{
  "qualification": "source scans only; not artifact or release acceptance",
  "entries": [
    {
      "scope": "AIUI",
      "package": "@babel/core",
      "advisory": "GHSA-4x5r-pxfx-6jf8",
      "title": "@babel/core: Arbitrary File Read via sourceMappingURL Comment",
      "source": "https://github.com/advisories/GHSA-4x5r-pxfx-6jf8",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "@babel/plugin-transform-modules-systemjs",
      "advisory": "GHSA-fv7c-fp4j-7gwp",
      "title": "@babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input",
      "source": "https://github.com/advisories/GHSA-fv7c-fp4j-7gwp",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "@humanfs/node",
      "advisory": "GHSA-p498-v437-472g",
      "title": "humanfs: Recursive copy follows symlinked files and copies data from outside the source tree",
      "source": "https://github.com/advisories/GHSA-p498-v437-472g",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "@storybook/core",
      "advisory": "GHSA-f2ph-cmg5-wxc8",
      "title": "Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites",
      "source": "https://github.com/advisories/GHSA-f2ph-cmg5-wxc8",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "@storybook/core",
      "advisory": "GHSA-px85-f4q5-jh77",
      "title": "Storybook dev server vulnerable to code injection from the local network",
      "source": "https://github.com/advisories/GHSA-px85-f4q5-jh77",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "@vitest/mocker",
      "advisory": "GHSA-82fw-gwwq-j7x9",
      "title": "Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock",
      "source": "https://github.com/advisories/GHSA-82fw-gwwq-j7x9",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "@vitest/mocker",
      "advisory": "GHSA-qxg6-89mg-rqv8",
      "title": "Vitest: Code injection via unauthenticated manual mock registration",
      "source": "https://github.com/advisories/GHSA-qxg6-89mg-rqv8",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "@vue/server-renderer",
      "advisory": "GHSA-g2v6-rqmx-r4w6",
      "title": "@vue/server-renderer: XSS via missing CR in attribute-name blacklist",
      "source": "https://github.com/advisories/GHSA-g2v6-rqmx-r4w6",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "baseline-browser-mapping",
      "advisory": "GHSA-w5vr-8v7q-w6rv",
      "title": "baseline-browser-mapping process termination on invalid input causes denial of service",
      "source": "https://github.com/advisories/GHSA-w5vr-8v7q-w6rv",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "brace-expansion",
      "advisory": "GHSA-3jxr-9vmj-r5cp",
      "title": "brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups",
      "source": "https://github.com/advisories/GHSA-3jxr-9vmj-r5cp",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "brace-expansion",
      "advisory": "GHSA-6j4f-fj2g-mc7p",
      "title": "brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion",
      "source": "https://github.com/advisories/GHSA-6j4f-fj2g-mc7p",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "brace-expansion",
      "advisory": "GHSA-f886-m6hf-6m8v",
      "title": "brace-expansion: Zero-step sequence causes process hang and memory exhaustion",
      "source": "https://github.com/advisories/GHSA-f886-m6hf-6m8v",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "brace-expansion",
      "advisory": "GHSA-jxxr-4gwj-5jf2",
      "title": "brace-expansion: Large numeric range defeats documented `max` DoS protection",
      "source": "https://github.com/advisories/GHSA-jxxr-4gwj-5jf2",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "brace-expansion",
      "advisory": "GHSA-mh99-v99m-4gvg",
      "title": "brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash",
      "source": "https://github.com/advisories/GHSA-mh99-v99m-4gvg",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "brace-expansion",
      "advisory": "GHSA-q2hr-2g5m-vwhr",
      "title": "brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service",
      "source": "https://github.com/advisories/GHSA-q2hr-2g5m-vwhr",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "brace-expansion",
      "advisory": "GHSA-qhr7-859c-m2p7",
      "title": "brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion",
      "source": "https://github.com/advisories/GHSA-qhr7-859c-m2p7",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "brace-expansion",
      "advisory": "GHSA-rgw5-rvv9-x895",
      "title": "brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation",
      "source": "https://github.com/advisories/GHSA-rgw5-rvv9-x895",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "browserslist",
      "advisory": "GHSA-73wf-gq98-2v4g",
      "title": "Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)",
      "source": "https://github.com/advisories/GHSA-73wf-gq98-2v4g",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "browserslist",
      "advisory": "GHSA-c83g-rgw3-j3cx",
      "title": "Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM",
      "source": "https://github.com/advisories/GHSA-c83g-rgw3-j3cx",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "deepmerge",
      "advisory": "GHSA-gcqx-w48m-w2h4",
      "title": "deepmerge mergeObject() allows prototype poisoning of returned objects",
      "source": "https://github.com/advisories/GHSA-gcqx-w48m-w2h4",
      "disposition": "remaining; no upstream compatible patched release selected"
    },
    {
      "scope": "AIUI",
      "package": "dompurify",
      "advisory": "GHSA-39q2-94rc-95cp",
      "title": "DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluation",
      "source": "https://github.com/advisories/GHSA-39q2-94rc-95cp",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "dompurify",
      "advisory": "GHSA-55q2-fjhq-7xh7",
      "title": "DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS",
      "source": "https://github.com/advisories/GHSA-55q2-fjhq-7xh7",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "dompurify",
      "advisory": "GHSA-6688-9rhm-gjv2",
      "title": "DOMPurify: IN_PLACE returns a force-removed rawtext root whose text carries attacker markup \u2014 pure HTML reparse executes",
      "source": "https://github.com/advisories/GHSA-6688-9rhm-gjv2",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "dompurify",
      "advisory": "GHSA-76mc-f452-cxcm",
      "title": "DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR`",
      "source": "https://github.com/advisories/GHSA-76mc-f452-cxcm",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "dompurify",
      "advisory": "GHSA-c2j3-45gr-mqc4",
      "title": "DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.",
      "source": "https://github.com/advisories/GHSA-c2j3-45gr-mqc4",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "dompurify",
      "advisory": "GHSA-c6gr-qvv4-5v3f",
      "title": "DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml",
      "source": "https://github.com/advisories/GHSA-c6gr-qvv4-5v3f",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "dompurify",
      "advisory": "GHSA-cj63-jhhr-wcxv",
      "title": "DOMPurify USE_PROFILES prototype pollution allows event handlers",
      "source": "https://github.com/advisories/GHSA-cj63-jhhr-wcxv",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "dompurify",
      "advisory": "GHSA-cjmm-f4jc-qw8r",
      "title": "DOMPurify ADD_ATTR predicate skips URI validation",
      "source": "https://github.com/advisories/GHSA-cjmm-f4jc-qw8r",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "dompurify",
      "advisory": "GHSA-cmwh-pvxp-8882",
      "title": "DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)",
      "source": "https://github.com/advisories/GHSA-cmwh-pvxp-8882",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "dompurify",
      "advisory": "GHSA-crv5-9vww-q3g8",
      "title": "DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode",
      "source": "https://github.com/advisories/GHSA-crv5-9vww-q3g8",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "dompurify",
      "advisory": "GHSA-gvmj-g25r-r7wr",
      "title": "DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside <template> content when using DOM output modes",
      "source": "https://github.com/advisories/GHSA-gvmj-g25r-r7wr",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "dompurify",
      "advisory": "GHSA-h7mw-gpvr-xq4m",
      "title": "DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)",
      "source": "https://github.com/advisories/GHSA-h7mw-gpvr-xq4m",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "dompurify",
      "advisory": "GHSA-h8r8-wccr-v5f2",
      "title": "DOMPurify is vulnerable to mutation-XSS via Re-Contextualization ",
      "source": "https://github.com/advisories/GHSA-h8r8-wccr-v5f2",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "dompurify",
      "advisory": "GHSA-hpcv-96wg-7vj8",
      "title": "DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks",
      "source": "https://github.com/advisories/GHSA-hpcv-96wg-7vj8",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "dompurify",
      "advisory": "GHSA-mrv2-3pqr-j5jr",
      "title": "DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)",
      "source": "https://github.com/advisories/GHSA-mrv2-3pqr-j5jr",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "dompurify",
      "advisory": "GHSA-r47g-fvhr-h676",
      "title": "DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM",
      "source": "https://github.com/advisories/GHSA-r47g-fvhr-h676",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "dompurify",
      "advisory": "GHSA-rp9w-3fw7-7cwq",
      "title": "DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content",
      "source": "https://github.com/advisories/GHSA-rp9w-3fw7-7cwq",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "dompurify",
      "advisory": "GHSA-v2wj-7wpq-c8vv",
      "title": "DOMPurify contains a Cross-site Scripting vulnerability",
      "source": "https://github.com/advisories/GHSA-v2wj-7wpq-c8vv",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "dompurify",
      "advisory": "GHSA-v9jr-rg53-9pgp",
      "title": "DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback",
      "source": "https://github.com/advisories/GHSA-v9jr-rg53-9pgp",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "dompurify",
      "advisory": "GHSA-vxr8-fq34-vvx9",
      "title": "DOMPurify: Trusted Types policy survives `clearConfig()` and can poison later `RETURN_TRUSTED_TYPE` output",
      "source": "https://github.com/advisories/GHSA-vxr8-fq34-vvx9",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "dompurify",
      "advisory": "GHSA-x4vx-rjvf-j5p4",
      "title": "DOMPurify: `IN_PLACE` mode trusts attacker-controlled `nodeName` on live non-form nodes, allowing script retention and XSS via attacker-supplied DOM objects",
      "source": "https://github.com/advisories/GHSA-x4vx-rjvf-j5p4",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "esbuild",
      "advisory": "GHSA-g7r4-m6w7-qqqr",
      "title": "esbuild allows arbitrary file read when running the development server on Windows",
      "source": "https://github.com/advisories/GHSA-g7r4-m6w7-qqqr",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "fast-uri",
      "advisory": "GHSA-333x-w4r6-6crp",
      "title": "fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references",
      "source": "https://github.com/advisories/GHSA-333x-w4r6-6crp",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "fast-uri",
      "advisory": "GHSA-4c8g-83qw-93j6",
      "title": "fast-uri vulnerable to host confusion via failed IDN canonicalization",
      "source": "https://github.com/advisories/GHSA-4c8g-83qw-93j6",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "fast-uri",
      "advisory": "GHSA-7p8r-x3mc-p8w7",
      "title": "fast-uri vulnerable to host confusion via backslash authority introducer",
      "source": "https://github.com/advisories/GHSA-7p8r-x3mc-p8w7",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "fast-uri",
      "advisory": "GHSA-f65p-4m7j-42xc",
      "title": "fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization",
      "source": "https://github.com/advisories/GHSA-f65p-4m7j-42xc",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "fast-uri",
      "advisory": "GHSA-hrr3-gc8f-f4qj",
      "title": "fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets",
      "source": "https://github.com/advisories/GHSA-hrr3-gc8f-f4qj",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "fast-uri",
      "advisory": "GHSA-jqff-g426-hqxp",
      "title": "fast-uri vulnerable to host confusion via percent-encoded scheme normalization",
      "source": "https://github.com/advisories/GHSA-jqff-g426-hqxp",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "fast-uri",
      "advisory": "GHSA-q3j6-qgpj-74h6",
      "title": "fast-uri vulnerable to path traversal via percent-encoded dot segments",
      "source": "https://github.com/advisories/GHSA-q3j6-qgpj-74h6",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "fast-uri",
      "advisory": "GHSA-qw65-cvwx-89v3",
      "title": "fast-uri vulnerable to authority injection via an unvalidated port in serialize",
      "source": "https://github.com/advisories/GHSA-qw65-cvwx-89v3",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "fast-uri",
      "advisory": "GHSA-v2hh-gcrm-f6hx",
      "title": "fast-uri vulnerable to host confusion via literal backslash authority delimiter",
      "source": "https://github.com/advisories/GHSA-v2hh-gcrm-f6hx",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "fast-uri",
      "advisory": "GHSA-v39h-62p7-jpjc",
      "title": "fast-uri vulnerable to host confusion via percent-encoded authority delimiters",
      "source": "https://github.com/advisories/GHSA-v39h-62p7-jpjc",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "fast-uri",
      "advisory": "GHSA-w74x-v6f9-j3xg",
      "title": "fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding",
      "source": "https://github.com/advisories/GHSA-w74x-v6f9-j3xg",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "fast-uri",
      "advisory": "GHSA-xhq7-xmqj-769h",
      "title": "fast-uri vulnerable to improper path equivalence in relative reference normalization",
      "source": "https://github.com/advisories/GHSA-xhq7-xmqj-769h",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "flatted",
      "advisory": "GHSA-25h7-pfq9-p65f",
      "title": "flatted vulnerable to unbounded recursion DoS in parse() revive phase",
      "source": "https://github.com/advisories/GHSA-25h7-pfq9-p65f",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "flatted",
      "advisory": "GHSA-rf6f-7fwh-wjgh",
      "title": "Prototype Pollution via parse() in NodeJS flatted",
      "source": "https://github.com/advisories/GHSA-rf6f-7fwh-wjgh",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "glob",
      "advisory": "GHSA-3g3m-2fjr-6pw4",
      "title": "Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal",
      "source": "https://github.com/advisories/GHSA-3g3m-2fjr-6pw4",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "happy-dom",
      "advisory": "GHSA-5fpq-26gf-qwcr",
      "title": "Happy DOM has cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies",
      "source": "https://github.com/advisories/GHSA-5fpq-26gf-qwcr",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "happy-dom",
      "advisory": "GHSA-6q6h-j7hj-3r64",
      "title": "Happy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable code",
      "source": "https://github.com/advisories/GHSA-6q6h-j7hj-3r64",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "happy-dom",
      "advisory": "GHSA-834v-8h66-3h79",
      "title": "Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution",
      "source": "https://github.com/advisories/GHSA-834v-8h66-3h79",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "happy-dom",
      "advisory": "GHSA-c8p4-j97h-3vg8",
      "title": "Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML",
      "source": "https://github.com/advisories/GHSA-c8p4-j97h-3vg8",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "happy-dom",
      "advisory": "GHSA-w4gp-fjgq-3q4g",
      "title": "Happy DOM's fetch credentials include uses page-origin cookies instead of target-origin cookies",
      "source": "https://github.com/advisories/GHSA-w4gp-fjgq-3q4g",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "katex",
      "advisory": "GHSA-238p-pmpm-9mq7",
      "title": "KaTeX: Existing prototype pollution can bypass trust restrictions",
      "source": "https://github.com/advisories/GHSA-238p-pmpm-9mq7",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "linkify-it",
      "advisory": "GHSA-22p9-wv53-3rq4",
      "title": "LinkifyIt#match scan loop has quadratic algorithmic complexity",
      "source": "https://github.com/advisories/GHSA-22p9-wv53-3rq4",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "linkify-it",
      "advisory": "GHSA-v245-v573-v5vm",
      "title": "linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text",
      "source": "https://github.com/advisories/GHSA-v245-v573-v5vm",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "lodash",
      "advisory": "GHSA-f23m-r3pf-42rh",
      "title": "lodash vulnerable to prototype pollution via array-path bypass in `_.unset`, `_.omit`, and `_.pullAt",
      "source": "https://github.com/advisories/GHSA-f23m-r3pf-42rh",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "lodash",
      "advisory": "GHSA-r5fr-rjxr-66jc",
      "title": "lodash vulnerable to Code Injection via `_.template` imports key names",
      "source": "https://github.com/advisories/GHSA-r5fr-rjxr-66jc",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "lodash-es",
      "advisory": "GHSA-f23m-r3pf-42rh",
      "title": "lodash vulnerable to prototype pollution via array-path bypass in `_.unset`, `_.omit`, and `_.pullAt",
      "source": "https://github.com/advisories/GHSA-f23m-r3pf-42rh",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "lodash-es",
      "advisory": "GHSA-r5fr-rjxr-66jc",
      "title": "lodash vulnerable to Code Injection via `_.template` imports key names",
      "source": "https://github.com/advisories/GHSA-r5fr-rjxr-66jc",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "markdown-it",
      "advisory": "GHSA-253c-mchw-3w2r",
      "title": "markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds",
      "source": "https://github.com/advisories/GHSA-253c-mchw-3w2r",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "markdown-it",
      "advisory": "GHSA-6v5v-wf23-fmfq",
      "title": "markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations",
      "source": "https://github.com/advisories/GHSA-6v5v-wf23-fmfq",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "markdown-it",
      "advisory": "GHSA-gfr2-rv44-r23c",
      "title": "markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)",
      "source": "https://github.com/advisories/GHSA-gfr2-rv44-r23c",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "markdown-it",
      "advisory": "GHSA-r7fv-28h4-cvq7",
      "title": "markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes",
      "source": "https://github.com/advisories/GHSA-r7fv-28h4-cvq7",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "markdown-it",
      "advisory": "GHSA-vfgh-jcmw-g37q",
      "title": "markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled",
      "source": "https://github.com/advisories/GHSA-vfgh-jcmw-g37q",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "mermaid",
      "advisory": "GHSA-2v8p-3f2j-5mp7",
      "title": "Mermaid XY Charts are vulnerable to an infinite loop DoS",
      "source": "https://github.com/advisories/GHSA-2v8p-3f2j-5mp7",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "mermaid",
      "advisory": "GHSA-3rrr-jr9j-h3q3",
      "title": "Mermaid Architecture diagrams are vulnerable to prototype pollution",
      "source": "https://github.com/advisories/GHSA-3rrr-jr9j-h3q3",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "mermaid",
      "advisory": "GHSA-6m6c-36f7-fhxh",
      "title": "Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS",
      "source": "https://github.com/advisories/GHSA-6m6c-36f7-fhxh",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "mermaid",
      "advisory": "GHSA-6x64-9x62-f2gx",
      "title": "Mermaid allows CSS injection applying to sibling elements of the diagram",
      "source": "https://github.com/advisories/GHSA-6x64-9x62-f2gx",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "mermaid",
      "advisory": "GHSA-87f9-hvmw-gh4p",
      "title": "Mermaid: Improper sanitization of configuration leads to CSS injection",
      "source": "https://github.com/advisories/GHSA-87f9-hvmw-gh4p",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "mermaid",
      "advisory": "GHSA-c4c3-pg64-4m4v",
      "title": "Mermaid configuration APIs allow prototype pollution",
      "source": "https://github.com/advisories/GHSA-c4c3-pg64-4m4v",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "mermaid",
      "advisory": "GHSA-ghcm-xqfw-q4vr",
      "title": "Mermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injection",
      "source": "https://github.com/advisories/GHSA-ghcm-xqfw-q4vr",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "mermaid",
      "advisory": "GHSA-rhh3-jpg6-66xh",
      "title": "Mermaid radar diagrams are vulnerable to DoS",
      "source": "https://github.com/advisories/GHSA-rhh3-jpg6-66xh",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "mermaid",
      "advisory": "GHSA-xcj9-5m2h-648r",
      "title": "Mermaid: Improper sanitization of `classDefs` in diagrams leads to CSS injection",
      "source": "https://github.com/advisories/GHSA-xcj9-5m2h-648r",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "minimatch",
      "advisory": "GHSA-g3hv-75wg-m249",
      "title": "minimatch has potential denial of service via globparts amplification",
      "source": "https://github.com/advisories/GHSA-g3hv-75wg-m249",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "nanoid",
      "advisory": "GHSA-28wg-ghj8-5hjv",
      "title": "nanoid: non-secure generators can loop indefinitely with negative size",
      "source": "https://github.com/advisories/GHSA-28wg-ghj8-5hjv",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "nanoid",
      "advisory": "GHSA-2v37-7h3g-55p8",
      "title": "nanoid: custom generators can loop indefinitely when size is zero",
      "source": "https://github.com/advisories/GHSA-2v37-7h3g-55p8",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "nanoid",
      "advisory": "GHSA-xwg4-73v4-xw9w",
      "title": "nanoid: Integer Overflow or Wraparound",
      "source": "https://github.com/advisories/GHSA-xwg4-73v4-xw9w",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "pdfjs-dist",
      "advisory": "GHSA-hq66-cqwq-w95j",
      "title": "PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF ",
      "source": "https://github.com/advisories/GHSA-hq66-cqwq-w95j",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "picomatch",
      "advisory": "GHSA-3v7f-55p6-f55p",
      "title": "Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching",
      "source": "https://github.com/advisories/GHSA-3v7f-55p6-f55p",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "picomatch",
      "advisory": "GHSA-c2c7-rcm5-vvqj",
      "title": "Picomatch has a ReDoS vulnerability via extglob quantifiers",
      "source": "https://github.com/advisories/GHSA-c2c7-rcm5-vvqj",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "postcss",
      "advisory": "GHSA-6g55-p6wh-862q",
      "title": "PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments",
      "source": "https://github.com/advisories/GHSA-6g55-p6wh-862q",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "postcss",
      "advisory": "GHSA-fxqj-rqcc-2cmp",
      "title": "PostCSS: incomplete fix of GHSA-6g55-p6wh-862q \u2014 attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset",
      "source": "https://github.com/advisories/GHSA-fxqj-rqcc-2cmp",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "postcss",
      "advisory": "GHSA-qx2v-qp2m-jg93",
      "title": "PostCSS has XSS via Unescaped </style> in its CSS Stringify Output",
      "source": "https://github.com/advisories/GHSA-qx2v-qp2m-jg93",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "postcss",
      "advisory": "GHSA-r28c-9q8g-f849",
      "title": "PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure",
      "source": "https://github.com/advisories/GHSA-r28c-9q8g-f849",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "postcss-selector-parser",
      "advisory": "GHSA-rj75-hqrm-r3gf",
      "title": "PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion",
      "source": "https://github.com/advisories/GHSA-rj75-hqrm-r3gf",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "postcss-selector-parser",
      "advisory": "GHSA-w9m9-85wc-3x92",
      "title": "postcss-selector-parser allows denial of service through uncontrolled AST recursion",
      "source": "https://github.com/advisories/GHSA-w9m9-85wc-3x92",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "serialize-javascript",
      "advisory": "GHSA-5c6j-r48x-rmvq",
      "title": "Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()",
      "source": "https://github.com/advisories/GHSA-5c6j-r48x-rmvq",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "serialize-javascript",
      "advisory": "GHSA-m5mm-p8h7-m29v",
      "title": "Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body",
      "source": "https://github.com/advisories/GHSA-m5mm-p8h7-m29v",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "serialize-javascript",
      "advisory": "GHSA-qj8w-gfj5-8c6v",
      "title": "Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects",
      "source": "https://github.com/advisories/GHSA-qj8w-gfj5-8c6v",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "source-map-js",
      "advisory": "GHSA-68fv-2mgg-jv7q",
      "title": "source-map-js allows event-loop denial of service through indexed source-map section offsets",
      "source": "https://github.com/advisories/GHSA-68fv-2mgg-jv7q",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "storybook",
      "advisory": "GHSA-f2ph-cmg5-wxc8",
      "title": "Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites",
      "source": "https://github.com/advisories/GHSA-f2ph-cmg5-wxc8",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "storybook",
      "advisory": "GHSA-px85-f4q5-jh77",
      "title": "Storybook dev server vulnerable to code injection from the local network",
      "source": "https://github.com/advisories/GHSA-px85-f4q5-jh77",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "turbo",
      "advisory": "GHSA-3qcw-2rhx-2726",
      "title": "Turbo: Unexpected local code execution during Yarn Berry detection",
      "source": "https://github.com/advisories/GHSA-3qcw-2rhx-2726",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "turbo",
      "advisory": "GHSA-hcf7-66rw-9f5r",
      "title": "Turbo: Login callback CSRF/session fixation",
      "source": "https://github.com/advisories/GHSA-hcf7-66rw-9f5r",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "uuid",
      "advisory": "GHSA-w5hq-g745-h8pq",
      "title": "uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided",
      "source": "https://github.com/advisories/GHSA-w5hq-g745-h8pq",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "vite",
      "advisory": "GHSA-4w7w-66w2-5vf9",
      "title": "Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling",
      "source": "https://github.com/advisories/GHSA-4w7w-66w2-5vf9",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "vite",
      "advisory": "GHSA-587h-7wmj-h5pm",
      "title": "launch-editor: `fs.existsSync()` existence check can be bypassed on Windows",
      "source": "https://github.com/advisories/GHSA-587h-7wmj-h5pm",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "vite",
      "advisory": "GHSA-698v-4r3x-3vcv",
      "title": "launch-editor: escapeCmdArgs() omits % escaping on Windows",
      "source": "https://github.com/advisories/GHSA-698v-4r3x-3vcv",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "vite",
      "advisory": "GHSA-9jrq-w75r-8gcw",
      "title": "Vite: Cross origin script execution through Vite custom middleware",
      "source": "https://github.com/advisories/GHSA-9jrq-w75r-8gcw",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "vite",
      "advisory": "GHSA-fx2h-pf6j-xcff",
      "title": "vite: `server.fs.deny` bypass on Windows alternate paths",
      "source": "https://github.com/advisories/GHSA-fx2h-pf6j-xcff",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "vite",
      "advisory": "GHSA-p9ff-h696-f583",
      "title": "Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket",
      "source": "https://github.com/advisories/GHSA-p9ff-h696-f583",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "vite",
      "advisory": "GHSA-r825-w8mm-5pxw",
      "title": "launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors",
      "source": "https://github.com/advisories/GHSA-r825-w8mm-5pxw",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "vite",
      "advisory": "GHSA-rq7h-c2jc-7f22",
      "title": "Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine",
      "source": "https://github.com/advisories/GHSA-rq7h-c2jc-7f22",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "vite",
      "advisory": "GHSA-v2wj-q39q-566r",
      "title": "Vite: `server.fs.deny` bypassed with queries",
      "source": "https://github.com/advisories/GHSA-v2wj-q39q-566r",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "vite",
      "advisory": "GHSA-v6wh-96g9-6wx3",
      "title": "launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows",
      "source": "https://github.com/advisories/GHSA-v6wh-96g9-6wx3",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "vitest",
      "advisory": "GHSA-5xrq-8626-4rwp",
      "title": "When Vitest UI server is listening, arbitrary file can be read and executed",
      "source": "https://github.com/advisories/GHSA-5xrq-8626-4rwp",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "vitest",
      "advisory": "GHSA-82fw-gwwq-j7x9",
      "title": "Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock",
      "source": "https://github.com/advisories/GHSA-82fw-gwwq-j7x9",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "ws",
      "advisory": "GHSA-58qx-3vcg-4xpx",
      "title": "ws: Uninitialized memory disclosure",
      "source": "https://github.com/advisories/GHSA-58qx-3vcg-4xpx",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "ws",
      "advisory": "GHSA-96hv-2xvq-fx4p",
      "title": "ws: Memory exhaustion DoS from tiny fragments and data chunks",
      "source": "https://github.com/advisories/GHSA-96hv-2xvq-fx4p",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "AIUI",
      "package": "yaml",
      "advisory": "GHSA-48c2-rrv3-qjmp",
      "title": "yaml is vulnerable to Stack Overflow via deeply nested YAML collections",
      "source": "https://github.com/advisories/GHSA-48c2-rrv3-qjmp",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "Android Rust",
      "package": "paste",
      "advisory": "RUSTSEC-2024-0436",
      "title": "paste - no longer maintained",
      "source": "https://rustsec.org/advisories/RUSTSEC-2024-0436.html",
      "disposition": "remaining; no upstream compatible patched release selected"
    },
    {
      "scope": "Android Rust",
      "package": "tokio",
      "advisory": "RUSTSEC-2026-0386",
      "title": "`AsyncFd::new` and related constructors violate I/O safety",
      "source": "https://rustsec.org/advisories/RUSTSEC-2026-0386.html",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "Android Rust",
      "package": "unsafe-libyaml",
      "advisory": "RUSTSEC-2024-0449",
      "title": "unsafe-libyaml is unmaintained",
      "source": "https://rustsec.org/advisories/RUSTSEC-2024-0449.html",
      "disposition": "remaining; no upstream compatible patched release selected"
    },
    {
      "scope": "dashboard",
      "package": "@intlify/core-base",
      "advisory": "GHSA-83rm-6c8r-g728",
      "title": "Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages",
      "source": "https://github.com/advisories/GHSA-83rm-6c8r-g728",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "dashboard",
      "package": "@intlify/core-base",
      "advisory": "GHSA-8rc2-428q-7ww3",
      "title": "Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list",
      "source": "https://github.com/advisories/GHSA-8rc2-428q-7ww3",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "dashboard",
      "package": "@intlify/shared",
      "advisory": "GHSA-83rm-6c8r-g728",
      "title": "Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages",
      "source": "https://github.com/advisories/GHSA-83rm-6c8r-g728",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "dashboard",
      "package": "body-parser",
      "advisory": "GHSA-27r3-jxmh-p828",
      "title": "body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body",
      "source": "https://github.com/advisories/GHSA-27r3-jxmh-p828",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "dashboard",
      "package": "deepmerge",
      "advisory": "GHSA-gcqx-w48m-w2h4",
      "title": "deepmerge mergeObject() allows prototype poisoning of returned objects",
      "source": "https://github.com/advisories/GHSA-gcqx-w48m-w2h4",
      "disposition": "remaining; no upstream compatible patched release selected"
    },
    {
      "scope": "dashboard",
      "package": "dompurify",
      "advisory": "GHSA-c6gr-qvv4-5v3f",
      "title": "DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml",
      "source": "https://github.com/advisories/GHSA-c6gr-qvv4-5v3f",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "dashboard",
      "package": "dompurify",
      "advisory": "GHSA-cg2g-xh64-v4q7",
      "title": "DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes",
      "source": "https://github.com/advisories/GHSA-cg2g-xh64-v4q7",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "dashboard",
      "package": "dompurify",
      "advisory": "GHSA-mrv2-3pqr-j5jr",
      "title": "DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)",
      "source": "https://github.com/advisories/GHSA-mrv2-3pqr-j5jr",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "dashboard",
      "package": "fast-uri",
      "advisory": "GHSA-333x-w4r6-6crp",
      "title": "fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references",
      "source": "https://github.com/advisories/GHSA-333x-w4r6-6crp",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "dashboard",
      "package": "fast-uri",
      "advisory": "GHSA-w74x-v6f9-j3xg",
      "title": "fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding",
      "source": "https://github.com/advisories/GHSA-w74x-v6f9-j3xg",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "dashboard",
      "package": "fast-uri",
      "advisory": "GHSA-wjr9-j795-jxcr",
      "title": "fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization",
      "source": "https://github.com/advisories/GHSA-wjr9-j795-jxcr",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "dashboard",
      "package": "fast-uri",
      "advisory": "GHSA-xhq7-xmqj-769h",
      "title": "fast-uri vulnerable to improper path equivalence in relative reference normalization",
      "source": "https://github.com/advisories/GHSA-xhq7-xmqj-769h",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "dashboard",
      "package": "glob",
      "advisory": "GHSA-3g3m-2fjr-6pw4",
      "title": "Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal",
      "source": "https://github.com/advisories/GHSA-3g3m-2fjr-6pw4",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "dashboard",
      "package": "minimatch",
      "advisory": "GHSA-g3hv-75wg-m249",
      "title": "minimatch has potential denial of service via globparts amplification",
      "source": "https://github.com/advisories/GHSA-g3hv-75wg-m249",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "dashboard",
      "package": "postcss-selector-parser",
      "advisory": "GHSA-rj75-hqrm-r3gf",
      "title": "PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion",
      "source": "https://github.com/advisories/GHSA-rj75-hqrm-r3gf",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "dashboard",
      "package": "qs",
      "advisory": "GHSA-4mjr-xmp4-gh2g",
      "title": "qs: Denial of Service via Attacker Controlled isBuffer",
      "source": "https://github.com/advisories/GHSA-4mjr-xmp4-gh2g",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "dashboard",
      "package": "qs",
      "advisory": "GHSA-6pq8-jhm2-2vcw",
      "title": "qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)",
      "source": "https://github.com/advisories/GHSA-6pq8-jhm2-2vcw",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "dashboard",
      "package": "qs",
      "advisory": "GHSA-q8mj-m7cp-5q26",
      "title": "qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set",
      "source": "https://github.com/advisories/GHSA-q8mj-m7cp-5q26",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "dashboard",
      "package": "qs",
      "advisory": "GHSA-x5fp-wj9c-mxmx",
      "title": "qs array-limit bypass via bracket-key comma parsing",
      "source": "https://github.com/advisories/GHSA-x5fp-wj9c-mxmx",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "dashboard",
      "package": "serialize-javascript",
      "advisory": "GHSA-m5mm-p8h7-m29v",
      "title": "Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body",
      "source": "https://github.com/advisories/GHSA-m5mm-p8h7-m29v",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "dashboard",
      "package": "vue-i18n",
      "advisory": "GHSA-83rm-6c8r-g728",
      "title": "Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages",
      "source": "https://github.com/advisories/GHSA-83rm-6c8r-g728",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "dashboard",
      "package": "vue-i18n",
      "advisory": "GHSA-8rc2-428q-7ww3",
      "title": "Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list",
      "source": "https://github.com/advisories/GHSA-8rc2-428q-7ww3",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "gashboard",
      "package": "@vue/server-renderer",
      "advisory": "GHSA-g2v6-rqmx-r4w6",
      "title": "@vue/server-renderer: XSS via missing CR in attribute-name blacklist",
      "source": "https://github.com/advisories/GHSA-g2v6-rqmx-r4w6",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "gashboard",
      "package": "body-parser",
      "advisory": "GHSA-27r3-jxmh-p828",
      "title": "body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body",
      "source": "https://github.com/advisories/GHSA-27r3-jxmh-p828",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "gashboard",
      "package": "body-parser",
      "advisory": "GHSA-v422-hmwv-36x6",
      "title": "body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement",
      "source": "https://github.com/advisories/GHSA-v422-hmwv-36x6",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "gashboard",
      "package": "brace-expansion",
      "advisory": "GHSA-3jxr-9vmj-r5cp",
      "title": "brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups",
      "source": "https://github.com/advisories/GHSA-3jxr-9vmj-r5cp",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "gashboard",
      "package": "brace-expansion",
      "advisory": "GHSA-6j4f-fj2g-mc7p",
      "title": "brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion",
      "source": "https://github.com/advisories/GHSA-6j4f-fj2g-mc7p",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "gashboard",
      "package": "brace-expansion",
      "advisory": "GHSA-mh99-v99m-4gvg",
      "title": "brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash",
      "source": "https://github.com/advisories/GHSA-mh99-v99m-4gvg",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "gashboard",
      "package": "brace-expansion",
      "advisory": "GHSA-q2hr-2g5m-vwhr",
      "title": "brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service",
      "source": "https://github.com/advisories/GHSA-q2hr-2g5m-vwhr",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "gashboard",
      "package": "brace-expansion",
      "advisory": "GHSA-qhr7-859c-m2p7",
      "title": "brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion",
      "source": "https://github.com/advisories/GHSA-qhr7-859c-m2p7",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "gashboard",
      "package": "brace-expansion",
      "advisory": "GHSA-rgw5-rvv9-x895",
      "title": "brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation",
      "source": "https://github.com/advisories/GHSA-rgw5-rvv9-x895",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "gashboard",
      "package": "esbuild",
      "advisory": "GHSA-67mh-4wv8-2f99",
      "title": "esbuild enables any website to send any requests to the development server and read the response",
      "source": "https://github.com/advisories/GHSA-67mh-4wv8-2f99",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "gashboard",
      "package": "minimatch",
      "advisory": "GHSA-g3hv-75wg-m249",
      "title": "minimatch has potential denial of service via globparts amplification",
      "source": "https://github.com/advisories/GHSA-g3hv-75wg-m249",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "gashboard",
      "package": "nanoid",
      "advisory": "GHSA-28wg-ghj8-5hjv",
      "title": "nanoid: non-secure generators can loop indefinitely with negative size",
      "source": "https://github.com/advisories/GHSA-28wg-ghj8-5hjv",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "gashboard",
      "package": "nanoid",
      "advisory": "GHSA-2v37-7h3g-55p8",
      "title": "nanoid: custom generators can loop indefinitely when size is zero",
      "source": "https://github.com/advisories/GHSA-2v37-7h3g-55p8",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "gashboard",
      "package": "path-to-regexp",
      "advisory": "GHSA-37ch-88jc-xwx2",
      "title": "path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters",
      "source": "https://github.com/advisories/GHSA-37ch-88jc-xwx2",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "gashboard",
      "package": "path-to-regexp",
      "advisory": "GHSA-rhx6-c78j-4q9w",
      "title": "path-to-regexp contains a ReDoS",
      "source": "https://github.com/advisories/GHSA-rhx6-c78j-4q9w",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "gashboard",
      "package": "postcss",
      "advisory": "GHSA-fxqj-rqcc-2cmp",
      "title": "PostCSS: incomplete fix of GHSA-6g55-p6wh-862q \u2014 attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset",
      "source": "https://github.com/advisories/GHSA-fxqj-rqcc-2cmp",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "gashboard",
      "package": "postcss",
      "advisory": "GHSA-r28c-9q8g-f849",
      "title": "PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure",
      "source": "https://github.com/advisories/GHSA-r28c-9q8g-f849",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "gashboard",
      "package": "proxy-addr",
      "advisory": "GHSA-jqcg-44mw-7w3h",
      "title": "proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet",
      "source": "https://github.com/advisories/GHSA-jqcg-44mw-7w3h",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "gashboard",
      "package": "qs",
      "advisory": "GHSA-4mjr-xmp4-gh2g",
      "title": "qs: Denial of Service via Attacker Controlled isBuffer",
      "source": "https://github.com/advisories/GHSA-4mjr-xmp4-gh2g",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "gashboard",
      "package": "qs",
      "advisory": "GHSA-6pq8-jhm2-2vcw",
      "title": "qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)",
      "source": "https://github.com/advisories/GHSA-6pq8-jhm2-2vcw",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "gashboard",
      "package": "qs",
      "advisory": "GHSA-6rw7-vpxm-498p",
      "title": "qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion",
      "source": "https://github.com/advisories/GHSA-6rw7-vpxm-498p",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "gashboard",
      "package": "qs",
      "advisory": "GHSA-q8mj-m7cp-5q26",
      "title": "qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set",
      "source": "https://github.com/advisories/GHSA-q8mj-m7cp-5q26",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "gashboard",
      "package": "qs",
      "advisory": "GHSA-w7fw-mjwx-w883",
      "title": "qs's arrayLimit bypass in comma parsing allows denial of service",
      "source": "https://github.com/advisories/GHSA-w7fw-mjwx-w883",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "gashboard",
      "package": "source-map-js",
      "advisory": "GHSA-68fv-2mgg-jv7q",
      "title": "source-map-js allows event-loop denial of service through indexed source-map section offsets",
      "source": "https://github.com/advisories/GHSA-68fv-2mgg-jv7q",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "gashboard",
      "package": "vite",
      "advisory": "GHSA-356w-63v5-8wf4",
      "title": "Vite has an `server.fs.deny` bypass with an invalid `request-target`",
      "source": "https://github.com/advisories/GHSA-356w-63v5-8wf4",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "gashboard",
      "package": "vite",
      "advisory": "GHSA-4r4m-qw57-chr8",
      "title": "Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query",
      "source": "https://github.com/advisories/GHSA-4r4m-qw57-chr8",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "gashboard",
      "package": "vite",
      "advisory": "GHSA-4w7w-66w2-5vf9",
      "title": "Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling",
      "source": "https://github.com/advisories/GHSA-4w7w-66w2-5vf9",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "gashboard",
      "package": "vite",
      "advisory": "GHSA-587h-7wmj-h5pm",
      "title": "launch-editor: `fs.existsSync()` existence check can be bypassed on Windows",
      "source": "https://github.com/advisories/GHSA-587h-7wmj-h5pm",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "gashboard",
      "package": "vite",
      "advisory": "GHSA-698v-4r3x-3vcv",
      "title": "launch-editor: escapeCmdArgs() omits % escaping on Windows",
      "source": "https://github.com/advisories/GHSA-698v-4r3x-3vcv",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "gashboard",
      "package": "vite",
      "advisory": "GHSA-859w-5945-r5v3",
      "title": "Vite's server.fs.deny bypassed with /. for files under project root",
      "source": "https://github.com/advisories/GHSA-859w-5945-r5v3",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "gashboard",
      "package": "vite",
      "advisory": "GHSA-93m4-6634-74q7",
      "title": "vite allows server.fs.deny bypass via backslash on Windows",
      "source": "https://github.com/advisories/GHSA-93m4-6634-74q7",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "gashboard",
      "package": "vite",
      "advisory": "GHSA-9jrq-w75r-8gcw",
      "title": "Vite: Cross origin script execution through Vite custom middleware",
      "source": "https://github.com/advisories/GHSA-9jrq-w75r-8gcw",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "gashboard",
      "package": "vite",
      "advisory": "GHSA-fx2h-pf6j-xcff",
      "title": "vite: `server.fs.deny` bypass on Windows alternate paths",
      "source": "https://github.com/advisories/GHSA-fx2h-pf6j-xcff",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "gashboard",
      "package": "vite",
      "advisory": "GHSA-g4jq-h2w9-997c",
      "title": "Vite middleware may serve files starting with the same name with the public directory",
      "source": "https://github.com/advisories/GHSA-g4jq-h2w9-997c",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "gashboard",
      "package": "vite",
      "advisory": "GHSA-jqfw-vq24-v9c3",
      "title": "Vite's `server.fs` settings were not applied to HTML files",
      "source": "https://github.com/advisories/GHSA-jqfw-vq24-v9c3",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "gashboard",
      "package": "vite",
      "advisory": "GHSA-p9ff-h696-f583",
      "title": "Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket",
      "source": "https://github.com/advisories/GHSA-p9ff-h696-f583",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "gashboard",
      "package": "vite",
      "advisory": "GHSA-r825-w8mm-5pxw",
      "title": "launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors",
      "source": "https://github.com/advisories/GHSA-r825-w8mm-5pxw",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "gashboard",
      "package": "vite",
      "advisory": "GHSA-rq7h-c2jc-7f22",
      "title": "Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine",
      "source": "https://github.com/advisories/GHSA-rq7h-c2jc-7f22",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "gashboard",
      "package": "vite",
      "advisory": "GHSA-v6wh-96g9-6wx3",
      "title": "launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows",
      "source": "https://github.com/advisories/GHSA-v6wh-96g9-6wx3",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "gashboard",
      "package": "vite",
      "advisory": "GHSA-vg6x-rcgg-rjx6",
      "title": "Websites were able to send any requests to the development server and read the response in vite",
      "source": "https://github.com/advisories/GHSA-vg6x-rcgg-rjx6",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "gashboard",
      "package": "vite",
      "advisory": "GHSA-x574-m823-4x7w",
      "title": "Vite bypasses server.fs.deny when using ?raw??",
      "source": "https://github.com/advisories/GHSA-x574-m823-4x7w",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "gashboard",
      "package": "vite",
      "advisory": "GHSA-xcj6-pq6g-qj4x",
      "title": "Vite allows server.fs.deny to be bypassed with .svg or relative paths",
      "source": "https://github.com/advisories/GHSA-xcj6-pq6g-qj4x",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "gashboard",
      "package": "zod",
      "advisory": "GHSA-mrhx-c7xc-m3w5",
      "title": "Zod can exhaust memory while validating oversized constrained collections",
      "source": "https://github.com/advisories/GHSA-mrhx-c7xc-m3w5",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "node Rust",
      "package": "anyhow",
      "advisory": "RUSTSEC-2026-0190",
      "title": "Unsoundness in `Error::downcast_mut()`",
      "source": "https://rustsec.org/advisories/RUSTSEC-2026-0190.html",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "node Rust",
      "package": "bytes",
      "advisory": "RUSTSEC-2026-0007",
      "title": "Integer overflow in `BytesMut::reserve`",
      "source": "https://rustsec.org/advisories/RUSTSEC-2026-0007.html",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "node Rust",
      "package": "h2",
      "advisory": "RUSTSEC-2026-0258",
      "title": "h2 unbounded empty DATA frames",
      "source": "https://rustsec.org/advisories/RUSTSEC-2026-0258.html",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "node Rust",
      "package": "instant",
      "advisory": "RUSTSEC-2024-0384",
      "title": "`instant` is unmaintained",
      "source": "https://rustsec.org/advisories/RUSTSEC-2024-0384.html",
      "disposition": "remaining; no upstream compatible patched release selected"
    },
    {
      "scope": "node Rust",
      "package": "libz-sys",
      "advisory": "RUSTSEC-2026-0418",
      "title": "libz-sys build script leaks environment variables in the build directory",
      "source": "https://rustsec.org/advisories/RUSTSEC-2026-0418.html",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "node Rust",
      "package": "negentropy",
      "advisory": "RUSTSEC-2026-0365",
      "title": " Remote DoS through unchecked `IdList` allocation in negentropy",
      "source": "https://rustsec.org/advisories/RUSTSEC-2026-0365.html",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "node Rust",
      "package": "paste",
      "advisory": "RUSTSEC-2024-0436",
      "title": "paste - no longer maintained",
      "source": "https://rustsec.org/advisories/RUSTSEC-2024-0436.html",
      "disposition": "remaining; no upstream compatible patched release selected"
    },
    {
      "scope": "node Rust",
      "package": "pin-utils",
      "advisory": "RUSTSEC-2026-0441",
      "title": "`pin-utils` is unmaintained",
      "source": "https://rustsec.org/advisories/RUSTSEC-2026-0441.html",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "node Rust",
      "package": "quick-xml",
      "advisory": "RUSTSEC-2026-0194",
      "title": "Quadratic run time when checking a start tag for duplicate attribute names",
      "source": "https://rustsec.org/advisories/RUSTSEC-2026-0194.html",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "node Rust",
      "package": "quick-xml",
      "advisory": "RUSTSEC-2026-0195",
      "title": "Unbounded namespace-declaration allocation in `NsReader` enables memory-exhaustion denial of service",
      "source": "https://rustsec.org/advisories/RUSTSEC-2026-0195.html",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "node Rust",
      "package": "rand",
      "advisory": "RUSTSEC-2026-0097",
      "title": "Rand is unsound with a custom logger using `rand::rng()`",
      "source": "https://rustsec.org/advisories/RUSTSEC-2026-0097.html",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "node Rust",
      "package": "rustls",
      "advisory": "RUSTSEC-2026-0285",
      "title": "TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries",
      "source": "https://rustsec.org/advisories/RUSTSEC-2026-0285.html",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "node Rust",
      "package": "rustls",
      "advisory": "RUSTSEC-2026-0346",
      "title": "`Debug` impls for client session values expose TLS secrets",
      "source": "https://rustsec.org/advisories/RUSTSEC-2026-0346.html",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "node Rust",
      "package": "rustls",
      "advisory": "RUSTSEC-2026-0348",
      "title": "Brotli certificate decompression can allocate up to 1 GiB before authentication",
      "source": "https://rustsec.org/advisories/RUSTSEC-2026-0348.html",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "node Rust",
      "package": "rustls",
      "advisory": "RUSTSEC-2026-0349",
      "title": "Unauthenticated ServerHello can downgrade later connections to classical key exchange",
      "source": "https://rustsec.org/advisories/RUSTSEC-2026-0349.html",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "node Rust",
      "package": "rustls-pemfile",
      "advisory": "RUSTSEC-2025-0134",
      "title": "rustls-pemfile is unmaintained",
      "source": "https://rustsec.org/advisories/RUSTSEC-2025-0134.html",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "node Rust",
      "package": "rustls-webpki",
      "advisory": "RUSTSEC-2026-0049",
      "title": "CRLs not considered authoritative by Distribution Point due to faulty matching logic",
      "source": "https://rustsec.org/advisories/RUSTSEC-2026-0049.html",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "node Rust",
      "package": "rustls-webpki",
      "advisory": "RUSTSEC-2026-0098",
      "title": "Name constraints for URI names were incorrectly accepted",
      "source": "https://rustsec.org/advisories/RUSTSEC-2026-0098.html",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "node Rust",
      "package": "rustls-webpki",
      "advisory": "RUSTSEC-2026-0099",
      "title": "Name constraints were accepted for certificates asserting a wildcard name",
      "source": "https://rustsec.org/advisories/RUSTSEC-2026-0099.html",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "node Rust",
      "package": "rustls-webpki",
      "advisory": "RUSTSEC-2026-0104",
      "title": "Reachable panic in certificate revocation list parsing",
      "source": "https://rustsec.org/advisories/RUSTSEC-2026-0104.html",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "node Rust",
      "package": "rustls-webpki",
      "advisory": "RUSTSEC-2026-0382",
      "title": "Certificate verification may accept distrusted intermediates",
      "source": "https://rustsec.org/advisories/RUSTSEC-2026-0382.html",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "node Rust",
      "package": "tar",
      "advisory": "RUSTSEC-2026-0067",
      "title": "`unpack_in` can chmod arbitrary directories by following symlinks",
      "source": "https://rustsec.org/advisories/RUSTSEC-2026-0067.html",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "node Rust",
      "package": "tar",
      "advisory": "RUSTSEC-2026-0068",
      "title": "tar-rs incorrectly ignores PAX size headers if header size is nonzero",
      "source": "https://rustsec.org/advisories/RUSTSEC-2026-0068.html",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "node Rust",
      "package": "unsafe-libyaml",
      "advisory": "RUSTSEC-2024-0449",
      "title": "unsafe-libyaml is unmaintained",
      "source": "https://rustsec.org/advisories/RUSTSEC-2024-0449.html",
      "disposition": "remaining; no upstream compatible patched release selected"
    },
    {
      "scope": "node Rust",
      "package": "webpki-roots",
      "advisory": "RUSTSEC-2026-0381",
      "title": "Bundled root certificates allow trust in distrusted emSign intermediates",
      "source": "https://rustsec.org/advisories/RUSTSEC-2026-0381.html",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "node Rust",
      "package": "zip",
      "advisory": "RUSTSEC-2026-0367",
      "title": " Insecure Preservation of SUID/SGID Bits during ZIP Extraction Leading to Potential Privilege Escalation",
      "source": "https://rustsec.org/advisories/RUSTSEC-2026-0367.html",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "node Rust",
      "package": "zip",
      "advisory": "RUSTSEC-2026-0368",
      "title": "zip: `ZipArchive::extract` creates symbolic links whose attacker-controlled targets are outside the destination directory",
      "source": "https://rustsec.org/advisories/RUSTSEC-2026-0368.html",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "node Rust",
      "package": "zip",
      "advisory": "RUSTSEC-2026-0369",
      "title": "ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the target",
      "source": "https://rustsec.org/advisories/RUSTSEC-2026-0369.html",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "node Rust",
      "package": "zip",
      "advisory": "RUSTSEC-2026-0429",
      "title": "zip: `ZipArchive::extract` aborts the process on a symlink entry with a large declared size",
      "source": "https://rustsec.org/advisories/RUSTSEC-2026-0429.html",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "router",
      "package": "body-parser",
      "advisory": "GHSA-27r3-jxmh-p828",
      "title": "body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body",
      "source": "https://github.com/advisories/GHSA-27r3-jxmh-p828",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "router",
      "package": "body-parser",
      "advisory": "GHSA-v422-hmwv-36x6",
      "title": "body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement",
      "source": "https://github.com/advisories/GHSA-v422-hmwv-36x6",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "router",
      "package": "ip",
      "advisory": "GHSA-2p57-rm9w-gvfp",
      "title": "ip SSRF improper categorization in isPublic",
      "source": "https://github.com/advisories/GHSA-2p57-rm9w-gvfp",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "router",
      "package": "path-to-regexp",
      "advisory": "GHSA-37ch-88jc-xwx2",
      "title": "path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters",
      "source": "https://github.com/advisories/GHSA-37ch-88jc-xwx2",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "router",
      "package": "proxy-addr",
      "advisory": "GHSA-jqcg-44mw-7w3h",
      "title": "proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet",
      "source": "https://github.com/advisories/GHSA-jqcg-44mw-7w3h",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "router",
      "package": "qs",
      "advisory": "GHSA-4mjr-xmp4-gh2g",
      "title": "qs: Denial of Service via Attacker Controlled isBuffer",
      "source": "https://github.com/advisories/GHSA-4mjr-xmp4-gh2g",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "router",
      "package": "qs",
      "advisory": "GHSA-6pq8-jhm2-2vcw",
      "title": "qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)",
      "source": "https://github.com/advisories/GHSA-6pq8-jhm2-2vcw",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "router",
      "package": "qs",
      "advisory": "GHSA-q8mj-m7cp-5q26",
      "title": "qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set",
      "source": "https://github.com/advisories/GHSA-q8mj-m7cp-5q26",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "router",
      "package": "qs",
      "advisory": "GHSA-w7fw-mjwx-w883",
      "title": "qs's arrayLimit bypass in comma parsing allows denial of service",
      "source": "https://github.com/advisories/GHSA-w7fw-mjwx-w883",
      "disposition": "not reported by current scan after dependency update; runtime qualification pending"
    },
    {
      "scope": "Python resolved runtime/build graph",
      "package": "ecdsa",
      "version": "0.19.2",
      "parent": "esptool==4.8.1",
      "advisory": "GHSA-wj6h-64fc-37mp",
      "aliases": [
        "CVE-2024-23342",
        "PYSEC-2026-1325"
      ],
      "title": "Minerva timing attack on P-256 in python-ecdsa",
      "source": "https://github.com/tlsfuzzer/python-ecdsa/security/advisories/GHSA-wj6h-64fc-37mp",
      "disposition": "removed from the current resolved Python runtime/build graph by the esptool5.6.0 migration; no advisory suppression; frozen-artifact and physical ESP acceptance remain pending",
      "reachability": "Historical esptool4.8.1 brought ecdsa0.19.2. Pinned esptool5.6.0 declares cryptography instead; all23 newly resolved coordinates and exact artifact hashes are recorded, with ecdsa absent and zero OSV findings. Real v5 source CLI/resource/reset/PTY tests pass. This does not prove old installed artifacts have been replaced.",
      "next_action": "Parent isolated flash.rs regression, then later immutable frozen-binary content/self-test qualification and authorized physical ESP serial workflow acceptance. No release or live flash performed by this source change.",
      "evidence": [
        "/home/archipelago/Reports/next-release-nine-issues-20261109/python-osv-resolved-r1.json",
        "/home/archipelago/Reports/next-release-nine-issues-20261109/python-resolution-linux-x86_64-r1.json",
        "/home/archipelago/Reports/next-release-nine-issues-20261109/python-resolution-linux-x86_64-r2.json",
        "/home/archipelago/Reports/next-release-nine-issues-20261109/python-osv-resolved-r2.json",
        "docs/security/2.1-beta-esptool-v5.md"
      ],
      "migration_sources": [
        "https://github.com/espressif/esptool/blob/v5.6.0/pyproject.toml",
        "https://github.com/espressif/esptool/blob/v5.6.0/esptool/__init__.py",
        "https://docs.espressif.com/projects/esptool/en/latest/esp32/migration-guide.html"
      ]
    }
  ],
  "license_review_items": [
    {
      "packages": [
        "rns@1.3.5",
        "lxmf@1.0.1"
      ],
      "terms": "Reticulum License (custom use restrictions and notice retention)",
      "status": "declared; usage and distribution obligations require review, not MIT"
    },
    {
      "packages": [
        "pyinstaller@6.21.0",
        "pyinstaller-hooks-contrib@2026.9"
      ],
      "terms": "GPL and Apache file scopes; PyInstaller bootloader exception and isolated-module MIT alternative",
      "status": "declared; apply exact file scope and preserve dependency obligations"
    },
    {
      "packages": [
        "esptool@5.6.0"
      ],
      "terms": "GPL-2.0-or-later with additional bundled stub notices",
      "status": "declared; frozen artifact contents and notices remain unqualified"
    },
    {
      "packages": [
        "rns@1.3.5"
      ],
      "terms": "Published wheel and sdist omit LICENSE despite metadata declaration",
      "status": "exact release-tag commit LICENSE retained as source evidence; ensure distributed notices include applicable terms"
    }
  ],
  "python_resolution_scope": {
    "environment": {
      "implementation_name": "cpython",
      "implementation_version": "3.13.5",
      "os_name": "posix",
      "platform_machine": "x86_64",
      "platform_release": "6.12.113+deb13-amd64",
      "platform_system": "Linux",
      "platform_version": "#1 SMP PREEMPT_DYNAMIC Debian 6.12.113-1 (2026-10-15)",
      "python_full_version": "3.13.5",
      "platform_python_implementation": "CPython",
      "python_version": "3.13",
      "sys_platform": "linux"
    },
    "components": 20,
    "roots": [
      "esptool==4.8.1",
      "lxmf==1.0.1",
      "pyinstaller==6.21.0",
      "rns==1.3.5"
    ],
    "qualification": "20 coordinates queried; one high finding represented by GHSA/PYSEC aliases; platform-specific point-in-time report, not a checked-in lock"
  }
}