all missions

2 repos indexed1 skipped…

Every open mission across every indexed repo, one list. Looking for one repo? Browse repos instead.

Impact

Ecosystem

Effort

Group by repoSort

Criticalnpm
Update @tauri-apps/plugin-shell to fix a critical vulnerability
Low effort SpIob/FlowState ⚠ low confidence
Claimed · @SpIob5.6/10
Improper Scope Validation in the `open` Endpoint of `tauri-plugin-shell` Affects @tauri-apps/plugin-shell (declared as "^2.3.5"), used as a production dependency of this repo. Severity: critical. Source: GHSA-c9pr-q8gx-3mgp (GHSA).
Upgrade @tauri-apps/plugin-shell to 2.2.1 or later (minor version bump).
⚠ Low confidenceSpIob/FlowState
Claimed by @SpIob
▸Why this score?
Formula
0.60 × impact (9.0) + 0.40 × ecosystem value (0.5) = 5.6
Impact inputs
CVSS: unknown
Severity: critical
Dependency type: production
Advisory age: 475d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-c9pr-q8gx-3mgp for @tauri-apps/plugin-shell
CriticalGo
Update golang.org/x/crypto to fix a critical vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
5.4/10
golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: critical. Source: GHSA-x527-x647-q7gg (GHSA).
Upgrade golang.org/x/crypto to 0.52.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (9.0) + 0.40 × ecosystem value (0.0) = 5.4
Impact inputs
CVSS: unknown
Severity: critical
Dependency type: production
Advisory age: 31d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-x527-x647-q7gg for golang.org/x/crypto
CriticalGo
Update golang.org/x/crypto to fix a critical vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
5.4/10
golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: critical. Source: GHSA-5cgq-3rg8-m6cv (GHSA).
Upgrade golang.org/x/crypto to 0.52.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (9.0) + 0.40 × ecosystem value (0.0) = 5.4
Impact inputs
CVSS: unknown
Severity: critical
Dependency type: production
Advisory age: 31d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-5cgq-3rg8-m6cv for golang.org/x/crypto
CriticalGo
Update golang.org/x/crypto to fix a critical vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
5.4/10
golang.org/x/crypto vulnerable to infinite loop on large channel writes Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: critical. Source: GHSA-rm3j-f69w-wqmq (GHSA).
Upgrade golang.org/x/crypto to 0.52.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (9.0) + 0.40 × ecosystem value (0.0) = 5.4
Impact inputs
CVSS: unknown
Severity: critical
Dependency type: production
Advisory age: 31d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-rm3j-f69w-wqmq for golang.org/x/crypto
CriticalGo
Update golang.org/x/crypto to fix a critical vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
5.4/10
golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: critical. Source: GHSA-89gr-r52h-f8rx (GHSA).
Upgrade golang.org/x/crypto to 0.52.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (9.0) + 0.40 × ecosystem value (0.0) = 5.4
Impact inputs
CVSS: unknown
Severity: critical
Dependency type: production
Advisory age: 31d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-89gr-r52h-f8rx for golang.org/x/crypto
CriticalGo
Update golang.org/x/crypto to fix a critical vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
5.4/10
golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: critical. Source: GHSA-vgwf-h737-ff37 (GHSA).
Upgrade golang.org/x/crypto to 0.52.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (9.0) + 0.40 × ecosystem value (0.0) = 5.4
Impact inputs
CVSS: unknown
Severity: critical
Dependency type: production
Advisory age: 31d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-vgwf-h737-ff37 for golang.org/x/crypto
CriticalGo
Update golang.org/x/crypto to fix a critical vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
5.4/10
golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: critical. Source: GHSA-f5wc-c3c7-36mc (GHSA).
Upgrade golang.org/x/crypto to 0.52.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (9.0) + 0.40 × ecosystem value (0.0) = 5.4
Impact inputs
CVSS: unknown
Severity: critical
Dependency type: production
Advisory age: 31d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-f5wc-c3c7-36mc for golang.org/x/crypto
CriticalGo
Update golang.org/x/crypto to fix a critical vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
5.4/10
golang.org/x/crypto doesn't enforce invoking key constraints Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: critical. Source: GHSA-jppx-rxg9-jmrx (GHSA).
Upgrade golang.org/x/crypto to 0.52.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (9.0) + 0.40 × ecosystem value (0.0) = 5.4
Impact inputs
CVSS: unknown
Severity: critical
Dependency type: production
Advisory age: 31d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-jppx-rxg9-jmrx for golang.org/x/crypto
CriticalGo
Update golang.org/x/crypto to fix a critical vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
5.4/10
Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: critical. Source: GHSA-v778-237x-gjrc (GHSA).
Upgrade golang.org/x/crypto to 0.31.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (9.0) + 0.40 × ecosystem value (0.0) = 5.4
Impact inputs
CVSS: unknown
Severity: critical
Dependency type: production
Advisory age: 592d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-v778-237x-gjrc for golang.org/x/crypto
HighGo
Update golang.org/x/crypto to fix a high vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
4.2/10
golang.org/x/crypto: Invoking pathological RSA/DSA parameters may cause DoS Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: high. Source: GHSA-w879-237q-wc7r (GHSA).
Upgrade golang.org/x/crypto to 0.52.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (7.0) + 0.40 × ecosystem value (0.0) = 4.2
Impact inputs
CVSS: unknown
Severity: high
Dependency type: production
Advisory age: 31d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-w879-237q-wc7r for golang.org/x/crypto
HighGo
Update golang.org/x/crypto to fix a high vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
4.2/10
golang.org/x/crypto: Invoking byte arithmetic causes underflow and panic Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: high. Source: GHSA-q4h4-gmj2-qvw2 (GHSA).
Upgrade golang.org/x/crypto to 0.52.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (7.0) + 0.40 × ecosystem value (0.0) = 4.2
Impact inputs
CVSS: unknown
Severity: high
Dependency type: production
Advisory age: 31d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-q4h4-gmj2-qvw2 for golang.org/x/crypto
HighGo
Update golang.org/x/crypto to fix a high vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
4.2/10
golang.org/x/crypto Vulnerable to Denial of Service (DoS) via Slow or Incomplete Key Exchange Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: high. Source: GHSA-hcg3-q754-cr77 (GHSA).
Upgrade golang.org/x/crypto to 0.35.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (7.0) + 0.40 × ecosystem value (0.0) = 4.2
Impact inputs
CVSS: unknown
Severity: high
Dependency type: production
Advisory age: 470d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-hcg3-q754-cr77 for golang.org/x/crypto
HighGo
Update golang.org/x/crypto to fix a high vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
4.2/10
golang.org/x/crypto/ssh Man-in-the-Middle attack Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: high. Source: GHSA-xhjq-w7xm-p8qj (GHSA).
Upgrade golang.org/x/crypto to 0.0.0-20170330155735-e4e2799dd7aa or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (7.0) + 0.40 × ecosystem value (0.0) = 4.2
Impact inputs
CVSS: unknown
Severity: high
Dependency type: production
Advisory age: 1265d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-xhjq-w7xm-p8qj for golang.org/x/crypto
HighGo
Update golang.org/x/crypto to fix a high vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
4.2/10
x/crypto/ssh vulnerable to panic via malformed packets Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: high. Source: GHSA-gwc9-m7rh-j2ww (GHSA).
Upgrade golang.org/x/crypto to 0.0.0-20211202192323-5770296d904e or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (7.0) + 0.40 × ecosystem value (0.0) = 4.2
Impact inputs
CVSS: unknown
Severity: high
Dependency type: production
Advisory age: 1419d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-gwc9-m7rh-j2ww for golang.org/x/crypto
HighGo
Update golang.org/x/crypto to fix a high vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
4.2/10
golang.org/x/crypto/ssh NULL Pointer Dereference vulnerability Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: high. Source: GHSA-3vm4-22fp-5rfm (GHSA).
Upgrade golang.org/x/crypto to 0.0.0-20201216223049-8b5274cf687f or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (7.0) + 0.40 × ecosystem value (0.0) = 4.2
Impact inputs
CVSS: unknown
Severity: high
Dependency type: production
Advisory age: 1524d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-3vm4-22fp-5rfm for golang.org/x/crypto
HighGo
Update golang.org/x/crypto to fix a high vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
4.2/10
golang.org/x/crypto/ssh Denial of service via crafted Signer Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: high. Source: GHSA-8c26-wmh5-6g9v (GHSA).
Upgrade golang.org/x/crypto to 0.0.0-20220314234659-1baeb1ce4c0b or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (7.0) + 0.40 × ecosystem value (0.0) = 4.2
Impact inputs
CVSS: unknown
Severity: high
Dependency type: production
Advisory age: 1591d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-8c26-wmh5-6g9v for golang.org/x/crypto
HighGo
Update golang.org/x/crypto to fix a high vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
4.2/10
Helm uses crypto package vulnerable to panic from malformed X.509 certificate Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: high. Source: GHSA-cjjc-xp8v-855w (GHSA).
Upgrade golang.org/x/crypto to 0.0.0-20200124225646-8b5121be2f68 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (7.0) + 0.40 × ecosystem value (0.0) = 4.2
Impact inputs
CVSS: unknown
Severity: high
Dependency type: production
Advisory age: 1859d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-cjjc-xp8v-855w for golang.org/x/crypto
HighGo
Update golang.org/x/crypto to fix a high vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
4.2/10
Improper Verification of Cryptographic Signature in golang.org/x/crypto Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: high. Source: GHSA-ffhg-7mh4-33c4 (GHSA).
Upgrade golang.org/x/crypto to 0.0.0-20200220183623-bac4c82f6975 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (7.0) + 0.40 × ecosystem value (0.0) = 4.2
Impact inputs
CVSS: unknown
Severity: high
Dependency type: production
Advisory age: 1895d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-ffhg-7mh4-33c4 for golang.org/x/crypto
Highnpm
Update react to fix a high vulnerability
High effort SpIob/FlowState ⚠ low confidence
4.4/10
Cross-Site Scripting in react Affects react (declared as "^19.1.0"), used as a production dependency of this repo. Severity: high. Source: GHSA-hg79-j56m-fxgv (GHSA).
Upgrade react to 0.14.0 or later (major version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (7.0) + 0.40 × ecosystem value (0.5) = 4.4
Impact inputs
CVSS: unknown
Severity: high
Dependency type: production
Advisory age: 2146d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-hg79-j56m-fxgv for react
Highnpm
Update xterm to fix a high vulnerability
High effort SpIob/FlowState ⚠ low confidence
4.4/10
xterm vulnerable to remote code execution Affects xterm (declared as "^5.3.0"), used as a production dependency of this repo. Severity: high. Source: GHSA-mc23-976p-j42x (GHSA).
Upgrade xterm to 3.8.1 or later (major version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (7.0) + 0.40 × ecosystem value (0.5) = 4.4
Impact inputs
CVSS: unknown
Severity: high
Dependency type: production
Advisory age: 2745d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-mc23-976p-j42x for xterm
MediumGo
Update golang.org/x/crypto to fix a medium vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
3.0/10
golang.org/x/crypto: Invoking memory leak when rejecting channels can lead to DoS Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: medium. Source: GHSA-qpw4-5x99-6vjp (GHSA).
Upgrade golang.org/x/crypto to 0.52.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (5.0) + 0.40 × ecosystem value (0.0) = 3.0
Impact inputs
CVSS: unknown
Severity: medium
Dependency type: production
Advisory age: 31d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-qpw4-5x99-6vjp for golang.org/x/crypto
MediumGo
Update golang.org/x/crypto to fix a medium vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
3.0/10
golang.org/x/crypto is vulnerable to invoking server panic during CheckHostKey/Authenticate flow Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: medium. Source: GHSA-78mq-xcr3-xm33 (GHSA).
Upgrade golang.org/x/crypto to 0.52.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (5.0) + 0.40 × ecosystem value (0.0) = 3.0
Impact inputs
CVSS: unknown
Severity: medium
Dependency type: production
Advisory age: 31d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-78mq-xcr3-xm33 for golang.org/x/crypto
MediumGo
Update golang.org/x/crypto to fix a medium vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
3.0/10
golang.org/x/crypto vulnerable to invoking bypass of certificate restrictions Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: medium. Source: GHSA-45gg-vh54-h5m9 (GHSA).
Upgrade golang.org/x/crypto to 0.52.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (5.0) + 0.40 × ecosystem value (0.0) = 3.0
Impact inputs
CVSS: unknown
Severity: medium
Dependency type: production
Advisory age: 31d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-45gg-vh54-h5m9 for golang.org/x/crypto
MediumGo
Update golang.org/x/crypto to fix a medium vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
3.0/10
golang.org/x/crypto: Invoking pathological inputs can lead to client panic Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: medium. Source: GHSA-9m57-25v3-79x9 (GHSA).
Upgrade golang.org/x/crypto to 0.52.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (5.0) + 0.40 × ecosystem value (0.0) = 3.0
Impact inputs
CVSS: unknown
Severity: medium
Dependency type: production
Advisory age: 31d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-9m57-25v3-79x9 for golang.org/x/crypto
MediumGo
Update golang.org/x/crypto to fix a medium vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
3.0/10
golang.org/x/crypto/ssh/agent vulnerable to panic if message is malformed due to out of bounds read Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: medium. Source: GHSA-f6x5-jh6r-wrfv (GHSA).
Upgrade golang.org/x/crypto to 0.45.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (5.0) + 0.40 × ecosystem value (0.0) = 3.0
Impact inputs
CVSS: unknown
Severity: medium
Dependency type: production
Advisory age: 249d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-f6x5-jh6r-wrfv for golang.org/x/crypto
MediumGo
Update golang.org/x/crypto to fix a medium vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
3.0/10
golang.org/x/crypto/ssh allows an attacker to cause unbounded memory consumption Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: medium. Source: GHSA-j5w8-q4qc-rx2x (GHSA).
Upgrade golang.org/x/crypto to 0.45.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (5.0) + 0.40 × ecosystem value (0.0) = 3.0
Impact inputs
CVSS: unknown
Severity: medium
Dependency type: production
Advisory age: 249d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-j5w8-q4qc-rx2x for golang.org/x/crypto
MediumGo
Update golang.org/x/crypto to fix a medium vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
3.0/10
Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: medium. Source: GHSA-45x7-px36-x8w8 (GHSA).
Upgrade golang.org/x/crypto to 0.17.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (5.0) + 0.40 × ecosystem value (0.0) = 3.0
Impact inputs
CVSS: unknown
Severity: medium
Dependency type: production
Advisory age: 951d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-45x7-px36-x8w8 for golang.org/x/crypto
MediumGo
Update golang.org/x/crypto to fix a medium vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
3.0/10
Golang/x/crypto message forgery vulnerability Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: medium. Source: GHSA-x3jr-pf6g-c48f (GHSA).
Upgrade golang.org/x/crypto to 0.0.0-20190424203555-c05e17bb3b2d or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (5.0) + 0.40 × ecosystem value (0.0) = 3.0
Impact inputs
CVSS: unknown
Severity: medium
Dependency type: production
Advisory age: 1524d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-x3jr-pf6g-c48f for golang.org/x/crypto
MediumGo
Update golang.org/x/crypto to fix a medium vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
3.0/10
golang.org/x/crypto/salsa20/salsa uses insufficiently random values Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: medium. Source: GHSA-r5c5-pr8j-pfp7 (GHSA).
Upgrade golang.org/x/crypto to 0.0.0-20190320223903-b7391e95e576 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (5.0) + 0.40 × ecosystem value (0.0) = 3.0
Impact inputs
CVSS: unknown
Severity: medium
Dependency type: production
Advisory age: 1524d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-r5c5-pr8j-pfp7 for golang.org/x/crypto
Mediumnpm
Update react to fix a medium vulnerability
High effort SpIob/FlowState ⚠ low confidence
3.2/10
Cross-Site Scripting in react Affects react (declared as "^19.1.0"), used as a production dependency of this repo. Severity: medium. Source: GHSA-g53w-52xc-2j85 (GHSA).
Upgrade react to 0.4.2 or later (major version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (5.0) + 0.40 × ecosystem value (0.5) = 3.2
Impact inputs
CVSS: unknown
Severity: medium
Dependency type: production
Advisory age: 2146d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-g53w-52xc-2j85 for react
Mediumnpm
Update react-dom to fix a medium vulnerability
High effort SpIob/FlowState ⚠ low confidence
3.2/10
Cross-Site Scripting in react-dom Affects react-dom (declared as "^19.1.0"), used as a production dependency of this repo. Severity: medium. Source: GHSA-mvjj-gqq2-p4hw (GHSA).
Upgrade react-dom to 16.0.1 or later (major version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (5.0) + 0.40 × ecosystem value (0.5) = 3.2
Impact inputs
CVSS: unknown
Severity: medium
Dependency type: production
Advisory age: 2755d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-mvjj-gqq2-p4hw for react-dom
Highnpm
Update @tauri-apps/cli to fix a high vulnerability
Medium effort SpIob/FlowState ⚠ low confidence
1.9/10
Tauri's Updater Private Keys Possibly Leaked via Vite Environment Variables Affects @tauri-apps/cli (declared as "^2"), used as a development dependency of this repo. Severity: high. Source: GHSA-2rcp-jvr4-r259 (GHSA).
Upgrade @tauri-apps/cli to 2.0.0-alpha.16 or later (version bump size unknown).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.8) + 0.40 × ecosystem value (0.5) = 1.9
Impact inputs
CVSS: unknown
Severity: high
Dependency type: development
Advisory age: 1005d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: unknown
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-2rcp-jvr4-r259 for @tauri-apps/cli
Highnpm
Update vite to fix a high vulnerability
High effort SpIob/FlowState ⚠ low confidence
1.9/10
vite: `server.fs.deny` bypass on Windows alternate paths Affects vite (declared as "^7.0.4"), used as a development dependency of this repo. Severity: high. Source: GHSA-fx2h-pf6j-xcff (GHSA).
Upgrade vite to 8.0.16 or later (major version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.8) + 0.40 × ecosystem value (0.5) = 1.9
Impact inputs
CVSS: unknown
Severity: high
Dependency type: development
Advisory age: 36d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-fx2h-pf6j-xcff for vite
Highnpm
Update vite to fix a high vulnerability
High effort SpIob/FlowState ⚠ low confidence
1.9/10
launch-editor vulnerable to command injection via the crafted request on Windows Affects vite (declared as "^7.0.4"), used as a development dependency of this repo. Severity: high. Source: GHSA-c27g-q93r-2cwf (GHSA).
Upgrade vite to 2.9.0 or later (major version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.8) + 0.40 × ecosystem value (0.5) = 1.9
Impact inputs
CVSS: unknown
Severity: high
Dependency type: development
Advisory age: 48d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-c27g-q93r-2cwf for vite
Highnpm
Update vite to fix a high vulnerability
High effort SpIob/FlowState ⚠ low confidence
1.9/10
Vite: `server.fs.deny` bypassed with queries Affects vite (declared as "^7.0.4"), used as a development dependency of this repo. Severity: high. Source: GHSA-v2wj-q39q-566r (GHSA).
Upgrade vite to 8.0.5 or later (major version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.8) + 0.40 × ecosystem value (0.5) = 1.9
Impact inputs
CVSS: unknown
Severity: high
Dependency type: development
Advisory age: 106d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-v2wj-q39q-566r for vite
Highnpm
Update vite to fix a high vulnerability
High effort SpIob/FlowState ⚠ low confidence
1.9/10
Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket Affects vite (declared as "^7.0.4"), used as a development dependency of this repo. Severity: high. Source: GHSA-p9ff-h696-f583 (GHSA).
Upgrade vite to 8.0.5 or later (major version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.8) + 0.40 × ecosystem value (0.5) = 1.9
Impact inputs
CVSS: unknown
Severity: high
Dependency type: development
Advisory age: 106d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-p9ff-h696-f583 for vite
Highnpm
Update vite to fix a high vulnerability
High effort SpIob/FlowState ⚠ low confidence
1.9/10
Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem Affects vite (declared as "^7.0.4"), used as a development dependency of this repo. Severity: high. Source: GHSA-c24v-8rfc-w8vw (GHSA).
Upgrade vite to 2.9.17 or later (major version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.8) + 0.40 × ecosystem value (0.5) = 1.9
Impact inputs
CVSS: unknown
Severity: high
Dependency type: development
Advisory age: 914d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-c24v-8rfc-w8vw for vite
Highnpm
Update vite to fix a high vulnerability
High effort SpIob/FlowState ⚠ low confidence
1.9/10
Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//) Affects vite (declared as "^7.0.4"), used as a development dependency of this repo. Severity: high. Source: GHSA-353f-5xf4-qw67 (GHSA).
Upgrade vite to 2.9.16 or later (major version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.8) + 0.40 × ecosystem value (0.5) = 1.9
Impact inputs
CVSS: unknown
Severity: high
Dependency type: development
Advisory age: 1142d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-353f-5xf4-qw67 for vite
Highnpm
Update vite to fix a high vulnerability
High effort SpIob/FlowState ⚠ low confidence
1.9/10
Vite before v2.9.13 vulnerable to directory traversal via crafted URL to victim's service Affects vite (declared as "^7.0.4"), used as a development dependency of this repo. Severity: high. Source: GHSA-mv48-hcvh-8jj8 (GHSA).
Upgrade vite to 2.9.13 or later (major version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.8) + 0.40 × ecosystem value (0.5) = 1.9
Impact inputs
CVSS: unknown
Severity: high
Dependency type: development
Advisory age: 1433d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-mv48-hcvh-8jj8 for vite
Mediumnpm
Update postcss to fix a medium vulnerability
Trivial effort SpIob/FlowState ⚠ low confidence
1.4/10
PostCSS has XSS via Unescaped </style> in its CSS Stringify Output Affects postcss (declared as "^8.5.15"), used as a development dependency of this repo. Severity: medium. Source: GHSA-qx2v-qp2m-jg93 (GHSA).
Upgrade postcss to 8.5.10 or later (patch version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.0) + 0.40 × ecosystem value (0.5) = 1.4
Impact inputs
CVSS: unknown
Severity: medium
Dependency type: development
Advisory age: 88d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: patch
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-qx2v-qp2m-jg93 for postcss
Mediumnpm
Update vite to fix a medium vulnerability
Low effort SpIob/FlowState ⚠ low confidence
1.4/10
vite allows server.fs.deny bypass via backslash on Windows Affects vite (declared as "^7.0.4"), used as a development dependency of this repo. Severity: medium. Source: GHSA-93m4-6634-74q7 (GHSA).
Upgrade vite to 7.1.11 or later (minor version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.0) + 0.40 × ecosystem value (0.5) = 1.4
Impact inputs
CVSS: unknown
Severity: medium
Dependency type: development
Advisory age: 274d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-93m4-6634-74q7 for vite
Mediumnpm
Update postcss to fix a medium vulnerability
Low effort SpIob/FlowState ⚠ low confidence
1.4/10
PostCSS line return parsing error Affects postcss (declared as "^8.5.15"), used as a development dependency of this repo. Severity: medium. Source: GHSA-7fh5-64p2-3v2j (GHSA).
Upgrade postcss to 8.4.31 or later (minor version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.0) + 0.40 × ecosystem value (0.5) = 1.4
Impact inputs
CVSS: unknown
Severity: medium
Dependency type: development
Advisory age: 1026d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-7fh5-64p2-3v2j for postcss
Mediumnpm
Update postcss to fix a medium vulnerability
Low effort SpIob/FlowState ⚠ low confidence
1.4/10
Regular Expression Denial of Service in postcss Affects postcss (declared as "^8.5.15"), used as a development dependency of this repo. Severity: medium. Source: GHSA-566m-qj78-rww5 (GHSA).
Upgrade postcss to 8.2.13 or later (minor version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.0) + 0.40 × ecosystem value (0.5) = 1.4
Impact inputs
CVSS: unknown
Severity: medium
Dependency type: development
Advisory age: 1657d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-566m-qj78-rww5 for postcss
Mediumnpm
Update vite to fix a medium vulnerability
High effort SpIob/FlowState ⚠ low confidence
1.4/10
launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows Affects vite (declared as "^7.0.4"), used as a development dependency of this repo. Severity: medium. Source: GHSA-v6wh-96g9-6wx3 (GHSA).
Upgrade vite to 2.14.1 or later (major version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.0) + 0.40 × ecosystem value (0.5) = 1.4
Impact inputs
CVSS: unknown
Severity: medium
Dependency type: development
Advisory age: 36d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-v6wh-96g9-6wx3 for vite
Mediumnpm
Update vite to fix a medium vulnerability
High effort SpIob/FlowState ⚠ low confidence
1.4/10
Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling Affects vite (declared as "^7.0.4"), used as a development dependency of this repo. Severity: medium. Source: GHSA-4w7w-66w2-5vf9 (GHSA).
Upgrade vite to 8.0.5 or later (major version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.0) + 0.40 × ecosystem value (0.5) = 1.4
Impact inputs
CVSS: unknown
Severity: medium
Dependency type: development
Advisory age: 106d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-4w7w-66w2-5vf9 for vite
Mediumnpm
Update vite to fix a medium vulnerability
High effort SpIob/FlowState ⚠ low confidence
1.4/10
Vite's server.fs.deny bypassed with /. for files under project root Affects vite (declared as "^7.0.4"), used as a development dependency of this repo. Severity: medium. Source: GHSA-859w-5945-r5v3 (GHSA).
Upgrade vite to 6.3.4 or later (major version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.0) + 0.40 × ecosystem value (0.5) = 1.4
Impact inputs
CVSS: unknown
Severity: medium
Dependency type: development
Advisory age: 447d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-859w-5945-r5v3 for vite
Mediumnpm
Update vite to fix a medium vulnerability
High effort SpIob/FlowState ⚠ low confidence
1.4/10
Vite has an `server.fs.deny` bypass with an invalid `request-target` Affects vite (declared as "^7.0.4"), used as a development dependency of this repo. Severity: medium. Source: GHSA-356w-63v5-8wf4 (GHSA).
Upgrade vite to 6.2.6 or later (major version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.0) + 0.40 × ecosystem value (0.5) = 1.4
Impact inputs
CVSS: unknown
Severity: medium
Dependency type: development
Advisory age: 466d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-356w-63v5-8wf4 for vite
Mediumnpm
Update vite to fix a medium vulnerability
High effort SpIob/FlowState ⚠ low confidence
1.4/10
Vite allows server.fs.deny to be bypassed with .svg or relative paths Affects vite (declared as "^7.0.4"), used as a development dependency of this repo. Severity: medium. Source: GHSA-xcj6-pq6g-qj4x (GHSA).
Upgrade vite to 6.2.5 or later (major version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.0) + 0.40 × ecosystem value (0.5) = 1.4
Impact inputs
CVSS: unknown
Severity: medium
Dependency type: development
Advisory age: 473d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-xcj6-pq6g-qj4x for vite
Mediumnpm
Update vite to fix a medium vulnerability
High effort SpIob/FlowState ⚠ low confidence
1.4/10
Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query Affects vite (declared as "^7.0.4"), used as a development dependency of this repo. Severity: medium. Source: GHSA-4r4m-qw57-chr8 (GHSA).
Upgrade vite to 6.2.4 or later (major version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.0) + 0.40 × ecosystem value (0.5) = 1.4
Impact inputs
CVSS: unknown
Severity: medium
Dependency type: development
Advisory age: 477d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-4r4m-qw57-chr8 for vite
Mediumnpm
Update vite to fix a medium vulnerability
High effort SpIob/FlowState ⚠ low confidence
1.4/10
Vite bypasses server.fs.deny when using ?raw?? Affects vite (declared as "^7.0.4"), used as a development dependency of this repo. Severity: medium. Source: GHSA-x574-m823-4x7w (GHSA).
Upgrade vite to 6.2.3 or later (major version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.0) + 0.40 × ecosystem value (0.5) = 1.4
Impact inputs
CVSS: unknown
Severity: medium
Dependency type: development
Advisory age: 483d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-x574-m823-4x7w for vite
Mediumnpm
Update vite to fix a medium vulnerability
High effort SpIob/FlowState ⚠ low confidence
1.4/10
Websites were able to send any requests to the development server and read the response in vite Affects vite (declared as "^7.0.4"), used as a development dependency of this repo. Severity: medium. Source: GHSA-vg6x-rcgg-rjx6 (GHSA).
Upgrade vite to 6.0.9 or later (major version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.0) + 0.40 × ecosystem value (0.5) = 1.4
Impact inputs
CVSS: unknown
Severity: medium
Dependency type: development
Advisory age: 546d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-vg6x-rcgg-rjx6 for vite
Mediumnpm
Update vite to fix a medium vulnerability
High effort SpIob/FlowState ⚠ low confidence
1.4/10
Vite DOM Clobbering gadget found in vite bundled scripts that leads to XSS Affects vite (declared as "^7.0.4"), used as a development dependency of this repo. Severity: medium. Source: GHSA-64vr-g452-qvp3 (GHSA).
Upgrade vite to 5.4.6 or later (major version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.0) + 0.40 × ecosystem value (0.5) = 1.4
Impact inputs
CVSS: unknown
Severity: medium
Dependency type: development
Advisory age: 672d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-64vr-g452-qvp3 for vite
Mediumnpm
Update vite to fix a medium vulnerability
High effort SpIob/FlowState ⚠ low confidence
1.4/10
Vite's `server.fs.deny` is bypassed when using `?import&raw` Affects vite (declared as "^7.0.4"), used as a development dependency of this repo. Severity: medium. Source: GHSA-9cwx-2883-4wfx (GHSA).
Upgrade vite to 5.4.6 or later (major version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.0) + 0.40 × ecosystem value (0.5) = 1.4
Impact inputs
CVSS: unknown
Severity: medium
Dependency type: development
Advisory age: 672d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-9cwx-2883-4wfx for vite
Mediumnpm
Update vite to fix a medium vulnerability
High effort SpIob/FlowState ⚠ low confidence
1.4/10
Vite's `server.fs.deny` did not deny requests for patterns with directories. Affects vite (declared as "^7.0.4"), used as a development dependency of this repo. Severity: medium. Source: GHSA-8jhw-289h-jh2g (GHSA).
Upgrade vite to 2.9.18 or later (major version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.0) + 0.40 × ecosystem value (0.5) = 1.4
Impact inputs
CVSS: unknown
Severity: medium
Dependency type: development
Advisory age: 839d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-8jhw-289h-jh2g for vite
Mediumnpm
Update vite to fix a medium vulnerability
High effort SpIob/FlowState ⚠ low confidence
1.4/10
Vite XSS vulnerability in `server.transformIndexHtml` via URL payload Affects vite (declared as "^7.0.4"), used as a development dependency of this repo. Severity: medium. Source: GHSA-92r3-m2mg-pj97 (GHSA).
Upgrade vite to 4.4.12 or later (major version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.0) + 0.40 × ecosystem value (0.5) = 1.4
Impact inputs
CVSS: unknown
Severity: medium
Dependency type: development
Advisory age: 959d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-92r3-m2mg-pj97 for vite
Mediumnpm
Update postcss to fix a medium vulnerability
High effort SpIob/FlowState ⚠ low confidence
1.4/10
Regular Expression Denial of Service in postcss Affects postcss (declared as "^8.5.15"), used as a development dependency of this repo. Severity: medium. Source: GHSA-hwj9-h5mp-3pm3 (GHSA).
Upgrade postcss to 7.0.36 or later (major version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.0) + 0.40 × ecosystem value (0.5) = 1.4
Impact inputs
CVSS: unknown
Severity: medium
Dependency type: development
Advisory age: 1898d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-hwj9-h5mp-3pm3 for postcss
UnknownGo
Unknown vulnerability in golang.org/x/crypto has no fix yet
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
0.6/10
The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: unknown. Source: GO-2026-5932 (OSV).
No fixed version has been published yet for GO-2026-5932. Track upstream for a fix.
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 19d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· No fixed version is published for this advisory yet.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2026-5932 for golang.org/x/crypto
UnknownGo
Update golang.org/x/crypto to fix a unknown vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
0.6/10
Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: unknown. Source: GO-2026-5005 (OSV).
Upgrade golang.org/x/crypto to 0.52.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 65d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2026-5005 for golang.org/x/crypto
UnknownGo
Update golang.org/x/crypto to fix a unknown vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
0.6/10
Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: unknown. Source: GO-2026-5006 (OSV).
Upgrade golang.org/x/crypto to 0.52.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 65d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2026-5006 for golang.org/x/crypto
UnknownGo
Update golang.org/x/crypto to fix a unknown vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
0.6/10
Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: unknown. Source: GO-2026-5013 (OSV).
Upgrade golang.org/x/crypto to 0.52.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 65d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2026-5013 for golang.org/x/crypto
UnknownGo
Update golang.org/x/crypto to fix a unknown vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
0.6/10
Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: unknown. Source: GO-2026-5014 (OSV).
Upgrade golang.org/x/crypto to 0.52.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 65d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2026-5014 for golang.org/x/crypto
UnknownGo
Update golang.org/x/crypto to fix a unknown vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
0.6/10
Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: unknown. Source: GO-2026-5015 (OSV).
Upgrade golang.org/x/crypto to 0.52.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 65d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2026-5015 for golang.org/x/crypto
UnknownGo
Update golang.org/x/crypto to fix a unknown vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
0.6/10
Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: unknown. Source: GO-2026-5016 (OSV).
Upgrade golang.org/x/crypto to 0.52.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 65d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2026-5016 for golang.org/x/crypto
UnknownGo
Update golang.org/x/crypto to fix a unknown vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
0.6/10
Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: unknown. Source: GO-2026-5017 (OSV).
Upgrade golang.org/x/crypto to 0.52.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 65d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2026-5017 for golang.org/x/crypto
UnknownGo
Update golang.org/x/crypto to fix a unknown vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
0.6/10
Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: unknown. Source: GO-2026-5018 (OSV).
Upgrade golang.org/x/crypto to 0.52.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 65d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2026-5018 for golang.org/x/crypto
UnknownGo
Update golang.org/x/crypto to fix a unknown vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
0.6/10
Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: unknown. Source: GO-2026-5019 (OSV).
Upgrade golang.org/x/crypto to 0.52.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 65d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2026-5019 for golang.org/x/crypto
UnknownGo
Update golang.org/x/crypto to fix a unknown vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
0.6/10
Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: unknown. Source: GO-2026-5020 (OSV).
Upgrade golang.org/x/crypto to 0.52.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 65d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2026-5020 for golang.org/x/crypto
UnknownGo
Update golang.org/x/crypto to fix a unknown vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
0.6/10
Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: unknown. Source: GO-2026-5021 (OSV).
Upgrade golang.org/x/crypto to 0.52.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 65d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2026-5021 for golang.org/x/crypto
UnknownGo
Update golang.org/x/crypto to fix a unknown vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
0.6/10
Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: unknown. Source: GO-2026-5023 (OSV).
Upgrade golang.org/x/crypto to 0.52.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 65d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2026-5023 for golang.org/x/crypto
UnknownGo
Update golang.org/x/crypto to fix a unknown vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
0.6/10
Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: unknown. Source: GO-2026-5033 (OSV).
Upgrade golang.org/x/crypto to 0.52.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 65d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2026-5033 for golang.org/x/crypto
UnknownGo
Update golang.org/x/crypto to fix a unknown vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
0.6/10
Unbounded memory consumption in golang.org/x/crypto/ssh Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: unknown. Source: GO-2025-4134 (OSV).
Upgrade golang.org/x/crypto to 0.45.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 249d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2025-4134 for golang.org/x/crypto
UnknownGo
Update golang.org/x/crypto to fix a unknown vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
0.6/10
Malformed constraint may cause denial of service in golang.org/x/crypto/ssh/agent Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: unknown. Source: GO-2025-4135 (OSV).
Upgrade golang.org/x/crypto to 0.45.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 249d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2025-4135 for golang.org/x/crypto
UnknownGo
Update golang.org/x/crypto to fix a unknown vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
0.6/10
Potential denial of service in golang.org/x/crypto/ssh/agent Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: unknown. Source: GO-2025-4116 (OSV).
Upgrade golang.org/x/crypto to 0.43.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 255d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2025-4116 for golang.org/x/crypto
Lownpm
Update vite to fix a low vulnerability
Low effort SpIob/FlowState ⚠ low confidence
0.8/10
Vite middleware may serve files starting with the same name with the public directory Affects vite (declared as "^7.0.4"), used as a development dependency of this repo. Severity: low. Source: GHSA-g4jq-h2w9-997c (GHSA).
Upgrade vite to 7.1.5 or later (minor version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.5) = 0.8
Impact inputs
CVSS: unknown
Severity: low
Dependency type: development
Advisory age: 315d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-g4jq-h2w9-997c for vite
Lownpm
Update vite to fix a low vulnerability
Low effort SpIob/FlowState ⚠ low confidence
0.8/10
Vite's `server.fs` settings were not applied to HTML files Affects vite (declared as "^7.0.4"), used as a development dependency of this repo. Severity: low. Source: GHSA-jqfw-vq24-v9c3 (GHSA).
Upgrade vite to 7.1.5 or later (minor version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.5) = 0.8
Impact inputs
CVSS: unknown
Severity: low
Dependency type: development
Advisory age: 315d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-jqfw-vq24-v9c3 for vite
UnknownGo
Update golang.org/x/crypto to fix a unknown vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
0.6/10
Potential denial of service in golang.org/x/crypto Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: unknown. Source: GO-2025-3487 (OSV).
Upgrade golang.org/x/crypto to 0.35.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 515d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2025-3487 for golang.org/x/crypto
UnknownGo
Update golang.org/x/crypto to fix a unknown vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
0.6/10
Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: unknown. Source: GO-2024-3321 (OSV).
Upgrade golang.org/x/crypto to 0.31.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 592d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2024-3321 for golang.org/x/crypto
UnknownGo
Update golang.org/x/crypto to fix a unknown vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
0.6/10
Limited directory traversal vulnerability on Windows in golang.org/x/crypto Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: unknown. Source: GO-2024-2961 (OSV).
Upgrade golang.org/x/crypto to 0.0.0-20220525230936-793ad666bf5e or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 754d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2024-2961 for golang.org/x/crypto
UnknownGo
Update golang.org/x/crypto to fix a unknown vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
0.6/10
Man-in-the-middle attacker can compromise integrity of secure channel in golang.org/x/crypto Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: unknown. Source: GO-2023-2402 (OSV).
Upgrade golang.org/x/crypto to 0.17.0 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 951d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2023-2402 for golang.org/x/crypto
UnknownGo
Update golang.org/x/crypto to fix a unknown vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
0.6/10
Misleading message verification in golang.org/x/crypto/openpgp/clearsign Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: unknown. Source: GO-2023-1992 (OSV).
Upgrade golang.org/x/crypto to 0.0.0-20190424203555-c05e17bb3b2d or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 1068d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2023-1992 for golang.org/x/crypto
UnknownGo
Update golang.org/x/crypto to fix a unknown vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
0.6/10
Panic on malformed packets in golang.org/x/crypto/ssh Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: unknown. Source: GO-2022-0968 (OSV).
Upgrade golang.org/x/crypto to 0.0.0-20211202192323-5770296d904e or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 1412d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2022-0968 for golang.org/x/crypto
UnknownGo
Update golang.org/x/crypto to fix a unknown vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
0.6/10
Panic in certificate parsing in crypto/x509 and golang.org/x/crypto/cryptobyte Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: unknown. Source: GO-2022-0229 (OSV).
Upgrade golang.org/x/crypto to 0.0.0-20200124225646-8b5121be2f68 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 1481d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2022-0229 for golang.org/x/crypto
UnknownGo
Update golang.org/x/crypto to fix a unknown vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
0.6/10
Insufficiently random values in golang.org/x/crypto/salsa20 Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: unknown. Source: GO-2022-0209 (OSV).
Upgrade golang.org/x/crypto to 0.0.0-20190320223903-b7391e95e576 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 1486d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2022-0209 for golang.org/x/crypto
UnknownGo
Update golang.org/x/crypto to fix a unknown vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
0.6/10
Denial of service via crafted Signer in golang.org/x/crypto/ssh Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: unknown. Source: GO-2021-0356 (OSV).
Upgrade golang.org/x/crypto to 0.0.0-20220314234659-1baeb1ce4c0b or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 1553d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2021-0356 for golang.org/x/crypto
UnknownGo
Update golang.org/x/crypto to fix a unknown vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
0.6/10
Panic on crafted authentication request message in golang.org/x/crypto/ssh Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: unknown. Source: GO-2021-0227 (OSV).
Upgrade golang.org/x/crypto to 0.0.0-20201216223049-8b5274cf687f or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 1620d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2021-0227 for golang.org/x/crypto
UnknownGo
Update golang.org/x/crypto to fix a unknown vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
0.6/10
Panic due to improper verification of cryptographic signatures in golang.org/x/crypto/ssh Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: unknown. Source: GO-2020-0012 (OSV).
Upgrade golang.org/x/crypto to 0.0.0-20200220183623-bac4c82f6975 or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 1929d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2020-0012 for golang.org/x/crypto
UnknownGo
Update golang.org/x/crypto to fix a unknown vulnerability
Low effort SpIob/deptend-go-test-fixture ⚠ low confidence
0.6/10
Man-in-the-middle attack in golang.org/x/crypto/ssh Affects golang.org/x/crypto (declared as "v0.29.0"), used as a production dependency of this repo. Severity: unknown. Source: GO-2020-0013 (OSV).
Upgrade golang.org/x/crypto to 0.0.0-20170330155735-e4e2799dd7aa or later (minor version bump).
⚠ Low confidenceSpIob/deptend-go-test-fixture
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.0) = 0.6
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: 1929d
Ecosystem value inputs
Repo stars: 0
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
OSV advisory GO-2020-0013 for golang.org/x/crypto

Update @tauri-apps/plugin-shell to fix a critical vulnerability

Update golang.org/x/crypto to fix a critical vulnerability

Update golang.org/x/crypto to fix a critical vulnerability

Update golang.org/x/crypto to fix a critical vulnerability

Update golang.org/x/crypto to fix a critical vulnerability

Update golang.org/x/crypto to fix a critical vulnerability

Update golang.org/x/crypto to fix a critical vulnerability

Update golang.org/x/crypto to fix a critical vulnerability

Update golang.org/x/crypto to fix a critical vulnerability

Update golang.org/x/crypto to fix a high vulnerability

Update golang.org/x/crypto to fix a high vulnerability

Update golang.org/x/crypto to fix a high vulnerability

Update golang.org/x/crypto to fix a high vulnerability

Update golang.org/x/crypto to fix a high vulnerability

Update golang.org/x/crypto to fix a high vulnerability

Update golang.org/x/crypto to fix a high vulnerability

Update golang.org/x/crypto to fix a high vulnerability

Update golang.org/x/crypto to fix a high vulnerability

Update react to fix a high vulnerability

Update xterm to fix a high vulnerability

Update golang.org/x/crypto to fix a medium vulnerability

Update golang.org/x/crypto to fix a medium vulnerability

Update golang.org/x/crypto to fix a medium vulnerability

Update golang.org/x/crypto to fix a medium vulnerability

Update golang.org/x/crypto to fix a medium vulnerability

Update golang.org/x/crypto to fix a medium vulnerability

Update golang.org/x/crypto to fix a medium vulnerability

Update golang.org/x/crypto to fix a medium vulnerability

Update golang.org/x/crypto to fix a medium vulnerability

Update react to fix a medium vulnerability

Update react-dom to fix a medium vulnerability

Update @tauri-apps/cli to fix a high vulnerability

Update vite to fix a high vulnerability

Update vite to fix a high vulnerability

Update vite to fix a high vulnerability

Update vite to fix a high vulnerability

Update vite to fix a high vulnerability

Update vite to fix a high vulnerability

Update vite to fix a high vulnerability

Update postcss to fix a medium vulnerability

Update vite to fix a medium vulnerability

Update postcss to fix a medium vulnerability

Update postcss to fix a medium vulnerability

Update vite to fix a medium vulnerability

Update vite to fix a medium vulnerability

Update vite to fix a medium vulnerability

Update vite to fix a medium vulnerability

Update vite to fix a medium vulnerability

Update vite to fix a medium vulnerability

Update vite to fix a medium vulnerability

Update vite to fix a medium vulnerability

Update vite to fix a medium vulnerability

Update vite to fix a medium vulnerability

Update vite to fix a medium vulnerability

Update vite to fix a medium vulnerability

Update postcss to fix a medium vulnerability

Unknown vulnerability in golang.org/x/crypto has no fix yet

Update golang.org/x/crypto to fix a unknown vulnerability

Update golang.org/x/crypto to fix a unknown vulnerability

Update golang.org/x/crypto to fix a unknown vulnerability

Update golang.org/x/crypto to fix a unknown vulnerability

Update golang.org/x/crypto to fix a unknown vulnerability

Update golang.org/x/crypto to fix a unknown vulnerability

Update golang.org/x/crypto to fix a unknown vulnerability

Update golang.org/x/crypto to fix a unknown vulnerability

Update golang.org/x/crypto to fix a unknown vulnerability

Update golang.org/x/crypto to fix a unknown vulnerability

Update golang.org/x/crypto to fix a unknown vulnerability

Update golang.org/x/crypto to fix a unknown vulnerability

Update golang.org/x/crypto to fix a unknown vulnerability

Update golang.org/x/crypto to fix a unknown vulnerability

Update golang.org/x/crypto to fix a unknown vulnerability

Update golang.org/x/crypto to fix a unknown vulnerability

Update vite to fix a low vulnerability

Update vite to fix a low vulnerability

Update golang.org/x/crypto to fix a unknown vulnerability

Update golang.org/x/crypto to fix a unknown vulnerability

Update golang.org/x/crypto to fix a unknown vulnerability

Update golang.org/x/crypto to fix a unknown vulnerability

Update golang.org/x/crypto to fix a unknown vulnerability