SpIob/FlowState

npm

★ 1Ingested 9/4/2026

A local-first developer workspace that detects when you're in flow and gets out of your way. Unified editor, terminal, and Git panel with OS-level interruption blocking and dynamic UI that adapts to your cognitive load. Built with Tauri, React, and Ollama.

← All repos

Impact

Ecosystem

Effort

Type

Sort

Critical
Update @tauri-apps/plugin-shell to fix a critical vulnerability(GHSA-c9pr)
Fix: 2.2.15.6/10
Improper Scope Validation in the `open` Endpoint of `tauri-plugin-shell` @tauri-apps/plugin-shell is declared as "^2.3.5" and used as a production npm dependency of this repo. Severity: critical. Reported via GHSA-c9pr-q8gx-3mgp (GHSA).
Upgrade @tauri-apps/plugin-shell to 2.2.1 or later — low effort (minor version bump).
⚠ Low confidenceSpIob/FlowState
Claimed by @SpIob
▸Why this score?
Formula
0.60 × impact (9.0) + 0.40 × ecosystem value (0.5) = 5.6
Impact inputs
CVSS: unknown
Severity: critical
Dependency type: production
Advisory age: 519d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-c9pr-q8gx-3mgp for @tauri-apps/plugin-shell
High
Update xterm to fix a high vulnerability(GHSA-mc23)
Fix: 3.8.15.5/10
xterm vulnerable to remote code execution xterm is declared as "^5.3.0" and used as a production npm dependency of this repo. Severity: high (CVSS 8.8). Reported via GHSA-mc23-976p-j42x (GHSA).
Upgrade xterm to 3.8.1 or later — high effort (major version bump).
Medium confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (8.8) + 0.40 × ecosystem value (0.5) = 5.5
Impact inputs
CVSS: 8.8
Severity: high
Dependency type: production
Advisory age: 2789d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why medium confidence
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
Source
GHSA advisory GHSA-mc23-976p-j42x for xterm
Medium
Update react to fix a medium vulnerability(GHSA-g53w)
Fix: 0.4.24.1/10
Cross-Site Scripting in react react is declared as "^19.1.0" and used as a production npm dependency of this repo. Severity: medium (CVSS 6.5). Reported via GHSA-g53w-52xc-2j85 (GHSA).
Upgrade react to 0.4.2 or later — high effort (major version bump).
Medium confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (6.5) + 0.40 × ecosystem value (0.5) = 4.1
Impact inputs
CVSS: 6.5
Severity: medium
Dependency type: production
Advisory age: 2190d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why medium confidence
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
Source
GHSA advisory GHSA-g53w-52xc-2j85 for react
High
Update react to fix a high vulnerability(GHSA-hg79)
Fix: 0.14.04.4/10
Cross-Site Scripting in react react is declared as "^19.1.0" and used as a production npm dependency of this repo. Severity: high. Reported via GHSA-hg79-j56m-fxgv (GHSA).
Upgrade react to 0.14.0 or later — high effort (major version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (7.0) + 0.40 × ecosystem value (0.5) = 4.4
Impact inputs
CVSS: unknown
Severity: high
Dependency type: production
Advisory age: 2190d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why low confidence
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
Source
GHSA advisory GHSA-hg79-j56m-fxgv for react
Medium
Update react-dom to fix a medium vulnerability(GHSA-mvjj)
Fix: 16.0.13.8/10
Cross-Site Scripting in react-dom react-dom is declared as "^19.1.0" and used as a production npm dependency of this repo. Severity: medium (CVSS 6.1). Reported via GHSA-mvjj-gqq2-p4hw (GHSA).
Upgrade react-dom to 16.0.1 or later — high effort (major version bump).
Medium confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (6.1) + 0.40 × ecosystem value (0.5) = 3.8
Impact inputs
CVSS: 6.1
Severity: medium
Dependency type: production
Advisory age: 2799d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why medium confidence
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
Source
GHSA advisory GHSA-mvjj-gqq2-p4hw for react-dom
High
Update browserslist to fix a high vulnerability(GHSA-c83g)
Fix: 4.28.72.6/10
Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM browserslist is declared as "*" and used as a transitive npm dependency of this repo. Severity: high (CVSS 7.5). Reported via GHSA-c83g-rgw3-j3cx (GHSA).
Upgrade browserslist to 4.28.7 or later — trivial effort (patch version bump).
Medium confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (4.1) + 0.40 × ecosystem value (0.5) = 2.6
Impact inputs
CVSS: 7.5
Severity: high
Dependency type: optional
Advisory age: 2d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: patch
Migration guide: not tracked yet
Why medium confidence
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
Source
GHSA advisory GHSA-c83g-rgw3-j3cx for browserslist
High
Update browserslist to fix a high vulnerability(GHSA-73wf)
Fix: 4.28.72.6/10
Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats) browserslist is declared as "*" and used as a transitive npm dependency of this repo. Severity: high (CVSS 7.5). Reported via GHSA-73wf-gq98-2v4g (GHSA).
Upgrade browserslist to 4.28.7 or later — trivial effort (patch version bump).
Medium confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (4.1) + 0.40 × ecosystem value (0.5) = 2.6
Impact inputs
CVSS: 7.5
Severity: high
Dependency type: optional
Advisory age: 2d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: patch
Migration guide: not tracked yet
Why medium confidence
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
Source
GHSA advisory GHSA-73wf-gq98-2v4g for browserslist
High
Update nanoid to fix a high vulnerability(GHSA-xwg4)
Fix: 3.3.122.6/10
nanoid: Integer Overflow or Wraparound nanoid is declared as "*" and used as a transitive npm dependency of this repo. Severity: high (CVSS 7.4). Reported via GHSA-xwg4-73v4-xw9w (GHSA).
Upgrade nanoid to 3.3.12 or later — medium effort (bump size unknown).
Medium confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (4.0) + 0.40 × ecosystem value (0.5) = 2.6
Impact inputs
CVSS: 7.4
Severity: high
Dependency type: optional
Advisory age: 2d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: unknown
Migration guide: not tracked yet
Why medium confidence
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
Source
GHSA advisory GHSA-xwg4-73v4-xw9w for nanoid
High
Update picomatch to fix a high vulnerability(GHSA-c2c7)
Fix: 4.0.42.6/10
Picomatch has a ReDoS vulnerability via extglob quantifiers picomatch is declared as "*" and used as a transitive npm dependency of this repo. Severity: high (CVSS 7.5). Reported via GHSA-c2c7-rcm5-vvqj (GHSA).
Upgrade picomatch to 4.0.4 or later — medium effort (bump size unknown).
Medium confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (4.1) + 0.40 × ecosystem value (0.5) = 2.6
Impact inputs
CVSS: 7.5
Severity: high
Dependency type: optional
Advisory age: 162d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: unknown
Migration guide: not tracked yet
Why medium confidence
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
Source
GHSA advisory GHSA-c2c7-rcm5-vvqj for picomatch
Medium
Update nanoid to fix a medium vulnerability(GHSA-28wg)
Fix: 3.3.162.1/10
nanoid: non-secure generators can loop indefinitely with negative size nanoid is declared as "*" and used as a transitive npm dependency of this repo. Severity: medium (CVSS 5.9). Reported via GHSA-28wg-ghj8-5hjv (GHSA).
Upgrade nanoid to 3.3.16 or later — trivial effort (patch version bump).
Medium confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (3.2) + 0.40 × ecosystem value (0.5) = 2.1
Impact inputs
CVSS: 5.9
Severity: medium
Dependency type: optional
Advisory age: 36d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: patch
Migration guide: not tracked yet
Why medium confidence
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
Source
GHSA advisory GHSA-28wg-ghj8-5hjv for nanoid
Medium
Update nanoid to fix a medium vulnerability(GHSA-2v37)
Fix: 3.3.182.1/10
nanoid: custom generators can loop indefinitely when size is zero nanoid is declared as "*" and used as a transitive npm dependency of this repo. Severity: medium (CVSS 5.9). Reported via GHSA-2v37-7h3g-55p8 (GHSA).
Upgrade nanoid to 3.3.18 or later — trivial effort (patch version bump).
Medium confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (3.2) + 0.40 × ecosystem value (0.5) = 2.1
Impact inputs
CVSS: 5.9
Severity: medium
Dependency type: optional
Advisory age: 36d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: patch
Migration guide: not tracked yet
Why medium confidence
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
Source
GHSA advisory GHSA-2v37-7h3g-55p8 for nanoid
High
Update postcss to fix a high vulnerability(GHSA-r28c)
Fix: 8.5.182.0/10
PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure postcss is declared as "^8.5.15" and used as a development npm dependency of this repo. Severity: high (CVSS 7.5). Reported via GHSA-r28c-9q8g-f849 (GHSA).
Upgrade postcss to 8.5.18 or later — trivial effort (patch version bump).
Medium confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (3.0) + 0.40 × ecosystem value (0.5) = 2.0
Impact inputs
CVSS: 7.5
Severity: high
Dependency type: development
Advisory age: 41d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: patch
Migration guide: not tracked yet
Why medium confidence
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
Source
GHSA advisory GHSA-r28c-9q8g-f849 for postcss
High
Update postcss to fix a high vulnerability(GHSA-6g55)
Fix: 8.5.122.0/10
PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments postcss is declared as "^8.5.15" and used as a development npm dependency of this repo. Severity: high (CVSS 7.5). Reported via GHSA-6g55-p6wh-862q (GHSA).
Upgrade postcss to 8.5.12 or later — trivial effort (patch version bump).
Medium confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (3.0) + 0.40 × ecosystem value (0.5) = 2.0
Impact inputs
CVSS: 7.5
Severity: high
Dependency type: development
Advisory age: 42d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: patch
Migration guide: not tracked yet
Why medium confidence
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
Source
GHSA advisory GHSA-6g55-p6wh-862q for postcss
High
Update @tauri-apps/cli to fix a high vulnerability(GHSA-2rcp)
Fix: 2.0.0-alpha.162.2/10
Tauri's Updater Private Keys Possibly Leaked via Vite Environment Variables @tauri-apps/cli is declared as "^2" and used as a development npm dependency of this repo. Severity: high (CVSS 8.4). Reported via GHSA-2rcp-jvr4-r259 (GHSA).
Upgrade @tauri-apps/cli to 2.0.0-alpha.16 or later — low effort (minor version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (3.4) + 0.40 × ecosystem value (0.5) = 2.2
Impact inputs
CVSS: 8.4
Severity: high
Dependency type: development
Advisory age: 1049d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-2rcp-jvr4-r259 for @tauri-apps/cli
Medium
Update nanoid to fix a medium vulnerability(GHSA-qrpm)
Fix: 3.1.312.0/10
Exposure of Sensitive Information to an Unauthorized Actor in nanoid nanoid is declared as "*" and used as a transitive npm dependency of this repo. Severity: medium (CVSS 5.5). Reported via GHSA-qrpm-p2h7-hrv2 (GHSA).
Upgrade nanoid to 3.1.31 or later — low effort (minor version bump).
Medium confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (3.0) + 0.40 × ecosystem value (0.5) = 2.0
Impact inputs
CVSS: 5.5
Severity: medium
Dependency type: optional
Advisory age: 1686d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why medium confidence
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
Source
GHSA advisory GHSA-qrpm-p2h7-hrv2 for nanoid
High
Update vite to fix a high vulnerability(GHSA-fx2h)
Fix: 8.0.162.0/10
vite: `server.fs.deny` bypass on Windows alternate paths vite is declared as "^7.0.4" and used as a development npm dependency of this repo. Severity: high (CVSS 7.5). Reported via GHSA-fx2h-pf6j-xcff (GHSA).
Upgrade vite to 8.0.16 or later — high effort (major version bump).
Medium confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (3.0) + 0.40 × ecosystem value (0.5) = 2.0
Impact inputs
CVSS: 7.5
Severity: high
Dependency type: development
Advisory age: 80d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why medium confidence
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
Source
GHSA advisory GHSA-fx2h-pf6j-xcff for vite
High
Update rollup to fix a high vulnerability(GHSA-mw96)
Fix: 2.80.02.4/10
Rollup 4 has Arbitrary File Write via Path Traversal rollup is declared as "*" and used as a transitive npm dependency of this repo. Severity: high. Reported via GHSA-mw96-cpmx-2vgc (GHSA).
Upgrade rollup to 2.80.0 or later — high effort (major version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (3.8) + 0.40 × ecosystem value (0.5) = 2.4
Impact inputs
CVSS: unknown
Severity: high
Dependency type: optional
Advisory age: 190d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why low confidence
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-mw96-cpmx-2vgc for rollup
Medium
Update rollup to fix a medium vulnerability(GHSA-gcx4)
Fix: 3.29.52.3/10
DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS rollup is declared as "*" and used as a transitive npm dependency of this repo. Severity: medium (CVSS 6.4). Reported via GHSA-gcx4-mw62-g8wm (GHSA).
Upgrade rollup to 3.29.5 or later — high effort (major version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (3.5) + 0.40 × ecosystem value (0.5) = 2.3
Impact inputs
CVSS: 6.4
Severity: medium
Dependency type: optional
Advisory age: 710d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why low confidence
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-gcx4-mw62-g8wm for rollup
High
Update vite to fix a high vulnerability(GHSA-c24v)
Fix: 2.9.172.0/10
Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem vite is declared as "^7.0.4" and used as a development npm dependency of this repo. Severity: high (CVSS 7.5). Reported via GHSA-c24v-8rfc-w8vw (GHSA).
Upgrade vite to 2.9.17 or later — high effort (major version bump).
Medium confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (3.0) + 0.40 × ecosystem value (0.5) = 2.0
Impact inputs
CVSS: 7.5
Severity: high
Dependency type: development
Advisory age: 958d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why medium confidence
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
Source
GHSA advisory GHSA-c24v-8rfc-w8vw for vite
High
Update vite to fix a high vulnerability(GHSA-353f)
Fix: 2.9.162.0/10
Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//) vite is declared as "^7.0.4" and used as a development npm dependency of this repo. Severity: high (CVSS 7.5). Reported via GHSA-353f-5xf4-qw67 (GHSA).
Upgrade vite to 2.9.16 or later — high effort (major version bump).
Medium confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (3.0) + 0.40 × ecosystem value (0.5) = 2.0
Impact inputs
CVSS: 7.5
Severity: high
Dependency type: development
Advisory age: 1186d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why medium confidence
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
Source
GHSA advisory GHSA-353f-5xf4-qw67 for vite
High
Update vite to fix a high vulnerability(GHSA-mv48)
Fix: 2.9.132.2/10
Vite before v2.9.13 vulnerable to directory traversal via crafted URL to victim's service vite is declared as "^7.0.4" and used as a development npm dependency of this repo. Severity: high (CVSS 8.6). Reported via GHSA-mv48-hcvh-8jj8 (GHSA).
Upgrade vite to 2.9.13 or later — high effort (major version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (3.4) + 0.40 × ecosystem value (0.5) = 2.2
Impact inputs
CVSS: 8.6
Severity: high
Dependency type: development
Advisory age: 1477d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why low confidence
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-mv48-hcvh-8jj8 for vite
Medium
Update postcss to fix a medium vulnerability(GHSA-qx2v)
Fix: 8.5.101.6/10
PostCSS has XSS via Unescaped </style> in its CSS Stringify Output postcss is declared as "^8.5.15" and used as a development npm dependency of this repo. Severity: medium (CVSS 6.1). Reported via GHSA-qx2v-qp2m-jg93 (GHSA).
Upgrade postcss to 8.5.10 or later — trivial effort (patch version bump).
Medium confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.4) + 0.40 × ecosystem value (0.5) = 1.6
Impact inputs
CVSS: 6.1
Severity: medium
Dependency type: development
Advisory age: 132d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: patch
Migration guide: not tracked yet
Why medium confidence
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
Source
GHSA advisory GHSA-qx2v-qp2m-jg93 for postcss
Medium
Update esbuild to fix a medium vulnerability(GHSA-67mh)
Fix: 0.25.01.9/10
esbuild enables any website to send any requests to the development server and read the response esbuild is declared as "*" and used as a transitive npm dependency of this repo. Severity: medium (CVSS 5.3). Reported via GHSA-67mh-4wv8-2f99 (GHSA).
Upgrade esbuild to 0.25.0 or later — low effort (minor version bump).
Medium confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.9) + 0.40 × ecosystem value (0.5) = 1.9
Impact inputs
CVSS: 5.3
Severity: medium
Dependency type: optional
Advisory age: 570d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: available
Why medium confidence
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
Source
GHSA advisory GHSA-67mh-4wv8-2f99 for esbuild
Medium
Update postcss to fix a medium vulnerability(GHSA-7fh5)
Fix: 8.4.311.5/10
PostCSS line return parsing error postcss is declared as "^8.5.15" and used as a development npm dependency of this repo. Severity: medium (CVSS 5.3). Reported via GHSA-7fh5-64p2-3v2j (GHSA).
Upgrade postcss to 8.4.31 or later — low effort (minor version bump).
Medium confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.1) + 0.40 × ecosystem value (0.5) = 1.5
Impact inputs
CVSS: 5.3
Severity: medium
Dependency type: development
Advisory age: 1070d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why medium confidence
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
Source
GHSA advisory GHSA-7fh5-64p2-3v2j for postcss
Medium
Update postcss to fix a medium vulnerability(GHSA-566m)
Fix: 8.2.131.5/10
Regular Expression Denial of Service in postcss postcss is declared as "^8.5.15" and used as a development npm dependency of this repo. Severity: medium (CVSS 5.3). Reported via GHSA-566m-qj78-rww5 (GHSA).
Upgrade postcss to 8.2.13 or later — low effort (minor version bump).
Medium confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.1) + 0.40 × ecosystem value (0.5) = 1.5
Impact inputs
CVSS: 5.3
Severity: medium
Dependency type: development
Advisory age: 1701d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why medium confidence
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
Source
GHSA advisory GHSA-566m-qj78-rww5 for postcss
Medium
Update browserslist to fix a medium vulnerability(GHSA-w8qv)
Fix: 4.16.51.9/10
Regular Expression Denial of Service in browserslist browserslist is declared as "*" and used as a transitive npm dependency of this repo. Severity: medium (CVSS 5.3). Reported via GHSA-w8qv-6jwh-64r5 (GHSA).
Upgrade browserslist to 4.16.5 or later — low effort (minor version bump).
Medium confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.9) + 0.40 × ecosystem value (0.5) = 1.9
Impact inputs
CVSS: 5.3
Severity: medium
Dependency type: optional
Advisory age: 1928d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why medium confidence
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
Source
GHSA advisory GHSA-w8qv-6jwh-64r5 for browserslist
Medium
Update picomatch to fix a medium vulnerability(GHSA-3v7f)
Fix: 4.0.41.9/10
Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching picomatch is declared as "*" and used as a transitive npm dependency of this repo. Severity: medium (CVSS 5.3). Reported via GHSA-3v7f-55p6-f55p (GHSA).
Upgrade picomatch to 4.0.4 or later — medium effort (bump size unknown).
Medium confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.9) + 0.40 × ecosystem value (0.5) = 1.9
Impact inputs
CVSS: 5.3
Severity: medium
Dependency type: optional
Advisory age: 162d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: unknown
Migration guide: not tracked yet
Why medium confidence
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
Source
GHSA advisory GHSA-3v7f-55p6-f55p for picomatch
Medium
Update mdast-util-to-hast to fix a medium vulnerability(GHSA-4fh9)
Fix: 13.2.11.9/10
mdast-util-to-hast has unsanitized class attribute mdast-util-to-hast is declared as "*" and used as a transitive npm dependency of this repo. Severity: medium (CVSS 5.3). Reported via GHSA-4fh9-h7wg-q85m (GHSA).
Upgrade mdast-util-to-hast to 13.2.1 or later — medium effort (bump size unknown).
Medium confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.9) + 0.40 × ecosystem value (0.5) = 1.9
Impact inputs
CVSS: 5.3
Severity: medium
Dependency type: optional
Advisory age: 276d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: unknown
Migration guide: not tracked yet
Why medium confidence
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
Source
GHSA advisory GHSA-4fh9-h7wg-q85m for mdast-util-to-hast
High
Update vite to fix a high vulnerability(GHSA-c27g)
Fix: 5.4.91.9/10
launch-editor vulnerable to command injection via the crafted request on Windows vite is declared as "^7.0.4" and used as a development npm dependency of this repo. Severity: high. Reported via GHSA-c27g-q93r-2cwf (GHSA).
Upgrade vite to 5.4.9 or later — high effort (major version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.8) + 0.40 × ecosystem value (0.5) = 1.9
Impact inputs
CVSS: unknown
Severity: high
Dependency type: development
Advisory age: 92d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why low confidence
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
Source
GHSA advisory GHSA-c27g-q93r-2cwf for vite
High
Update vite to fix a high vulnerability(GHSA-v2wj)
Fix: 8.0.51.9/10
Vite: `server.fs.deny` bypassed with queries vite is declared as "^7.0.4" and used as a development npm dependency of this repo. Severity: high. Reported via GHSA-v2wj-q39q-566r (GHSA).
Upgrade vite to 8.0.5 or later — high effort (major version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.8) + 0.40 × ecosystem value (0.5) = 1.9
Impact inputs
CVSS: unknown
Severity: high
Dependency type: development
Advisory age: 150d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why low confidence
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
Source
GHSA advisory GHSA-v2wj-q39q-566r for vite
High
Update vite to fix a high vulnerability(GHSA-p9ff)
Fix: 8.0.51.9/10
Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket vite is declared as "^7.0.4" and used as a development npm dependency of this repo. Severity: high. Reported via GHSA-p9ff-h696-f583 (GHSA).
Upgrade vite to 8.0.5 or later — high effort (major version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.8) + 0.40 × ecosystem value (0.5) = 1.9
Impact inputs
CVSS: unknown
Severity: high
Dependency type: development
Advisory age: 150d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why low confidence
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
Source
GHSA advisory GHSA-p9ff-h696-f583 for vite
Medium
Update vite to fix a medium vulnerability(GHSA-xcj6)
Fix: 6.2.51.5/10
Vite allows server.fs.deny to be bypassed with .svg or relative paths vite is declared as "^7.0.4" and used as a development npm dependency of this repo. Severity: medium (CVSS 5.3). Reported via GHSA-xcj6-pq6g-qj4x (GHSA).
Upgrade vite to 6.2.5 or later — high effort (major version bump).
Medium confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.1) + 0.40 × ecosystem value (0.5) = 1.5
Impact inputs
CVSS: 5.3
Severity: medium
Dependency type: development
Advisory age: 517d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why medium confidence
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
Source
GHSA advisory GHSA-xcj6-pq6g-qj4x for vite
Medium
Update vite to fix a medium vulnerability(GHSA-4r4m)
Fix: 6.2.41.5/10
Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query vite is declared as "^7.0.4" and used as a development npm dependency of this repo. Severity: medium (CVSS 5.3). Reported via GHSA-4r4m-qw57-chr8 (GHSA).
Upgrade vite to 6.2.4 or later — high effort (major version bump).
Medium confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.1) + 0.40 × ecosystem value (0.5) = 1.5
Impact inputs
CVSS: 5.3
Severity: medium
Dependency type: development
Advisory age: 521d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why medium confidence
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
Source
GHSA advisory GHSA-4r4m-qw57-chr8 for vite
Medium
Update vite to fix a medium vulnerability(GHSA-x574)
Fix: 6.2.31.5/10
Vite bypasses server.fs.deny when using ?raw?? vite is declared as "^7.0.4" and used as a development npm dependency of this repo. Severity: medium (CVSS 5.3). Reported via GHSA-x574-m823-4x7w (GHSA).
Upgrade vite to 6.2.3 or later — high effort (major version bump).
Medium confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.1) + 0.40 × ecosystem value (0.5) = 1.5
Impact inputs
CVSS: 5.3
Severity: medium
Dependency type: development
Advisory age: 527d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why medium confidence
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
Source
GHSA advisory GHSA-x574-m823-4x7w for vite
Medium
Update vite to fix a medium vulnerability(GHSA-vg6x)
Fix: 6.0.91.7/10
Websites were able to send any requests to the development server and read the response in vite vite is declared as "^7.0.4" and used as a development npm dependency of this repo. Severity: medium (CVSS 6.5). Reported via GHSA-vg6x-rcgg-rjx6 (GHSA).
Upgrade vite to 6.0.9 or later — high effort (major version bump).
Medium confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.6) + 0.40 × ecosystem value (0.5) = 1.7
Impact inputs
CVSS: 6.5
Severity: medium
Dependency type: development
Advisory age: 590d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why medium confidence
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
Source
GHSA advisory GHSA-vg6x-rcgg-rjx6 for vite
Medium
Update nanoid to fix a medium vulnerability(GHSA-mwcw)
Fix: 5.0.91.6/10
Predictable results in nanoid generation when given non-integer values nanoid is declared as "*" and used as a transitive npm dependency of this repo. Severity: medium (CVSS 4.3). Reported via GHSA-mwcw-c2x4-8c55 (GHSA).
Upgrade nanoid to 5.0.9 or later — high effort (major version bump).
Medium confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.3) + 0.40 × ecosystem value (0.5) = 1.6
Impact inputs
CVSS: 4.3
Severity: medium
Dependency type: optional
Advisory age: 634d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why medium confidence
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
Source
GHSA advisory GHSA-mwcw-c2x4-8c55 for nanoid
Medium
Update vite to fix a medium vulnerability(GHSA-64vr)
Fix: 5.4.61.7/10
Vite DOM Clobbering gadget found in vite bundled scripts that leads to XSS vite is declared as "^7.0.4" and used as a development npm dependency of this repo. Severity: medium (CVSS 6.4). Reported via GHSA-64vr-g452-qvp3 (GHSA).
Upgrade vite to 5.4.6 or later — high effort (major version bump).
Medium confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.6) + 0.40 × ecosystem value (0.5) = 1.7
Impact inputs
CVSS: 6.4
Severity: medium
Dependency type: development
Advisory age: 716d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why medium confidence
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
Source
GHSA advisory GHSA-64vr-g452-qvp3 for vite
Medium
Update vite to fix a medium vulnerability(GHSA-9cwx)
Fix: 5.4.61.5/10
Vite's `server.fs.deny` is bypassed when using `?import&raw` vite is declared as "^7.0.4" and used as a development npm dependency of this repo. Severity: medium (CVSS 5.3). Reported via GHSA-9cwx-2883-4wfx (GHSA).
Upgrade vite to 5.4.6 or later — high effort (major version bump).
Medium confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.1) + 0.40 × ecosystem value (0.5) = 1.5
Impact inputs
CVSS: 5.3
Severity: medium
Dependency type: development
Advisory age: 716d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why medium confidence
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
Source
GHSA advisory GHSA-9cwx-2883-4wfx for vite
Medium
Update vite to fix a medium vulnerability(GHSA-8jhw)
Fix: 2.9.181.6/10
Vite's `server.fs.deny` did not deny requests for patterns with directories. vite is declared as "^7.0.4" and used as a development npm dependency of this repo. Severity: medium (CVSS 5.9). Reported via GHSA-8jhw-289h-jh2g (GHSA).
Upgrade vite to 2.9.18 or later — high effort (major version bump).
Medium confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.4) + 0.40 × ecosystem value (0.5) = 1.6
Impact inputs
CVSS: 5.9
Severity: medium
Dependency type: development
Advisory age: 883d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why medium confidence
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
Source
GHSA advisory GHSA-8jhw-289h-jh2g for vite
Medium
Update vite to fix a medium vulnerability(GHSA-92r3)
Fix: 4.4.121.6/10
Vite XSS vulnerability in `server.transformIndexHtml` via URL payload vite is declared as "^7.0.4" and used as a development npm dependency of this repo. Severity: medium (CVSS 6.1). Reported via GHSA-92r3-m2mg-pj97 (GHSA).
Upgrade vite to 4.4.12 or later — high effort (major version bump).
Medium confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.4) + 0.40 × ecosystem value (0.5) = 1.6
Impact inputs
CVSS: 6.1
Severity: medium
Dependency type: development
Advisory age: 1003d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why medium confidence
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
Source
GHSA advisory GHSA-92r3-m2mg-pj97 for vite
Medium
Update postcss to fix a medium vulnerability(GHSA-hwj9)
Fix: 7.0.361.5/10
Regular Expression Denial of Service in postcss postcss is declared as "^8.5.15" and used as a development npm dependency of this repo. Severity: medium (CVSS 5.3). Reported via GHSA-hwj9-h5mp-3pm3 (GHSA).
Upgrade postcss to 7.0.36 or later — high effort (major version bump).
Medium confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.1) + 0.40 × ecosystem value (0.5) = 1.5
Impact inputs
CVSS: 5.3
Severity: medium
Dependency type: development
Advisory age: 1942d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why medium confidence
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
Source
GHSA advisory GHSA-hwj9-h5mp-3pm3 for postcss
Medium
Update postcss to fix a medium vulnerability(GHSA-fxqj)
Fix: 8.5.231.4/10
PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset postcss is declared as "^8.5.15" and used as a development npm dependency of this repo. Severity: medium. Reported via GHSA-fxqj-rqcc-2cmp (GHSA).
Upgrade postcss to 8.5.23 or later — trivial effort (patch version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.0) + 0.40 × ecosystem value (0.5) = 1.4
Impact inputs
CVSS: unknown
Severity: medium
Dependency type: development
Advisory age: 31d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: patch
Migration guide: not tracked yet
Why low confidence
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
Source
GHSA advisory GHSA-fxqj-rqcc-2cmp for postcss
Low
Update esbuild to fix a low vulnerability(GHSA-g7r4)
Fix: 0.28.11.0/10
esbuild allows arbitrary file read when running the development server on Windows esbuild is declared as "*" and used as a transitive npm dependency of this repo. Severity: low (CVSS 2.5). Reported via GHSA-g7r4-m6w7-qqqr (GHSA).
Upgrade esbuild to 0.28.1 or later — low effort (minor version bump).
Medium confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.4) + 0.40 × ecosystem value (0.5) = 1.0
Impact inputs
CVSS: 2.5
Severity: low
Dependency type: optional
Advisory age: 83d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: available
Why medium confidence
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
Source
GHSA advisory GHSA-g7r4-m6w7-qqqr for esbuild
Medium
Update vite to fix a medium vulnerability(GHSA-93m4)
Fix: 7.1.111.4/10
vite allows server.fs.deny bypass via backslash on Windows vite is declared as "^7.0.4" and used as a development npm dependency of this repo. Severity: medium. Reported via GHSA-93m4-6634-74q7 (GHSA).
Upgrade vite to 7.1.11 or later — low effort (minor version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.0) + 0.40 × ecosystem value (0.5) = 1.4
Impact inputs
CVSS: unknown
Severity: medium
Dependency type: development
Advisory age: 318d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
Source
GHSA advisory GHSA-93m4-6634-74q7 for vite
Medium
Update vite to fix a medium vulnerability(GHSA-v6wh)
Fix: 8.0.161.4/10
launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows vite is declared as "^7.0.4" and used as a development npm dependency of this repo. Severity: medium. Reported via GHSA-v6wh-96g9-6wx3 (GHSA).
Upgrade vite to 8.0.16 or later — high effort (major version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.0) + 0.40 × ecosystem value (0.5) = 1.4
Impact inputs
CVSS: unknown
Severity: medium
Dependency type: development
Advisory age: 80d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why low confidence
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
Source
GHSA advisory GHSA-v6wh-96g9-6wx3 for vite
Low
Update @babel/core to fix a low vulnerability(GHSA-4x5r)
Fix: 8.0.0-rc.61.2/10
@babel/core: Arbitrary File Read via sourceMappingURL Comment @babel/core is declared as "*" and used as a transitive npm dependency of this repo. Severity: low (CVSS 3.2). Reported via GHSA-4x5r-pxfx-6jf8 (GHSA).
Upgrade @babel/core to 8.0.0-rc.6 or later — high effort (major version bump).
Medium confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.7) + 0.40 × ecosystem value (0.5) = 1.2
Impact inputs
CVSS: 3.2
Severity: low
Dependency type: optional
Advisory age: 80d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why medium confidence
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
Source
GHSA advisory GHSA-4x5r-pxfx-6jf8 for @babel/core
Medium
Update vite to fix a medium vulnerability(GHSA-4w7w)
Fix: 8.0.51.4/10
Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling vite is declared as "^7.0.4" and used as a development npm dependency of this repo. Severity: medium. Reported via GHSA-4w7w-66w2-5vf9 (GHSA).
Upgrade vite to 8.0.5 or later — high effort (major version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.0) + 0.40 × ecosystem value (0.5) = 1.4
Impact inputs
CVSS: unknown
Severity: medium
Dependency type: development
Advisory age: 150d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why low confidence
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
Source
GHSA advisory GHSA-4w7w-66w2-5vf9 for vite
Medium
Update vite to fix a medium vulnerability(GHSA-859w)
Fix: 6.3.41.4/10
Vite's server.fs.deny bypassed with /. for files under project root vite is declared as "^7.0.4" and used as a development npm dependency of this repo. Severity: medium. Reported via GHSA-859w-5945-r5v3 (GHSA).
Upgrade vite to 6.3.4 or later — high effort (major version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.0) + 0.40 × ecosystem value (0.5) = 1.4
Impact inputs
CVSS: unknown
Severity: medium
Dependency type: development
Advisory age: 491d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why low confidence
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
Source
GHSA advisory GHSA-859w-5945-r5v3 for vite
Medium
Update vite to fix a medium vulnerability(GHSA-356w)
Fix: 6.2.61.4/10
Vite has an `server.fs.deny` bypass with an invalid `request-target` vite is declared as "^7.0.4" and used as a development npm dependency of this repo. Severity: medium. Reported via GHSA-356w-63v5-8wf4 (GHSA).
Upgrade vite to 6.2.6 or later — high effort (major version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.0) + 0.40 × ecosystem value (0.5) = 1.4
Impact inputs
CVSS: unknown
Severity: medium
Dependency type: development
Advisory age: 510d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why low confidence
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
Source
GHSA advisory GHSA-356w-63v5-8wf4 for vite
Unknown
Update caniuse-lite to 1.0.30001810 (no known vulnerabilities)
0.5/10
caniuse-lite is declared as "*" and used as a transitive npm dependency of this repo. Latest version is 1.0.30001810. No known vulnerabilities in current version. Consider updating to stay current with bug fixes and improvements.
Upgrade caniuse-lite to 1.0.30001810 or later — trivial effort (patch version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (0.5) + 0.40 × ecosystem value (0.5) = 0.5
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: optional
Advisory age: unknown
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: patch
Migration guide: not tracked yet
Why low confidence
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· No fixed version is published for this advisory yet.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Unknown
Update @tailwindcss/oxide to 4.3.3 (no known vulnerabilities)
0.5/10
@tailwindcss/oxide is declared as "*" and used as a transitive npm dependency of this repo. Latest version is 4.3.3. No known vulnerabilities in current version. Consider updating to stay current with bug fixes and improvements.
Upgrade @tailwindcss/oxide to 4.3.3 or later — trivial effort (patch version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (0.5) + 0.40 × ecosystem value (0.5) = 0.5
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: optional
Advisory age: unknown
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: patch
Migration guide: not tracked yet
Why low confidence
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· No fixed version is published for this advisory yet.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Unknown
Update @tailwindcss/node to 4.3.3 (no known vulnerabilities)
0.5/10
@tailwindcss/node is declared as "*" and used as a transitive npm dependency of this repo. Latest version is 4.3.3. No known vulnerabilities in current version. Consider updating to stay current with bug fixes and improvements.
Upgrade @tailwindcss/node to 4.3.3 or later — trivial effort (patch version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (0.5) + 0.40 × ecosystem value (0.5) = 0.5
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: optional
Advisory age: unknown
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: patch
Migration guide: not tracked yet
Why low confidence
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· No fixed version is published for this advisory yet.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Unknown
Update @tauri-apps/plugin-dialog to 2.7.3 (no known vulnerabilities)
0.8/10
@tauri-apps/plugin-dialog is declared as "^2.7.1" and used as a production npm dependency of this repo. Latest version is 2.7.3. No known vulnerabilities in current version. Consider updating to stay current with bug fixes and improvements.
Upgrade @tauri-apps/plugin-dialog to 2.7.3 or later — trivial effort (patch version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.5) = 0.8
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: unknown
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: patch
Migration guide: not tracked yet
Why low confidence
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· No fixed version is published for this advisory yet.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Unknown
Update @tauri-apps/api to 2.11.1 (no known vulnerabilities)
0.8/10
@tauri-apps/api is declared as "^2" and used as a production npm dependency of this repo. Latest version is 2.11.1. No known vulnerabilities in current version. Consider updating to stay current with bug fixes and improvements.
Upgrade @tauri-apps/api to 2.11.1 or later — trivial effort (patch version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.5) = 0.8
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: unknown
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: patch
Migration guide: not tracked yet
Why low confidence
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· No fixed version is published for this advisory yet.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Unknown
Update @tauri-apps/plugin-opener to 2.5.5 (no known vulnerabilities)
0.8/10
@tauri-apps/plugin-opener is declared as "^2" and used as a production npm dependency of this repo. Latest version is 2.5.5. No known vulnerabilities in current version. Consider updating to stay current with bug fixes and improvements.
Upgrade @tauri-apps/plugin-opener to 2.5.5 or later — trivial effort (patch version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.5) = 0.8
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: unknown
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: patch
Migration guide: not tracked yet
Why low confidence
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· No fixed version is published for this advisory yet.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Unknown
Update @types/hast to 3.0.5 (no known vulnerabilities)
0.5/10
@types/hast is declared as "*" and used as a transitive npm dependency of this repo. Latest version is 3.0.5. No known vulnerabilities in current version. Consider updating to stay current with bug fixes and improvements.
Upgrade @types/hast to 3.0.5 or later — trivial effort (patch version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (0.5) + 0.40 × ecosystem value (0.5) = 0.5
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: optional
Advisory age: unknown
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: patch
Migration guide: not tracked yet
Why low confidence
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· No fixed version is published for this advisory yet.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Low
Update vite to fix a low vulnerability(GHSA-g4jq)
Fix: 7.1.50.8/10
Vite middleware may serve files starting with the same name with the public directory vite is declared as "^7.0.4" and used as a development npm dependency of this repo. Severity: low. Reported via GHSA-g4jq-h2w9-997c (GHSA).
Upgrade vite to 7.1.5 or later — low effort (minor version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.5) = 0.8
Impact inputs
CVSS: unknown
Severity: low
Dependency type: development
Advisory age: 359d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
Source
GHSA advisory GHSA-g4jq-h2w9-997c for vite
Low
Update vite to fix a low vulnerability(GHSA-jqfw)
Fix: 7.1.50.8/10
Vite's `server.fs` settings were not applied to HTML files vite is declared as "^7.0.4" and used as a development npm dependency of this repo. Severity: low. Reported via GHSA-jqfw-vq24-v9c3 (GHSA).
Upgrade vite to 7.1.5 or later — low effort (minor version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.5) = 0.8
Impact inputs
CVSS: unknown
Severity: low
Dependency type: development
Advisory age: 359d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
Source
GHSA advisory GHSA-jqfw-vq24-v9c3 for vite
Unknown
Update enhanced-resolve to 5.24.5 (no known vulnerabilities)
0.5/10
enhanced-resolve is declared as "*" and used as a transitive npm dependency of this repo. Latest version is 5.24.5. No known vulnerabilities in current version. Consider updating to stay current with bug fixes and improvements.
Upgrade enhanced-resolve to 5.24.5 or later — low effort (minor version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (0.5) + 0.40 × ecosystem value (0.5) = 0.5
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: optional
Advisory age: unknown
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· No fixed version is published for this advisory yet.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Unknown
Update react-window to 2.3.0 (no known vulnerabilities)
0.8/10
react-window is declared as "^2.2.7" and used as a production npm dependency of this repo. Latest version is 2.3.0. No known vulnerabilities in current version. Consider updating to stay current with bug fixes and improvements.
Upgrade react-window to 2.3.0 or later — low effort (minor version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.5) = 0.8
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: unknown
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· No fixed version is published for this advisory yet.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Unknown
Update react-refresh to 0.18.0 (no known vulnerabilities)
0.5/10
react-refresh is declared as "*" and used as a transitive npm dependency of this repo. Latest version is 0.18.0. No known vulnerabilities in current version. Consider updating to stay current with bug fixes and improvements.
Upgrade react-refresh to 0.18.0 or later — low effort (minor version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (0.5) + 0.40 × ecosystem value (0.5) = 0.5
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: optional
Advisory age: unknown
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· No fixed version is published for this advisory yet.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Unknown
Update @tauri-apps/plugin-updater to 2.11.0 (no known vulnerabilities)
0.8/10
@tauri-apps/plugin-updater is declared as "^2.10.1" and used as a production npm dependency of this repo. Latest version is 2.11.0. No known vulnerabilities in current version. Consider updating to stay current with bug fixes and improvements.
Upgrade @tauri-apps/plugin-updater to 2.11.0 or later — low effort (minor version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.5) = 0.8
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: unknown
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· No fixed version is published for this advisory yet.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Unknown
Update @parcel/watcher to 2.6.0 (no known vulnerabilities)
0.5/10
@parcel/watcher is declared as "*" and used as a transitive npm dependency of this repo. Latest version is 2.6.0. No known vulnerabilities in current version. Consider updating to stay current with bug fixes and improvements.
Upgrade @parcel/watcher to 2.6.0 or later — low effort (minor version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (0.5) + 0.40 × ecosystem value (0.5) = 0.5
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: optional
Advisory age: unknown
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· No fixed version is published for this advisory yet.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Unknown
Deprecated package: xterm-addon-web-links needs attention
0.8/10
xterm-addon-web-links is declared as "^0.9.0" and used as a production npm dependency of this repo. This package has been deprecated by its maintainers. Consider migrating to an actively maintained alternative.
Review xterm-addon-web-links and consider updating to 0.9.0 or finding an alternative.
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.5) = 0.8
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: unknown
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: unknown
Migration guide: not tracked yet
Why low confidence
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· No fixed version is published for this advisory yet.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Unknown
Deprecated package: xterm-addon-fit needs attention
0.8/10
xterm-addon-fit is declared as "^0.8.0" and used as a production npm dependency of this repo. This package has been deprecated by its maintainers. Consider migrating to an actively maintained alternative.
Review xterm-addon-fit and consider updating to 0.8.0 or finding an alternative.
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.5) = 0.8
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: production
Advisory age: unknown
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: unknown
Migration guide: not tracked yet
Why low confidence
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· No fixed version is published for this advisory yet.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Unknown
Update @rolldown/pluginutils to 1.0.1 (no known vulnerabilities)
0.5/10
@rolldown/pluginutils is declared as "*" and used as a transitive npm dependency of this repo. Latest version is 1.0.1. No known vulnerabilities in current version. Consider updating to stay current with bug fixes and improvements.
Upgrade @rolldown/pluginutils to 1.0.1 or later — high effort (major version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (0.5) + 0.40 × ecosystem value (0.5) = 0.5
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: optional
Advisory age: unknown
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why low confidence
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· No fixed version is published for this advisory yet.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Unknown
Update autoprefixer to 10.5.4 (no known vulnerabilities)
0.4/10
autoprefixer is declared as "^10.5.0" and used as a development npm dependency of this repo. Latest version is 10.5.4. No known vulnerabilities in current version. Consider updating to stay current with bug fixes and improvements.
Upgrade autoprefixer to 10.5.4 or later — trivial effort (patch version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (0.4) + 0.40 × ecosystem value (0.5) = 0.4
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: development
Advisory age: unknown
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: patch
Migration guide: not tracked yet
Why low confidence
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· No fixed version is published for this advisory yet.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Unknown
Update @types/react-dom to 19.2.7 (no known vulnerabilities)
0.4/10
@types/react-dom is declared as "^19.1.6" and used as a development npm dependency of this repo. Latest version is 19.2.7. No known vulnerabilities in current version. Consider updating to stay current with bug fixes and improvements.
Upgrade @types/react-dom to 19.2.7 or later — trivial effort (patch version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (0.4) + 0.40 × ecosystem value (0.5) = 0.4
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: development
Advisory age: unknown
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: patch
Migration guide: not tracked yet
Why low confidence
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· No fixed version is published for this advisory yet.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Unknown
Update @tailwindcss/cli to 4.3.3 (no known vulnerabilities)
0.4/10
@tailwindcss/cli is declared as "^4.3.1" and used as a development npm dependency of this repo. Latest version is 4.3.3. No known vulnerabilities in current version. Consider updating to stay current with bug fixes and improvements.
Upgrade @tailwindcss/cli to 4.3.3 or later — trivial effort (patch version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (0.4) + 0.40 × ecosystem value (0.5) = 0.4
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: development
Advisory age: unknown
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: patch
Migration guide: not tracked yet
Why low confidence
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· No fixed version is published for this advisory yet.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Unknown
Update tailwindcss to 4.3.3 (no known vulnerabilities)
0.4/10
tailwindcss is declared as "^4.3.1" and used as a development npm dependency of this repo. Latest version is 4.3.3. No known vulnerabilities in current version. Consider updating to stay current with bug fixes and improvements.
Upgrade tailwindcss to 4.3.3 or later — trivial effort (patch version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (0.4) + 0.40 × ecosystem value (0.5) = 0.4
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: development
Advisory age: unknown
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: patch
Migration guide: not tracked yet
Why low confidence
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· No fixed version is published for this advisory yet.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Unknown
Update @types/react to 19.2.18 (no known vulnerabilities)
0.4/10
@types/react is declared as "^19.1.8" and used as a development npm dependency of this repo. Latest version is 19.2.18. No known vulnerabilities in current version. Consider updating to stay current with bug fixes and improvements.
Upgrade @types/react to 19.2.18 or later — trivial effort (patch version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (0.4) + 0.40 × ecosystem value (0.5) = 0.4
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: development
Advisory age: unknown
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: patch
Migration guide: not tracked yet
Why low confidence
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· No fixed version is published for this advisory yet.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Unknown
Update @tailwindcss/vite to 4.3.3 (no known vulnerabilities)
0.4/10
@tailwindcss/vite is declared as "^4.3.1" and used as a development npm dependency of this repo. Latest version is 4.3.3. No known vulnerabilities in current version. Consider updating to stay current with bug fixes and improvements.
Upgrade @tailwindcss/vite to 4.3.3 or later — trivial effort (patch version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (0.4) + 0.40 × ecosystem value (0.5) = 0.4
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: development
Advisory age: unknown
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: patch
Migration guide: not tracked yet
Why low confidence
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· No fixed version is published for this advisory yet.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Unknown
Deprecated package: @types/react-window needs attention
0.4/10
@types/react-window is declared as "^1.8.8" and used as a development npm dependency of this repo. This package has been deprecated by its maintainers. Consider migrating to an actively maintained alternative.
Review @types/react-window and consider updating to 2.0.0 or finding an alternative.
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (0.4) + 0.40 × ecosystem value (0.5) = 0.4
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: development
Advisory age: unknown
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why low confidence
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· No fixed version is published for this advisory yet.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Unknown
Update @vitejs/plugin-react to 6.1.1 (no known vulnerabilities)
0.4/10
@vitejs/plugin-react is declared as "^4.6.0" and used as a development npm dependency of this repo. Latest version is 6.1.1. No known vulnerabilities in current version. Consider updating to stay current with bug fixes and improvements.
Upgrade @vitejs/plugin-react to 6.1.1 or later — high effort (major version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (0.4) + 0.40 × ecosystem value (0.5) = 0.4
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: development
Advisory age: unknown
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why low confidence
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· No fixed version is published for this advisory yet.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.
Unknown
Update typescript to 7.0.2 (no known vulnerabilities)
0.4/10
typescript is declared as "~5.8.3" and used as a development npm dependency of this repo. Latest version is 7.0.2. No known vulnerabilities in current version. Consider updating to stay current with bug fixes and improvements.
Upgrade typescript to 7.0.2 or later — high effort (major version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (0.4) + 0.40 × ecosystem value (0.5) = 0.4
Impact inputs
CVSS: unknown
Severity: unknown
Dependency type: development
Advisory age: unknown
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why low confidence
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· No fixed version is published for this advisory yet.
· The number of packages depending on this repo's published package couldn't be checked, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data wasn't available for this dependency's own upstream repository, so the effort estimate is based on the semver version bump alone.

Missions

Update @tauri-apps/plugin-shell to fix a critical vulnerability(GHSA-c9pr)

Update xterm to fix a high vulnerability(GHSA-mc23)

Update react to fix a medium vulnerability(GHSA-g53w)

Update react to fix a high vulnerability(GHSA-hg79)

Update react-dom to fix a medium vulnerability(GHSA-mvjj)

Update browserslist to fix a high vulnerability(GHSA-c83g)

Update browserslist to fix a high vulnerability(GHSA-73wf)

Update nanoid to fix a high vulnerability(GHSA-xwg4)

Update picomatch to fix a high vulnerability(GHSA-c2c7)

Update nanoid to fix a medium vulnerability(GHSA-28wg)

Update nanoid to fix a medium vulnerability(GHSA-2v37)

Update postcss to fix a high vulnerability(GHSA-r28c)

Update postcss to fix a high vulnerability(GHSA-6g55)

Update @tauri-apps/cli to fix a high vulnerability(GHSA-2rcp)

Update nanoid to fix a medium vulnerability(GHSA-qrpm)

Update vite to fix a high vulnerability(GHSA-fx2h)

Update rollup to fix a high vulnerability(GHSA-mw96)

Update rollup to fix a medium vulnerability(GHSA-gcx4)

Update vite to fix a high vulnerability(GHSA-c24v)

Update vite to fix a high vulnerability(GHSA-353f)

Update vite to fix a high vulnerability(GHSA-mv48)

Update postcss to fix a medium vulnerability(GHSA-qx2v)

Update esbuild to fix a medium vulnerability(GHSA-67mh)

Update postcss to fix a medium vulnerability(GHSA-7fh5)

Update postcss to fix a medium vulnerability(GHSA-566m)

Update browserslist to fix a medium vulnerability(GHSA-w8qv)

Update picomatch to fix a medium vulnerability(GHSA-3v7f)

Update mdast-util-to-hast to fix a medium vulnerability(GHSA-4fh9)

Update vite to fix a high vulnerability(GHSA-c27g)

Update vite to fix a high vulnerability(GHSA-v2wj)

Update vite to fix a high vulnerability(GHSA-p9ff)

Update vite to fix a medium vulnerability(GHSA-xcj6)

Update vite to fix a medium vulnerability(GHSA-4r4m)

Update vite to fix a medium vulnerability(GHSA-x574)

Update vite to fix a medium vulnerability(GHSA-vg6x)

Update nanoid to fix a medium vulnerability(GHSA-mwcw)

Update vite to fix a medium vulnerability(GHSA-64vr)

Update vite to fix a medium vulnerability(GHSA-9cwx)

Update vite to fix a medium vulnerability(GHSA-8jhw)

Update vite to fix a medium vulnerability(GHSA-92r3)

Update postcss to fix a medium vulnerability(GHSA-hwj9)

Update postcss to fix a medium vulnerability(GHSA-fxqj)

Update esbuild to fix a low vulnerability(GHSA-g7r4)

Update vite to fix a medium vulnerability(GHSA-93m4)

Update vite to fix a medium vulnerability(GHSA-v6wh)

Update @babel/core to fix a low vulnerability(GHSA-4x5r)

Update vite to fix a medium vulnerability(GHSA-4w7w)

Update vite to fix a medium vulnerability(GHSA-859w)

Update vite to fix a medium vulnerability(GHSA-356w)

Update caniuse-lite to 1.0.30001810 (no known vulnerabilities)

Update @tailwindcss/oxide to 4.3.3 (no known vulnerabilities)

Update @tailwindcss/node to 4.3.3 (no known vulnerabilities)

Update @tauri-apps/plugin-dialog to 2.7.3 (no known vulnerabilities)

Update @tauri-apps/api to 2.11.1 (no known vulnerabilities)

Update @tauri-apps/plugin-opener to 2.5.5 (no known vulnerabilities)

Update @types/hast to 3.0.5 (no known vulnerabilities)

Update vite to fix a low vulnerability(GHSA-g4jq)

Update vite to fix a low vulnerability(GHSA-jqfw)

Update enhanced-resolve to 5.24.5 (no known vulnerabilities)

Update react-window to 2.3.0 (no known vulnerabilities)

Update react-refresh to 0.18.0 (no known vulnerabilities)

Update @tauri-apps/plugin-updater to 2.11.0 (no known vulnerabilities)

Update @parcel/watcher to 2.6.0 (no known vulnerabilities)

Deprecated package: xterm-addon-web-links needs attention

Deprecated package: xterm-addon-fit needs attention

Update @rolldown/pluginutils to 1.0.1 (no known vulnerabilities)

Update autoprefixer to 10.5.4 (no known vulnerabilities)

Update @types/react-dom to 19.2.7 (no known vulnerabilities)

Update @tailwindcss/cli to 4.3.3 (no known vulnerabilities)

Update tailwindcss to 4.3.3 (no known vulnerabilities)

Update @types/react to 19.2.18 (no known vulnerabilities)

Update @tailwindcss/vite to 4.3.3 (no known vulnerabilities)

Deprecated package: @types/react-window needs attention

Update @vitejs/plugin-react to 6.1.1 (no known vulnerabilities)

Update typescript to 7.0.2 (no known vulnerabilities)