6.0.0
• L GHSA-m6fv-jmcg-4jfg in send@0.17.1
• M GHSA-mh29-5h37-fv8m in js-yaml@3.14.1
• H GHSA-mh99-v99m-4gvg in brace-expansion@1.1.11
• M GHSA-mwcw-c2x4-8c55 in nanoid@3.1.25
• H GHSA-mwp4-54f8-5fhr in ip-address@9.0.5
• H GHSA-p6mc-m468-83gw in lodash.set@4.3.2
• C GHSA-p8wg-vrv2-v86f in handlebars@4.7.8
• H GHSA-ph9p-34f9-6g65 in tmp@0.0.33
• M GHSA-pmjh-fq2x-6v4x in undici@7.29.0
• H GHSA-pq67-2wwv-3xjx in tar-fs@2.1.1
• M GHSA-q2hr-2g5m-vwhr in brace-expansion@1.1.11
• H GHSA-q3j6-qgpj-74h6 in fast-uri@3.0.6
• H GHSA-qffp-2rhf-9h96 in tar@6.2.1
• H GHSA-qhr7-859c-m2p7 in brace-expansion@1.1.11
• M GHSA-qj8w-gfj5-8c6v in serialize-javascript@6.0.0
• H GHSA-qr28-fpjm-wq7f in decode-uri-component@0.2.0
• M GHSA-qrpm-p2h7-hrv2 in nanoid@3.1.25
• H GHSA-qrxm-fqhp-jwvm in undici@7.29.0
• H GHSA-qw65-cvwx-89v3 in fast-uri@3.0.6
• L GHSA-qw6h-vgh9-j6wx in express@4.17.1
• H GHSA-qwcr-r2fm-qrc7 in body-parser@1.19.0
• M GHSA-qwph-4952-7xr6 in jsonwebtoken@8.5.1
• M GHSA-qx2v-qp2m-jg93 in postcss@8.3.6
• H GHSA-r28c-9q8g-f849 in postcss@8.3.6
• H GHSA-r292-9mhp-454m in tar@6.2.1
• L GHSA-r53p-7pc4-xj5r in undici@7.29.0
• H GHSA-r6q2-hw4h-h46w in tar@6.2.1
• H GHSA-rf6f-7fwh-wjgh in flatted@2.0.2
• H GHSA-rfgv-xxqx-mfg5 in undici@7.29.0
• H GHSA-rgw5-rvv9-x895 in brace-expansion@1.1.11
• H GHSA-rhx6-c78j-4q9w in path-to-regexp@0.1.7
• M GHSA-rj75-hqrm-r3gf in postcss-selector-parser@6.0.6
• M GHSA-rmvr-2pp2-xj38 in @octokit/request@5.6.1
• M GHSA-rpw4-54j3-4h4q in ip-address@9.0.5
• M GHSA-rv95-896h-c2vc in express@4.17.1
• M GHSA-rx4f-c7p8-82vq in undici@7.29.0
• M GHSA-rxp7-6hxx-x8q5 in ip-address@9.0.5
• H GHSA-v2hh-gcrm-f6hx in fast-uri@3.0.6
• M GHSA-v2v4-37r5-5v8g in ip-address@9.0.5
• H GHSA-v39h-62p7-jpjc in fast-uri@3.0.6
• L GHSA-v422-hmwv-36x6 in body-parser@1.19.0
• L GHSA-v6h2-p8h4-qcjw in brace-expansion@1.1.11
• M GHSA-vcc3-ghjq-m6fr in decode-uri-component@0.2.0
• H GHSA-vj76-c3g6-qr5v in tar-fs@2.1.1
• M GHSA-vmf3-w455-68vh in tar@6.2.1
• H GHSA-w293-vg96-wgc3 in undici@7.29.0
• H GHSA-w4pp-8pjf-rmxw in pacote@17.0.7
• H GHSA-w573-4hg7-7wgq in decode-uri-component@0.2.0
• M GHSA-w5hq-g745-h8pq in uuid@8.3.2
• M GHSA-w74x-v6f9-j3xg in fast-uri@3.0.6
• L GHSA-w7fw-mjwx-w883 in qs@6.7.0
• C GHSA-w7jw-789q-3m8p in shell-quote@1.7.2
• M GHSA-w8wr-v893-vjvp in tar@6.2.1
• M GHSA-x7hr-w5r2-h6wg in prismjs@1.29.0
• H GHSA-xhpv-hc6g-r9c6 in handlebars@4.7.8
• L GHSA-xhq7-xmqj-769h in fast-uri@3.0.6
• H GHSA-xjj6-f33q-929c in undici@7.29.0
• H GHSA-xjpj-3mr7-gcpf in handlebars@4.7.8
• M GHSA-xw65-4hp5-5hc7 in handlebars@4.7.8
• H GHSA-xwg4-73v4-xw9w in nanoid@3.1.25
• M GHSA-xx4v-prfh-6cgc in @octokit/request-error@2.1.0

Resolved advisories (5)

• H GHSA-4vrv-93c7-m92j in snyk@1.0.0-monorepo
• M GHSA-4x6g-3cmx-w76r in snyk@1.0.0-monorepo
• L GHSA-6hwc-9h8r-3vmf in snyk@1.0.0-monorepo
• H GHSA-cxww-7g56-2vh6 in actions/download-artifact@v4
• H GHSA-hpqj-7cj6-hfj8 in snyk@1.0.0-monorepo

License changes

• has: none → MIT

Known vulnerabilities (205)

Vulnerabilities are known advisories that Grype matches against the dependencies declared in each project's release source (manifests and lockfiles, including development and build dependencies). A match does not mean the tool is exploitable: the vulnerable code may be unused, test-only, or not shipped in the released binary. OSV: also reported by OSV-Scanner. Released binary: for Go tools, whether govulncheck found the vulnerable code in the shipped Linux binary. KEV: listed in the CISA Known Exploited Vulnerabilities catalog. EPSS: FIRST's estimated probability of exploitation in the next 30 days. Both describe the vulnerability in general, not its exploitability through this tool; a match in a workflow file refers to a GitHub Action, not to shipped code. Select an advisory for every catalog tool it matches. If a match is wrong or does not apply, use Dispute; accepted disputes are annotated here and listed on the corrections page, and the match stays visible.

Not counted: 1 match (action reference to a moving tag or branch); 4 matches (package defined in the repository itself). Neither identifies a version installed from a registry.

Second opinion: OSV-Scanner

OSV-Scanner found 92 advisories in the same files; 89 of Grype's matches are confirmed by it (marked ✓ above). 6 advisories were reported only by OSV-Scanner.

Vulnerable code in the released binary

govulncheck analyzed snyk-linux from snyk-linux, built with go1.26.10. 6 advisories have vulnerable functions compiled into it: 0 in the Go standard library and 6 in dependencies.

Of the 10 Go advisories Grype matched in the source, 4 are in modules or code paths that are not in the shipped binary.

The Go linker removes unreachable functions, so a vulnerable function in the binary is likely reachable. Standard-library advisories are fixed by rebuilding with a newer Go release.

Release integrity

Verdict: checksums only for snyk-linux. The download matches GitHub's recorded digest.

• Checksums file: yes
• Signatures: yes
• SLSA provenance: no
• SBOM published with the release: no

Verified means a signature, provenance, or attestation was checked against an identity in snyk/cli's own GitHub Actions workflows.

Repository security (OpenSSF Scorecard)

No Scorecard result yet (the project is not in the OpenSSF public dataset; the Scorecard CLI fallback was skipped because this shard's weekly budget was used). Results are added as the weekly budget allows.

GitHub Actions workflow audit (zizmor)

87 potential issues in 9 workflow files at this release: 38 high, 22 medium, 27 low severity (medium or high confidence only). Each is a pattern to review, not a confirmed vulnerability.