This run took 197 seconds.
$ date
--- stdout ---
Sun Oct 5 07:50:08 UTC 2025
--- end ---
$ git clone file:///srv/git/mediawiki-extensions-MobileFrontend.git repo --depth=1 -b REL1_39
--- stderr ---
Cloning into 'repo'...
--- stdout ---
--- end ---
$ git config user.name libraryupgrader
--- stdout ---
--- end ---
$ git config user.email tools.libraryupgrader@tools.wmflabs.org
--- stdout ---
--- end ---
$ git submodule update --init
--- stdout ---
--- end ---
$ grr init
--- stdout ---
Installed commit-msg hook.
--- end ---
$ git show-ref refs/heads/REL1_39
--- stdout ---
035b2bd532ddad376db6c267fe415f12eb8f0049 refs/heads/REL1_39
--- end ---
$ /usr/bin/npm audit --json
--- stdout ---
{
"auditReportVersion": 2,
"vulnerabilities": {
"@babel/helpers": {
"name": "@babel/helpers",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1104001,
"name": "@babel/helpers",
"dependency": "@babel/helpers",
"title": "Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups",
"url": "https://github.com/advisories/GHSA-968p-4wvh-cqc8",
"severity": "moderate",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 6.2,
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<7.26.10"
}
],
"effects": [],
"range": "<7.26.10",
"nodes": [
"node_modules/@babel/helpers"
],
"fixAvailable": true
},
"@babel/runtime": {
"name": "@babel/runtime",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1104000,
"name": "@babel/runtime",
"dependency": "@babel/runtime",
"title": "Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups",
"url": "https://github.com/advisories/GHSA-968p-4wvh-cqc8",
"severity": "moderate",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 6.2,
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<7.26.10"
}
],
"effects": [],
"range": "<7.26.10",
"nodes": [
"node_modules/@babel/runtime"
],
"fixAvailable": true
},
"@babel/traverse": {
"name": "@babel/traverse",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1096886,
"name": "@babel/traverse",
"dependency": "@babel/traverse",
"title": "Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code",
"url": "https://github.com/advisories/GHSA-67hx-6x53-jw92",
"severity": "critical",
"cwe": [
"CWE-184",
"CWE-697"
],
"cvss": {
"score": 9.4,
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
},
"range": "<7.23.2"
}
],
"effects": [],
"range": "<7.23.2",
"nodes": [
"node_modules/@babel/traverse"
],
"fixAvailable": true
},
"@storybook/addon-actions": {
"name": "@storybook/addon-actions",
"severity": "low",
"isDirect": true,
"via": [
"@storybook/addons",
"@storybook/api",
"@storybook/client-api",
"@storybook/components",
"@storybook/theming",
"global"
],
"effects": [],
"range": "3.3.0-alpha.0 - 7.0.0-rc.11",
"nodes": [
"node_modules/@storybook/addon-actions"
],
"fixAvailable": {
"name": "@storybook/addon-actions",
"version": "9.0.8",
"isSemVerMajor": true
}
},
"@storybook/addons": {
"name": "@storybook/addons",
"severity": "low",
"isDirect": false,
"via": [
"@storybook/api",
"@storybook/client-logger",
"@storybook/router",
"@storybook/theming",
"global"
],
"effects": [
"@storybook/addon-actions",
"@storybook/html",
"@storybook/ui"
],
"range": "4.0.0-alpha.0 - 7.0.0-rc.11",
"nodes": [
"node_modules/@storybook/addons"
],
"fixAvailable": {
"name": "@storybook/addon-actions",
"version": "9.0.8",
"isSemVerMajor": true
}
},
"@storybook/api": {
"name": "@storybook/api",
"severity": "low",
"isDirect": false,
"via": [
"@storybook/client-logger",
"@storybook/router",
"@storybook/theming",
"global",
"telejson"
],
"effects": [
"@storybook/addon-actions",
"@storybook/addons",
"@storybook/ui"
],
"range": "<=7.0.0-rc.11",
"nodes": [
"node_modules/@storybook/api"
],
"fixAvailable": {
"name": "@storybook/addon-actions",
"version": "9.0.8",
"isSemVerMajor": true
}
},
"@storybook/builder-webpack4": {
"name": "@storybook/builder-webpack4",
"severity": "high",
"isDirect": false,
"via": [
"@storybook/addons",
"@storybook/api",
"@storybook/channel-postmessage",
"@storybook/client-api",
"@storybook/client-logger",
"@storybook/components",
"@storybook/core-common",
"@storybook/router",
"@storybook/theming",
"@storybook/ui",
"autoprefixer",
"css-loader",
"fork-ts-checker-webpack-plugin",
"global",
"postcss",
"postcss-flexbugs-fixes",
"react-dev-utils",
"webpack",
"webpack-dev-middleware"
],
"effects": [],
"range": "*",
"nodes": [
"node_modules/@storybook/builder-webpack4"
],
"fixAvailable": true
},
"@storybook/channel-postmessage": {
"name": "@storybook/channel-postmessage",
"severity": "low",
"isDirect": false,
"via": [
"@storybook/client-logger",
"global",
"telejson"
],
"effects": [
"@storybook/client-api"
],
"range": "3.1.2 - 7.0.0-rc.11",
"nodes": [
"node_modules/@storybook/channel-postmessage"
],
"fixAvailable": {
"name": "@storybook/addon-actions",
"version": "9.0.8",
"isSemVerMajor": true
}
},
"@storybook/client-api": {
"name": "@storybook/client-api",
"severity": "low",
"isDirect": false,
"via": [
"@storybook/addons",
"@storybook/channel-postmessage",
"@storybook/client-logger",
"global"
],
"effects": [
"@storybook/addon-actions",
"@storybook/html"
],
"range": "<=7.0.0-rc.11",
"nodes": [
"node_modules/@storybook/client-api"
],
"fixAvailable": {
"name": "@storybook/addon-actions",
"version": "9.0.8",
"isSemVerMajor": true
}
},
"@storybook/client-logger": {
"name": "@storybook/client-logger",
"severity": "low",
"isDirect": false,
"via": [
"global"
],
"effects": [
"@storybook/addons",
"@storybook/api",
"@storybook/channel-postmessage",
"@storybook/client-api",
"@storybook/components",
"@storybook/router",
"@storybook/theming",
"@storybook/ui"
],
"range": "6.0.0-alpha.0 - 7.0.0-rc.11",
"nodes": [
"node_modules/@storybook/client-logger"
],
"fixAvailable": {
"name": "@storybook/addon-actions",
"version": "9.0.8",
"isSemVerMajor": true
}
},
"@storybook/components": {
"name": "@storybook/components",
"severity": "moderate",
"isDirect": false,
"via": [
"@storybook/client-logger",
"@storybook/theming",
"global",
"react-syntax-highlighter"
],
"effects": [
"@storybook/addon-actions",
"@storybook/builder-webpack4",
"@storybook/ui"
],
"range": "4.0.0-alpha.0 - 7.0.0-rc.11",
"nodes": [
"node_modules/@storybook/components"
],
"fixAvailable": {
"name": "@storybook/addon-actions",
"version": "9.0.8",
"isSemVerMajor": true
}
},
"@storybook/core": {
"name": "@storybook/core",
"severity": "high",
"isDirect": false,
"via": [
"@storybook/core-client",
"@storybook/core-server"
],
"effects": [],
"range": "6.2.0-alpha.0 - 6.5.17-alpha.0",
"nodes": [
"node_modules/@storybook/core"
],
"fixAvailable": true
},
"@storybook/core-client": {
"name": "@storybook/core-client",
"severity": "moderate",
"isDirect": false,
"via": [
"@storybook/addons",
"@storybook/channel-postmessage",
"@storybook/client-api",
"@storybook/client-logger",
"@storybook/ui",
"global"
],
"effects": [
"@storybook/core",
"@storybook/core-server"
],
"range": "<=7.0.0-rc.11",
"nodes": [
"node_modules/@storybook/core-client"
],
"fixAvailable": true
},
"@storybook/core-common": {
"name": "@storybook/core-common",
"severity": "moderate",
"isDirect": false,
"via": [
"webpack"
],
"effects": [
"@storybook/html"
],
"range": "<=6.5.17-alpha.0",
"nodes": [
"node_modules/@storybook/core-common"
],
"fixAvailable": {
"name": "@storybook/html",
"version": "9.1.10",
"isSemVerMajor": true
}
},
"@storybook/core-server": {
"name": "@storybook/core-server",
"severity": "high",
"isDirect": false,
"via": [
"@storybook/addons",
"@storybook/builder-webpack4",
"@storybook/core-client",
"@storybook/core-common",
"@storybook/theming",
"@storybook/ui",
"cpy",
"css-loader",
"global",
"ip",
"telejson",
"webpack",
"webpack-dev-middleware"
],
"effects": [
"@storybook/core"
],
"range": "<=7.6.19 || 8.0.0-alpha.0 - 8.1.5 || 8.2.0-alpha.0 - 8.2.0-beta.3",
"nodes": [
"node_modules/@storybook/core-server"
],
"fixAvailable": true
},
"@storybook/html": {
"name": "@storybook/html",
"severity": "high",
"isDirect": true,
"via": [
"@storybook/addons",
"@storybook/client-api",
"@storybook/core",
"@storybook/core-common",
"global"
],
"effects": [],
"range": "<=7.0.0-rc.11",
"nodes": [
"node_modules/@storybook/html"
],
"fixAvailable": {
"name": "@storybook/html",
"version": "9.1.10",
"isSemVerMajor": true
}
},
"@storybook/router": {
"name": "@storybook/router",
"severity": "low",
"isDirect": false,
"via": [
"@storybook/client-logger",
"global"
],
"effects": [
"@storybook/addons",
"@storybook/api",
"@storybook/ui"
],
"range": "<=7.0.0-rc.11",
"nodes": [
"node_modules/@storybook/router"
],
"fixAvailable": {
"name": "@storybook/addon-actions",
"version": "9.0.8",
"isSemVerMajor": true
}
},
"@storybook/theming": {
"name": "@storybook/theming",
"severity": "low",
"isDirect": false,
"via": [
"@storybook/client-logger",
"global"
],
"effects": [
"@storybook/addon-actions",
"@storybook/components"
],
"range": "<=7.0.0-rc.11",
"nodes": [
"node_modules/@storybook/theming"
],
"fixAvailable": {
"name": "@storybook/addon-actions",
"version": "9.0.8",
"isSemVerMajor": true
}
},
"@storybook/ui": {
"name": "@storybook/ui",
"severity": "moderate",
"isDirect": false,
"via": [
"@storybook/addons",
"@storybook/api",
"@storybook/client-logger",
"@storybook/components",
"@storybook/router",
"@storybook/theming",
"global",
"markdown-to-jsx"
],
"effects": [
"@storybook/builder-webpack4",
"@storybook/core-client"
],
"range": "3.1.0 - 7.0.0-alpha.10",
"nodes": [
"node_modules/@storybook/ui"
],
"fixAvailable": true
},
"@wikimedia/mw-node-qunit": {
"name": "@wikimedia/mw-node-qunit",
"severity": "moderate",
"isDirect": true,
"via": [
"eslint-config-wikimedia",
"jsdom",
"qunit"
],
"effects": [],
"range": "<=6.2.1",
"nodes": [
"node_modules/@wikimedia/mw-node-qunit"
],
"fixAvailable": {
"name": "@wikimedia/mw-node-qunit",
"version": "6.4.2",
"isSemVerMajor": false
}
},
"ansi-regex": {
"name": "ansi-regex",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1094091,
"name": "ansi-regex",
"dependency": "ansi-regex",
"title": "Inefficient Regular Expression Complexity in chalk/ansi-regex",
"url": "https://github.com/advisories/GHSA-93q8-gq69-wqmw",
"severity": "high",
"cwe": [
"CWE-697",
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=4.0.0 <4.1.1"
}
],
"effects": [],
"range": "4.0.0 - 4.1.0",
"nodes": [
"node_modules/@wikimedia/mw-node-qunit/node_modules/ansi-regex",
"node_modules/webpack-cli/node_modules/ansi-regex"
],
"fixAvailable": true
},
"anymatch": {
"name": "anymatch",
"severity": "moderate",
"isDirect": false,
"via": [
"micromatch"
],
"effects": [
"chokidar",
"sane"
],
"range": "1.2.0 - 2.0.0",
"nodes": [
"node_modules/sane/node_modules/anymatch",
"node_modules/watchpack-chokidar2/node_modules/anymatch"
],
"fixAvailable": {
"name": "@wikimedia/mw-node-qunit",
"version": "6.4.2",
"isSemVerMajor": false
}
},
"autoprefixer": {
"name": "autoprefixer",
"severity": "moderate",
"isDirect": false,
"via": [
"postcss"
],
"effects": [
"stylelint"
],
"range": "1.0.20131222 - 9.8.8",
"nodes": [
"node_modules/autoprefixer"
],
"fixAvailable": {
"name": "stylelint-config-wikimedia",
"version": "0.18.0",
"isSemVerMajor": true
}
},
"axios": {
"name": "axios",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1097679,
"name": "axios",
"dependency": "axios",
"title": "Axios Cross-Site Request Forgery Vulnerability",
"url": "https://github.com/advisories/GHSA-wf5p-g6vw-rhxx",
"severity": "moderate",
"cwe": [
"CWE-352"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
},
"range": ">=0.8.1 <0.28.0"
},
{
"source": 1103617,
"name": "axios",
"dependency": "axios",
"title": "axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL",
"url": "https://github.com/advisories/GHSA-jr5f-v2jv-69x6",
"severity": "high",
"cwe": [
"CWE-918"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<0.30.0"
},
{
"source": 1108262,
"name": "axios",
"dependency": "axios",
"title": "Axios is vulnerable to DoS attack through lack of data size check",
"url": "https://github.com/advisories/GHSA-4hjh-wcwx-xvwj",
"severity": "high",
"cwe": [
"CWE-770"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<0.30.2"
}
],
"effects": [
"bundlesize",
"github-build"
],
"range": "<=0.30.1",
"nodes": [
"node_modules/axios",
"node_modules/github-build/node_modules/axios"
],
"fixAvailable": {
"name": "bundlesize",
"version": "0.18.2",
"isSemVerMajor": false
}
},
"body-parser": {
"name": "body-parser",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1099520,
"name": "body-parser",
"dependency": "body-parser",
"title": "body-parser vulnerable to denial of service when url encoding is enabled",
"url": "https://github.com/advisories/GHSA-qwcr-r2fm-qrc7",
"severity": "high",
"cwe": [
"CWE-405"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<1.20.3"
},
"qs"
],
"effects": [
"express"
],
"range": "<=1.20.2",
"nodes": [
"node_modules/body-parser"
],
"fixAvailable": true
},
"brace-expansion": {
"name": "brace-expansion",
"severity": "low",
"isDirect": false,
"via": [
{
"source": 1105443,
"name": "brace-expansion",
"dependency": "brace-expansion",
"title": "brace-expansion Regular Expression Denial of Service vulnerability",
"url": "https://github.com/advisories/GHSA-v6h2-p8h4-qcjw",
"severity": "low",
"cwe": [
"CWE-400"
],
"cvss": {
"score": 3.1,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L"
},
"range": ">=1.0.0 <=1.1.11"
}
],
"effects": [],
"range": "1.0.0 - 1.1.11",
"nodes": [
"node_modules/brace-expansion"
],
"fixAvailable": true
},
"braces": {
"name": "braces",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1098094,
"name": "braces",
"dependency": "braces",
"title": "Uncontrolled resource consumption in braces",
"url": "https://github.com/advisories/GHSA-grv7-fg5c-xmjg",
"severity": "high",
"cwe": [
"CWE-400",
"CWE-1050"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<3.0.3"
}
],
"effects": [
"chokidar",
"micromatch"
],
"range": "<3.0.3",
"nodes": [
"node_modules/@storybook/builder-webpack4/node_modules/braces",
"node_modules/braces",
"node_modules/fast-glob/node_modules/braces",
"node_modules/findup-sync/node_modules/braces",
"node_modules/react-dev-utils/node_modules/micromatch/node_modules/braces",
"node_modules/sane/node_modules/braces",
"node_modules/watchpack-chokidar2/node_modules/braces",
"node_modules/webpack-cli/node_modules/braces",
"node_modules/webpack/node_modules/braces"
],
"fixAvailable": {
"name": "webpack",
"version": "5.102.0",
"isSemVerMajor": true
}
},
"browserify-sign": {
"name": "browserify-sign",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1102445,
"name": "browserify-sign",
"dependency": "browserify-sign",
"title": "browserify-sign upper bound check issue in `dsaVerify` leads to a signature forgery attack",
"url": "https://github.com/advisories/GHSA-x9w5-v3q2-3rhw",
"severity": "high",
"cwe": [
"CWE-347"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
},
"range": ">=2.6.0 <=4.2.1"
}
],
"effects": [],
"range": "2.6.0 - 4.2.1",
"nodes": [
"node_modules/browserify-sign"
],
"fixAvailable": true
},
"browserslist": {
"name": "browserslist",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1093035,
"name": "browserslist",
"dependency": "browserslist",
"title": "Regular Expression Denial of Service in browserslist",
"url": "https://github.com/advisories/GHSA-w8qv-6jwh-64r5",
"severity": "moderate",
"cwe": [
"CWE-400",
"CWE-1333"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": ">=4.0.0 <4.16.5"
}
],
"effects": [
"react-dev-utils"
],
"range": "4.0.0 - 4.16.4",
"nodes": [
"node_modules/react-dev-utils/node_modules/browserslist"
],
"fixAvailable": true
},
"bundlesize": {
"name": "bundlesize",
"severity": "high",
"isDirect": true,
"via": [
"axios"
],
"effects": [],
"range": "0.3.0 - 0.18.1 || >=1.0.0-beta.1",
"nodes": [
"node_modules/bundlesize"
],
"fixAvailable": {
"name": "bundlesize",
"version": "0.18.2",
"isSemVerMajor": false
}
},
"chokidar": {
"name": "chokidar",
"severity": "high",
"isDirect": false,
"via": [
"anymatch",
"braces",
"readdirp"
],
"effects": [
"watchpack-chokidar2"
],
"range": "1.3.0 - 2.1.8",
"nodes": [
"node_modules/watchpack-chokidar2/node_modules/chokidar"
],
"fixAvailable": true
},
"cipher-base": {
"name": "cipher-base",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1107538,
"name": "cipher-base",
"dependency": "cipher-base",
"title": "cipher-base is missing type checks, leading to hash rewind and passing on crafted data",
"url": "https://github.com/advisories/GHSA-cpq7-6gpm-g9rc",
"severity": "critical",
"cwe": [
"CWE-20"
],
"cvss": {
"score": 9.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
},
"range": "<=1.0.4"
}
],
"effects": [],
"range": "<=1.0.4",
"nodes": [
"node_modules/cipher-base"
],
"fixAvailable": true
},
"cookie": {
"name": "cookie",
"severity": "low",
"isDirect": false,
"via": [
{
"source": 1103907,
"name": "cookie",
"dependency": "cookie",
"title": "cookie accepts cookie name, path, and domain with out of bounds characters",
"url": "https://github.com/advisories/GHSA-pxg6-pf52-xh8x",
"severity": "low",
"cwe": [
"CWE-74"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<0.7.0"
}
],
"effects": [
"express"
],
"range": "<0.7.0",
"nodes": [
"node_modules/cookie"
],
"fixAvailable": true
},
"core-js-compat": {
"name": "core-js-compat",
"severity": "high",
"isDirect": false,
"via": [
"semver"
],
"effects": [],
"range": "3.6.0 - 3.25.0",
"nodes": [
"node_modules/core-js-compat"
],
"fixAvailable": true
},
"cpy": {
"name": "cpy",
"severity": "moderate",
"isDirect": false,
"via": [
"globby"
],
"effects": [
"@storybook/core-server"
],
"range": "7.0.0 - 8.1.2",
"nodes": [
"node_modules/cpy"
],
"fixAvailable": true
},
"cross-spawn": {
"name": "cross-spawn",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1104663,
"name": "cross-spawn",
"dependency": "cross-spawn",
"title": "Regular Expression Denial of Service (ReDoS) in cross-spawn",
"url": "https://github.com/advisories/GHSA-3xgq-45jj-v275",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<6.0.6"
},
{
"source": 1104664,
"name": "cross-spawn",
"dependency": "cross-spawn",
"title": "Regular Expression Denial of Service (ReDoS) in cross-spawn",
"url": "https://github.com/advisories/GHSA-3xgq-45jj-v275",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=7.0.0 <7.0.5"
}
],
"effects": [
"pre-commit",
"react-dev-utils",
"webpack-cli"
],
"range": "<6.0.6 || >=7.0.0 <7.0.5",
"nodes": [
"node_modules/cross-spawn",
"node_modules/eslint/node_modules/cross-spawn",
"node_modules/foreground-child/node_modules/cross-spawn",
"node_modules/istanbul-lib-processinfo/node_modules/cross-spawn",
"node_modules/pre-commit/node_modules/cross-spawn",
"node_modules/react-dev-utils/node_modules/cross-spawn"
],
"fixAvailable": {
"name": "pre-commit",
"version": "1.0.10",
"isSemVerMajor": true
}
},
"css-loader": {
"name": "css-loader",
"severity": "moderate",
"isDirect": false,
"via": [
"icss-utils",
"postcss",
"postcss-modules-extract-imports",
"postcss-modules-local-by-default",
"postcss-modules-scope",
"postcss-modules-values"
],
"effects": [],
"range": "0.15.0 - 4.3.0",
"nodes": [
"node_modules/css-loader"
],
"fixAvailable": true
},
"decode-uri-component": {
"name": "decode-uri-component",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1094087,
"name": "decode-uri-component",
"dependency": "decode-uri-component",
"title": "decode-uri-component vulnerable to Denial of Service (DoS)",
"url": "https://github.com/advisories/GHSA-w573-4hg7-7wgq",
"severity": "high",
"cwe": [
"CWE-20"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<0.2.1"
}
],
"effects": [],
"range": "<0.2.1",
"nodes": [
"node_modules/decode-uri-component"
],
"fixAvailable": true
},
"elliptic": {
"name": "elliptic",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1098593,
"name": "elliptic",
"dependency": "elliptic",
"title": "Elliptic's EDDSA missing signature length check",
"url": "https://github.com/advisories/GHSA-f7q4-pwc6-w24p",
"severity": "low",
"cwe": [
"CWE-347"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
},
"range": ">=4.0.0 <=6.5.6"
},
{
"source": 1098594,
"name": "elliptic",
"dependency": "elliptic",
"title": "Elliptic's ECDSA missing check for whether leading bit of r and s is zero",
"url": "https://github.com/advisories/GHSA-977x-g7h5-7qgw",
"severity": "low",
"cwe": [
"CWE-130"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
},
"range": ">=2.0.0 <=6.5.6"
},
{
"source": 1098595,
"name": "elliptic",
"dependency": "elliptic",
"title": "Elliptic allows BER-encoded signatures",
"url": "https://github.com/advisories/GHSA-49q7-c7j4-3p7m",
"severity": "low",
"cwe": [
"CWE-347"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
},
"range": ">=5.2.1 <=6.5.6"
},
{
"source": 1101424,
"name": "elliptic",
"dependency": "elliptic",
"title": "Elliptic's verify function omits uniqueness validation",
"url": "https://github.com/advisories/GHSA-434g-2637-qmqr",
"severity": "low",
"cwe": [
"CWE-347"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
"range": "<6.5.6"
},
{
"source": 1102901,
"name": "elliptic",
"dependency": "elliptic",
"title": "Elliptic's private key extraction in ECDSA upon signing a malformed input (e.g. a string)",
"url": "https://github.com/advisories/GHSA-vjh7-7g9h-fjfh",
"severity": "critical",
"cwe": [
"CWE-200"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<=6.6.0"
},
{
"source": 1105750,
"name": "elliptic",
"dependency": "elliptic",
"title": "Valid ECDSA signatures erroneously rejected in Elliptic",
"url": "https://github.com/advisories/GHSA-fc9h-whq2-v747",
"severity": "low",
"cwe": [
"CWE-347"
],
"cvss": {
"score": 4.8,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"
},
"range": "<6.6.0"
}
],
"effects": [],
"range": "<=6.6.0",
"nodes": [
"node_modules/elliptic"
],
"fixAvailable": true
},
"eslint": {
"name": "eslint",
"severity": "low",
"isDirect": false,
"via": [
"inquirer"
],
"effects": [
"eslint-config-wikimedia"
],
"range": "4.0.0-alpha.0 - 7.2.0",
"nodes": [
"node_modules/@wikimedia/mw-node-qunit/node_modules/eslint"
],
"fixAvailable": {
"name": "eslint-config-wikimedia",
"version": "0.31.0",
"isSemVerMajor": true
}
},
"eslint-config-wikimedia": {
"name": "eslint-config-wikimedia",
"severity": "high",
"isDirect": true,
"via": [
"eslint",
"eslint-plugin-compat"
],
"effects": [
"@wikimedia/mw-node-qunit"
],
"range": "0.18.0 - 0.21.0 || 0.9.0 - 0.15.3",
"nodes": [
"node_modules/@wikimedia/mw-node-qunit/node_modules/eslint-config-wikimedia",
"node_modules/eslint-config-wikimedia"
],
"fixAvailable": {
"name": "eslint-config-wikimedia",
"version": "0.31.0",
"isSemVerMajor": true
}
},
"eslint-plugin-compat": {
"name": "eslint-plugin-compat",
"severity": "high",
"isDirect": false,
"via": [
"semver"
],
"effects": [
"eslint-config-wikimedia"
],
"range": "3.6.0-0 - 4.1.4",
"nodes": [
"node_modules/eslint-plugin-compat"
],
"fixAvailable": {
"name": "eslint-config-wikimedia",
"version": "0.31.0",
"isSemVerMajor": true
}
},
"express": {
"name": "express",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1096820,
"name": "express",
"dependency": "express",
"title": "Express.js Open Redirect in malformed URLs",
"url": "https://github.com/advisories/GHSA-rv95-896h-c2vc",
"severity": "moderate",
"cwe": [
"CWE-601",
"CWE-1286"
],
"cvss": {
"score": 6.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
"range": "<4.19.2"
},
{
"source": 1100530,
"name": "express",
"dependency": "express",
"title": "express vulnerable to XSS via response.redirect()",
"url": "https://github.com/advisories/GHSA-qw6h-vgh9-j6wx",
"severity": "low",
"cwe": [
"CWE-79"
],
"cvss": {
"score": 5,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L"
},
"range": "<4.20.0"
},
"body-parser",
"cookie",
"path-to-regexp",
"qs",
"send",
"serve-static"
],
"effects": [],
"range": "<=4.21.0 || 5.0.0-alpha.1 - 5.0.0",
"nodes": [
"node_modules/express"
],
"fixAvailable": true
},
"external-editor": {
"name": "external-editor",
"severity": "low",
"isDirect": false,
"via": [
"tmp"
],
"effects": [
"inquirer"
],
"range": ">=1.1.1",
"nodes": [
"node_modules/external-editor"
],
"fixAvailable": {
"name": "eslint-config-wikimedia",
"version": "0.31.0",
"isSemVerMajor": true
}
},
"fast-glob": {
"name": "fast-glob",
"severity": "moderate",
"isDirect": false,
"via": [
"micromatch"
],
"effects": [
"globby"
],
"range": "<=2.2.7",
"nodes": [
"node_modules/fast-glob"
],
"fixAvailable": true
},
"findup-sync": {
"name": "findup-sync",
"severity": "moderate",
"isDirect": false,
"via": [
"micromatch"
],
"effects": [
"qunit",
"webpack-cli"
],
"range": "0.4.0 - 3.0.0",
"nodes": [
"node_modules/findup-sync",
"node_modules/webpack-cli/node_modules/findup-sync"
],
"fixAvailable": {
"name": "@wikimedia/mw-node-qunit",
"version": "6.4.2",
"isSemVerMajor": false
}
},
"follow-redirects": {
"name": "follow-redirects",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1092623,
"name": "follow-redirects",
"dependency": "follow-redirects",
"title": "Exposure of Sensitive Information to an Unauthorized Actor in follow-redirects",
"url": "https://github.com/advisories/GHSA-pw2r-vq6v-hr8c",
"severity": "moderate",
"cwe": [
"CWE-200",
"CWE-212"
],
"cvss": {
"score": 5.9,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
"range": "<1.14.8"
},
{
"source": 1096353,
"name": "follow-redirects",
"dependency": "follow-redirects",
"title": "Follow Redirects improperly handles URLs in the url.parse() function",
"url": "https://github.com/advisories/GHSA-jchw-25xp-jwwc",
"severity": "moderate",
"cwe": [
"CWE-20",
"CWE-601"
],
"cvss": {
"score": 6.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
"range": "<1.15.4"
},
{
"source": 1096856,
"name": "follow-redirects",
"dependency": "follow-redirects",
"title": "follow-redirects' Proxy-Authorization header kept across hosts",
"url": "https://github.com/advisories/GHSA-cxjh-pqwp-8mfp",
"severity": "moderate",
"cwe": [
"CWE-200"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
},
"range": "<=1.15.5"
},
{
"source": 1102323,
"name": "follow-redirects",
"dependency": "follow-redirects",
"title": "Exposure of sensitive information in follow-redirects",
"url": "https://github.com/advisories/GHSA-74fj-2j2h-c42q",
"severity": "high",
"cwe": [
"CWE-359"
],
"cvss": {
"score": 8,
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
},
"range": "<1.14.7"
}
],
"effects": [],
"range": "<=1.15.5",
"nodes": [
"node_modules/follow-redirects"
],
"fixAvailable": true
},
"fork-ts-checker-webpack-plugin": {
"name": "fork-ts-checker-webpack-plugin",
"severity": "moderate",
"isDirect": false,
"via": [
"micromatch"
],
"effects": [
"react-dev-utils"
],
"range": "0.4.14 - 4.1.6",
"nodes": [
"node_modules/@storybook/builder-webpack4/node_modules/fork-ts-checker-webpack-plugin",
"node_modules/react-dev-utils/node_modules/fork-ts-checker-webpack-plugin"
],
"fixAvailable": true
},
"form-data": {
"name": "form-data",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1106508,
"name": "form-data",
"dependency": "form-data",
"title": "form-data uses unsafe random function in form-data for choosing boundary",
"url": "https://github.com/advisories/GHSA-fjxv-7rqg-78g4",
"severity": "critical",
"cwe": [
"CWE-330"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=3.0.0 <3.0.4"
},
{
"source": 1106509,
"name": "form-data",
"dependency": "form-data",
"title": "form-data uses unsafe random function in form-data for choosing boundary",
"url": "https://github.com/advisories/GHSA-fjxv-7rqg-78g4",
"severity": "critical",
"cwe": [
"CWE-330"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<2.5.4"
}
],
"effects": [
"request"
],
"range": ">=3.0.0 <3.0.4 || <2.5.4",
"nodes": [
"node_modules/form-data",
"node_modules/request/node_modules/form-data"
],
"fixAvailable": {
"name": "jsdom",
"version": "27.0.0",
"isSemVerMajor": true
}
},
"github-build": {
"name": "github-build",
"severity": "high",
"isDirect": false,
"via": [
"axios"
],
"effects": [],
"range": "<=1.2.3",
"nodes": [
"node_modules/github-build"
],
"fixAvailable": true
},
"global": {
"name": "global",
"severity": "low",
"isDirect": false,
"via": [
"min-document"
],
"effects": [
"@storybook/addon-actions",
"@storybook/addons",
"@storybook/api",
"@storybook/channel-postmessage",
"@storybook/client-api",
"@storybook/client-logger",
"@storybook/components",
"@storybook/core-client",
"@storybook/core-server",
"@storybook/html",
"@storybook/router",
"@storybook/theming",
"@storybook/ui",
"telejson"
],
"range": ">=2.0.3",
"nodes": [
"node_modules/global"
],
"fixAvailable": {
"name": "@storybook/addon-actions",
"version": "9.0.8",
"isSemVerMajor": true
}
},
"globby": {
"name": "globby",
"severity": "moderate",
"isDirect": false,
"via": [
"fast-glob"
],
"effects": [
"cpy"
],
"range": "8.0.0 - 9.2.0",
"nodes": [
"node_modules/globby"
],
"fixAvailable": true
},
"icss-utils": {
"name": "icss-utils",
"severity": "moderate",
"isDirect": false,
"via": [
"postcss"
],
"effects": [
"css-loader",
"postcss-modules-local-by-default",
"postcss-modules-values"
],
"range": "<=4.1.1",
"nodes": [
"node_modules/icss-utils"
],
"fixAvailable": true
},
"immer": {
"name": "immer",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1097196,
"name": "immer",
"dependency": "immer",
"title": "Prototype Pollution in immer",
"url": "https://github.com/advisories/GHSA-c36v-fmgq-m8hx",
"severity": "high",
"cwe": [
"CWE-915",
"CWE-1321"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=7.0.0 <9.0.6"
},
{
"source": 1097209,
"name": "immer",
"dependency": "immer",
"title": "Prototype Pollution in immer",
"url": "https://github.com/advisories/GHSA-33f9-j839-rf8h",
"severity": "critical",
"cwe": [
"CWE-843",
"CWE-1321"
],
"cvss": {
"score": 9.8,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"range": ">=7.0.0 <9.0.6"
}
],
"effects": [],
"range": "7.0.0 - 9.0.5",
"nodes": [
"node_modules/immer"
],
"fixAvailable": true
},
"inquirer": {
"name": "inquirer",
"severity": "low",
"isDirect": false,
"via": [
"external-editor"
],
"effects": [
"eslint"
],
"range": "3.0.0 - 8.2.6 || 9.0.0 - 9.3.7",
"nodes": [
"node_modules/@wikimedia/mw-node-qunit/node_modules/inquirer"
],
"fixAvailable": {
"name": "eslint-config-wikimedia",
"version": "0.31.0",
"isSemVerMajor": true
}
},
"ip": {
"name": "ip",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1097720,
"name": "ip",
"dependency": "ip",
"title": "NPM IP package incorrectly identifies some private IP addresses as public",
"url": "https://github.com/advisories/GHSA-78xj-cgh5-2h22",
"severity": "low",
"cwe": [
"CWE-918"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<1.1.9"
},
{
"source": 1101851,
"name": "ip",
"dependency": "ip",
"title": "ip SSRF improper categorization in isPublic",
"url": "https://github.com/advisories/GHSA-2p57-rm9w-gvfp",
"severity": "high",
"cwe": [
"CWE-918"
],
"cvss": {
"score": 8.1,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"range": "<=2.0.1"
}
],
"effects": [
"@storybook/core-server"
],
"range": "*",
"nodes": [
"node_modules/ip"
],
"fixAvailable": true
},
"jsdoc": {
"name": "jsdoc",
"severity": "high",
"isDirect": true,
"via": [
"markdown-it",
"marked",
"taffydb"
],
"effects": [],
"range": "3.2.0-dev - 3.6.11",
"nodes": [
"node_modules/jsdoc"
],
"fixAvailable": {
"name": "jsdoc",
"version": "3.6.11",
"isSemVerMajor": false
}
},
"jsdom": {
"name": "jsdom",
"severity": "moderate",
"isDirect": true,
"via": [
"request",
"request-promise-native",
"tough-cookie"
],
"effects": [
"@wikimedia/mw-node-qunit"
],
"range": "0.1.20 || 0.2.0 - 16.5.3",
"nodes": [
"node_modules/jsdom"
],
"fixAvailable": {
"name": "jsdom",
"version": "27.0.0",
"isSemVerMajor": true
}
},
"json-schema": {
"name": "json-schema",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1101855,
"name": "json-schema",
"dependency": "json-schema",
"title": "json-schema is vulnerable to Prototype Pollution",
"url": "https://github.com/advisories/GHSA-896r-f27r-55mw",
"severity": "critical",
"cwe": [
"CWE-915",
"CWE-1321"
],
"cvss": {
"score": 9.8,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"range": "<0.4.0"
}
],
"effects": [
"jsprim"
],
"range": "<0.4.0",
"nodes": [
"node_modules/json-schema"
],
"fixAvailable": true
},
"json5": {
"name": "json5",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1096543,
"name": "json5",
"dependency": "json5",
"title": "Prototype Pollution in JSON5 via Parse Method",
"url": "https://github.com/advisories/GHSA-9c47-m6qq-7p4h",
"severity": "high",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 7.1,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H"
},
"range": "<1.0.2"
},
{
"source": 1096544,
"name": "json5",
"dependency": "json5",
"title": "Prototype Pollution in JSON5 via Parse Method",
"url": "https://github.com/advisories/GHSA-9c47-m6qq-7p4h",
"severity": "high",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 7.1,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H"
},
"range": ">=2.0.0 <2.2.2"
}
],
"effects": [],
"range": "<1.0.2 || >=2.0.0 <2.2.2",
"nodes": [
"node_modules/json5",
"node_modules/loader-utils/node_modules/json5",
"node_modules/webpack-cli/node_modules/json5"
],
"fixAvailable": true
},
"jsprim": {
"name": "jsprim",
"severity": "critical",
"isDirect": false,
"via": [
"json-schema"
],
"effects": [],
"range": "0.3.0 - 1.4.1 || 2.0.0 - 2.0.1",
"nodes": [
"node_modules/jsprim"
],
"fixAvailable": true
},
"less": {
"name": "less",
"severity": "moderate",
"isDirect": true,
"via": [
"request"
],
"effects": [],
"range": "1.4.0-b1 - 2.6.1 || 2.7.2 - 3.11.3",
"nodes": [
"node_modules/less"
],
"fixAvailable": {
"name": "less",
"version": "3.13.1",
"isSemVerMajor": false
}
},
"loader-utils": {
"name": "loader-utils",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1094088,
"name": "loader-utils",
"dependency": "loader-utils",
"title": "Prototype pollution in webpack loader-utils",
"url": "https://github.com/advisories/GHSA-76p3-8jx3-jpfq",
"severity": "critical",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 9.8,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"range": "<1.4.1"
},
{
"source": 1094089,
"name": "loader-utils",
"dependency": "loader-utils",
"title": "Prototype pollution in webpack loader-utils",
"url": "https://github.com/advisories/GHSA-76p3-8jx3-jpfq",
"severity": "critical",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 9.8,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"range": ">=2.0.0 <2.0.3"
},
{
"source": 1095054,
"name": "loader-utils",
"dependency": "loader-utils",
"title": "loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS) via url variable",
"url": "https://github.com/advisories/GHSA-3rfm-jhwj-7488",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=2.0.0 <2.0.4"
},
{
"source": 1095055,
"name": "loader-utils",
"dependency": "loader-utils",
"title": "loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS) via url variable",
"url": "https://github.com/advisories/GHSA-3rfm-jhwj-7488",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=1.0.0 <1.4.2"
},
{
"source": 1097142,
"name": "loader-utils",
"dependency": "loader-utils",
"title": "loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS)",
"url": "https://github.com/advisories/GHSA-hhq3-ff78-jv3g",
"severity": "high",
"cwe": [
"CWE-400",
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=2.0.0 <2.0.4"
},
{
"source": 1097143,
"name": "loader-utils",
"dependency": "loader-utils",
"title": "loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS)",
"url": "https://github.com/advisories/GHSA-hhq3-ff78-jv3g",
"severity": "high",
"cwe": [
"CWE-400",
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=1.0.0 <1.4.2"
}
],
"effects": [
"react-dev-utils",
"webpack-cli"
],
"range": "<=1.4.1 || 2.0.0 - 2.0.3",
"nodes": [
"node_modules/file-loader/node_modules/loader-utils",
"node_modules/html-loader/node_modules/loader-utils",
"node_modules/loader-utils",
"node_modules/postcss-loader/node_modules/loader-utils",
"node_modules/raw-loader/node_modules/loader-utils",
"node_modules/react-dev-utils/node_modules/loader-utils",
"node_modules/style-loader/node_modules/loader-utils",
"node_modules/url-loader/node_modules/loader-utils",
"node_modules/webpack-cli/node_modules/loader-utils"
],
"fixAvailable": {
"name": "webpack-cli",
"version": "3.3.12",
"isSemVerMajor": false
}
},
"markdown-it": {
"name": "markdown-it",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1092663,
"name": "markdown-it",
"dependency": "markdown-it",
"title": "Uncontrolled Resource Consumption in markdown-it",
"url": "https://github.com/advisories/GHSA-6vfc-qv3f-vr6c",
"severity": "moderate",
"cwe": [
"CWE-400",
"CWE-1333"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": "<12.3.2"
}
],
"effects": [
"jsdoc"
],
"range": "<12.3.2",
"nodes": [
"node_modules/markdown-it"
],
"fixAvailable": {
"name": "jsdoc",
"version": "3.6.11",
"isSemVerMajor": false
}
},
"markdown-to-jsx": {
"name": "markdown-to-jsx",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1100074,
"name": "markdown-to-jsx",
"dependency": "markdown-to-jsx",
"title": "Cross site scripting in markdown-to-jsx",
"url": "https://github.com/advisories/GHSA-4wx3-54gh-9fr9",
"severity": "moderate",
"cwe": [
"CWE-79"
],
"cvss": {
"score": 6.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
"range": "<7.4.0"
}
],
"effects": [
"@storybook/ui"
],
"range": "<7.4.0",
"nodes": [
"node_modules/@storybook/ui/node_modules/markdown-to-jsx",
"node_modules/markdown-to-jsx"
],
"fixAvailable": true
},
"marked": {
"name": "marked",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1095051,
"name": "marked",
"dependency": "marked",
"title": "Inefficient Regular Expression Complexity in marked",
"url": "https://github.com/advisories/GHSA-rrrm-qjm4-v8hf",
"severity": "high",
"cwe": [
"CWE-400",
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<4.0.10"
},
{
"source": 1095052,
"name": "marked",
"dependency": "marked",
"title": "Inefficient Regular Expression Complexity in marked",
"url": "https://github.com/advisories/GHSA-5v2h-r2cx-5xgj",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<4.0.10"
}
],
"effects": [
"jsdoc"
],
"range": "<=4.0.9",
"nodes": [
"node_modules/marked"
],
"fixAvailable": {
"name": "jsdoc",
"version": "3.6.11",
"isSemVerMajor": false
}
},
"micromatch": {
"name": "micromatch",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1098681,
"name": "micromatch",
"dependency": "micromatch",
"title": "Regular Expression Denial of Service (ReDoS) in micromatch",
"url": "https://github.com/advisories/GHSA-952p-6rrq-rcjv",
"severity": "moderate",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": "<4.0.8"
},
"braces"
],
"effects": [
"anymatch",
"fast-glob",
"findup-sync",
"fork-ts-checker-webpack-plugin",
"readdirp",
"sane",
"webpack"
],
"range": "<=4.0.7",
"nodes": [
"node_modules/@storybook/builder-webpack4/node_modules/micromatch",
"node_modules/fast-glob/node_modules/micromatch",
"node_modules/findup-sync/node_modules/micromatch",
"node_modules/micromatch",
"node_modules/react-dev-utils/node_modules/fast-glob/node_modules/micromatch",
"node_modules/react-dev-utils/node_modules/micromatch",
"node_modules/sane/node_modules/micromatch",
"node_modules/watchpack-chokidar2/node_modules/micromatch",
"node_modules/webpack-cli/node_modules/micromatch",
"node_modules/webpack/node_modules/micromatch"
],
"fixAvailable": {
"name": "webpack",
"version": "5.102.0",
"isSemVerMajor": true
}
},
"min-document": {
"name": "min-document",
"severity": "low",
"isDirect": false,
"via": [
{
"source": 1108264,
"name": "min-document",
"dependency": "min-document",
"title": "min-document vulnerable to prototype pollution",
"url": "https://github.com/advisories/GHSA-rx8g-88g5-qh64",
"severity": "low",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<=2.19.0"
}
],
"effects": [
"global"
],
"range": "*",
"nodes": [
"node_modules/min-document"
],
"fixAvailable": {
"name": "@storybook/addon-actions",
"version": "9.0.8",
"isSemVerMajor": true
}
},
"minimatch": {
"name": "minimatch",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1096485,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch ReDoS vulnerability",
"url": "https://github.com/advisories/GHSA-f8q6-p94x-37v3",
"severity": "high",
"cwe": [
"CWE-400",
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<3.0.5"
}
],
"effects": [
"recursive-readdir"
],
"range": "<3.0.5",
"nodes": [
"node_modules/minimatch"
],
"fixAvailable": true
},
"minimist": {
"name": "minimist",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1097678,
"name": "minimist",
"dependency": "minimist",
"title": "Prototype Pollution in minimist",
"url": "https://github.com/advisories/GHSA-xvch-5gv4-984h",
"severity": "critical",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 9.8,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"range": ">=1.0.0 <1.2.6"
}
],
"effects": [],
"range": "1.0.0 - 1.2.5",
"nodes": [
"node_modules/minimist"
],
"fixAvailable": true
},
"nanoid": {
"name": "nanoid",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1089011,
"name": "nanoid",
"dependency": "nanoid",
"title": "Exposure of Sensitive Information to an Unauthorized Actor in nanoid",
"url": "https://github.com/advisories/GHSA-qrpm-p2h7-hrv2",
"severity": "moderate",
"cwe": [
"CWE-200"
],
"cvss": {
"score": 5.5,
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
},
"range": ">=3.0.0 <3.1.31"
},
{
"source": 1101163,
"name": "nanoid",
"dependency": "nanoid",
"title": "Predictable results in nanoid generation when given non-integer values",
"url": "https://github.com/advisories/GHSA-mwcw-c2x4-8c55",
"severity": "moderate",
"cwe": [
"CWE-835"
],
"cvss": {
"score": 4.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
},
"range": "<3.3.8"
}
],
"effects": [],
"range": "<=3.3.7",
"nodes": [
"node_modules/doiuse/node_modules/nanoid",
"node_modules/stylelint-no-unsupported-browser-features/node_modules/nanoid"
],
"fixAvailable": true
},
"node-fetch": {
"name": "node-fetch",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1095073,
"name": "node-fetch",
"dependency": "node-fetch",
"title": "node-fetch forwards secure headers to untrusted sites",
"url": "https://github.com/advisories/GHSA-r683-j2x4-v87g",
"severity": "high",
"cwe": [
"CWE-173",
"CWE-200",
"CWE-601"
],
"cvss": {
"score": 8.8,
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
},
"range": "<2.6.7"
}
],
"effects": [],
"range": "<2.6.7",
"nodes": [
"node_modules/node-fetch"
],
"fixAvailable": true
},
"path-to-regexp": {
"name": "path-to-regexp",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1101849,
"name": "path-to-regexp",
"dependency": "path-to-regexp",
"title": "path-to-regexp outputs backtracking regular expressions",
"url": "https://github.com/advisories/GHSA-9wv6-86v2-598j",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=0.2.0 <1.9.0"
},
{
"source": 1101850,
"name": "path-to-regexp",
"dependency": "path-to-regexp",
"title": "path-to-regexp outputs backtracking regular expressions",
"url": "https://github.com/advisories/GHSA-9wv6-86v2-598j",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<0.1.10"
},
{
"source": 1105199,
"name": "path-to-regexp",
"dependency": "path-to-regexp",
"title": "path-to-regexp contains a ReDoS",
"url": "https://github.com/advisories/GHSA-rhx6-c78j-4q9w",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<0.1.12"
}
],
"effects": [
"express"
],
"range": "<=0.1.11 || 0.2.0 - 1.8.0",
"nodes": [
"node_modules/nise/node_modules/path-to-regexp",
"node_modules/path-to-regexp"
],
"fixAvailable": true
},
"pbkdf2": {
"name": "pbkdf2",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1105691,
"name": "pbkdf2",
"dependency": "pbkdf2",
"title": "pbkdf2 silently disregards Uint8Array input, returning static keys",
"url": "https://github.com/advisories/GHSA-v62p-rq8g-8h59",
"severity": "critical",
"cwe": [
"CWE-20"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<=3.1.2"
},
{
"source": 1105692,
"name": "pbkdf2",
"dependency": "pbkdf2",
"title": "pbkdf2 returns predictable uninitialized/zero-filled memory for non-normalized or unimplemented algos",
"url": "https://github.com/advisories/GHSA-h7cp-r72f-jxh6",
"severity": "critical",
"cwe": [
"CWE-20"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=3.0.10 <=3.1.2"
}
],
"effects": [],
"range": "<=3.1.2",
"nodes": [
"node_modules/pbkdf2"
],
"fixAvailable": true
},
"postcss": {
"name": "postcss",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1094544,
"name": "postcss",
"dependency": "postcss",
"title": "PostCSS line return parsing error",
"url": "https://github.com/advisories/GHSA-7fh5-64p2-3v2j",
"severity": "moderate",
"cwe": [
"CWE-74",
"CWE-144"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
"range": "<8.4.31"
}
],
"effects": [
"@storybook/builder-webpack4",
"autoprefixer",
"css-loader",
"icss-utils",
"postcss-flexbugs-fixes",
"postcss-less",
"postcss-modules-extract-imports",
"postcss-modules-local-by-default",
"postcss-modules-scope",
"postcss-modules-values",
"postcss-safe-parser",
"postcss-sass",
"postcss-scss",
"stylelint",
"sugarss"
],
"range": "<8.4.31",
"nodes": [
"node_modules/doiuse/node_modules/postcss",
"node_modules/postcss",
"node_modules/stylelint-no-unsupported-browser-features/node_modules/postcss"
],
"fixAvailable": {
"name": "stylelint-config-wikimedia",
"version": "0.18.0",
"isSemVerMajor": true
}
},
"postcss-flexbugs-fixes": {
"name": "postcss-flexbugs-fixes",
"severity": "moderate",
"isDirect": false,
"via": [
"postcss"
],
"effects": [],
"range": "<=4.2.1",
"nodes": [
"node_modules/postcss-flexbugs-fixes"
],
"fixAvailable": true
},
"postcss-less": {
"name": "postcss-less",
"severity": "moderate",
"isDirect": false,
"via": [
"postcss"
],
"effects": [
"stylelint"
],
"range": "<=3.1.4",
"nodes": [
"node_modules/postcss-less"
],
"fixAvailable": {
"name": "stylelint-config-wikimedia",
"version": "0.18.0",
"isSemVerMajor": true
}
},
"postcss-modules-extract-imports": {
"name": "postcss-modules-extract-imports",
"severity": "moderate",
"isDirect": false,
"via": [
"postcss"
],
"effects": [],
"range": "<=2.0.0",
"nodes": [
"node_modules/postcss-modules-extract-imports"
],
"fixAvailable": true
},
"postcss-modules-local-by-default": {
"name": "postcss-modules-local-by-default",
"severity": "moderate",
"isDirect": false,
"via": [
"icss-utils",
"postcss"
],
"effects": [],
"range": "<=4.0.0-rc.4",
"nodes": [
"node_modules/postcss-modules-local-by-default"
],
"fixAvailable": true
},
"postcss-modules-scope": {
"name": "postcss-modules-scope",
"severity": "moderate",
"isDirect": false,
"via": [
"postcss"
],
"effects": [],
"range": "<=2.2.0",
"nodes": [
"node_modules/postcss-modules-scope"
],
"fixAvailable": true
},
"postcss-modules-values": {
"name": "postcss-modules-values",
"severity": "moderate",
"isDirect": false,
"via": [
"icss-utils",
"postcss"
],
"effects": [
"css-loader"
],
"range": "<=4.0.0-rc.5",
"nodes": [
"node_modules/postcss-modules-values"
],
"fixAvailable": true
},
"postcss-safe-parser": {
"name": "postcss-safe-parser",
"severity": "moderate",
"isDirect": false,
"via": [
"postcss"
],
"effects": [
"stylelint"
],
"range": "<=4.0.2",
"nodes": [
"node_modules/postcss-safe-parser"
],
"fixAvailable": {
"name": "stylelint-config-wikimedia",
"version": "0.18.0",
"isSemVerMajor": true
}
},
"postcss-sass": {
"name": "postcss-sass",
"severity": "moderate",
"isDirect": false,
"via": [
"postcss"
],
"effects": [
"stylelint"
],
"range": "<=0.4.4",
"nodes": [
"node_modules/postcss-sass"
],
"fixAvailable": {
"name": "stylelint-config-wikimedia",
"version": "0.18.0",
"isSemVerMajor": true
}
},
"postcss-scss": {
"name": "postcss-scss",
"severity": "moderate",
"isDirect": false,
"via": [
"postcss"
],
"effects": [
"stylelint"
],
"range": "<=2.1.1",
"nodes": [
"node_modules/postcss-scss"
],
"fixAvailable": {
"name": "stylelint-config-wikimedia",
"version": "0.18.0",
"isSemVerMajor": true
}
},
"pre-commit": {
"name": "pre-commit",
"severity": "high",
"isDirect": true,
"via": [
"cross-spawn"
],
"effects": [],
"range": ">=1.1.0",
"nodes": [
"node_modules/pre-commit"
],
"fixAvailable": {
"name": "pre-commit",
"version": "1.0.10",
"isSemVerMajor": true
}
},
"prismjs": {
"name": "prismjs",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1090424,
"name": "prismjs",
"dependency": "prismjs",
"title": "Cross-site Scripting in Prism",
"url": "https://github.com/advisories/GHSA-3949-f494-cm99",
"severity": "high",
"cwe": [
"CWE-79"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:L"
},
"range": ">=1.14.0 <1.27.0"
},
{
"source": 1105770,
"name": "prismjs",
"dependency": "prismjs",
"title": "PrismJS DOM Clobbering vulnerability",
"url": "https://github.com/advisories/GHSA-x7hr-w5r2-h6wg",
"severity": "moderate",
"cwe": [
"CWE-79",
"CWE-94"
],
"cvss": {
"score": 4.9,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N"
},
"range": "<1.30.0"
}
],
"effects": [
"refractor"
],
"range": "<=1.29.0",
"nodes": [
"node_modules/prismjs"
],
"fixAvailable": {
"name": "@storybook/addon-actions",
"version": "9.0.8",
"isSemVerMajor": true
}
},
"qs": {
"name": "qs",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1104118,
"name": "qs",
"dependency": "qs",
"title": "qs vulnerable to Prototype Pollution",
"url": "https://github.com/advisories/GHSA-hrpp-h998-j3pp",
"severity": "high",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=6.5.0 <6.5.3"
},
{
"source": 1104120,
"name": "qs",
"dependency": "qs",
"title": "qs vulnerable to Prototype Pollution",
"url": "https://github.com/advisories/GHSA-hrpp-h998-j3pp",
"severity": "high",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=6.7.0 <6.7.3"
},
{
"source": 1104123,
"name": "qs",
"dependency": "qs",
"title": "qs vulnerable to Prototype Pollution",
"url": "https://github.com/advisories/GHSA-hrpp-h998-j3pp",
"severity": "high",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=6.10.0 <6.10.3"
}
],
"effects": [
"body-parser",
"express"
],
"range": "6.5.0 - 6.5.2 || 6.7.0 - 6.7.2 || 6.10.0 - 6.10.2",
"nodes": [
"node_modules/body-parser/node_modules/qs",
"node_modules/express/node_modules/qs",
"node_modules/qs",
"node_modules/request/node_modules/qs"
],
"fixAvailable": true
},
"qunit": {
"name": "qunit",
"severity": "moderate",
"isDirect": false,
"via": [
"findup-sync",
"sane"
],
"effects": [
"@wikimedia/mw-node-qunit"
],
"range": "2.4.1 - 2.8.0",
"nodes": [
"node_modules/@wikimedia/mw-node-qunit/node_modules/qunit"
],
"fixAvailable": {
"name": "@wikimedia/mw-node-qunit",
"version": "6.4.2",
"isSemVerMajor": false
}
},
"react-dev-utils": {
"name": "react-dev-utils",
"severity": "critical",
"isDirect": false,
"via": [
"browserslist",
"cross-spawn",
"fork-ts-checker-webpack-plugin",
"immer",
"loader-utils",
"recursive-readdir",
"shell-quote"
],
"effects": [
"@storybook/builder-webpack4"
],
"range": "0.5.2 - 12.0.0-next.60",
"nodes": [
"node_modules/react-dev-utils"
],
"fixAvailable": true
},
"react-syntax-highlighter": {
"name": "react-syntax-highlighter",
"severity": "moderate",
"isDirect": false,
"via": [
"refractor"
],
"effects": [
"@storybook/components"
],
"range": ">=6.0.0",
"nodes": [
"node_modules/react-syntax-highlighter"
],
"fixAvailable": {
"name": "@storybook/addon-actions",
"version": "9.0.8",
"isSemVerMajor": true
}
},
"readdirp": {
"name": "readdirp",
"severity": "moderate",
"isDirect": false,
"via": [
"micromatch"
],
"effects": [
"chokidar"
],
"range": "2.2.0 - 2.2.1",
"nodes": [
"node_modules/watchpack-chokidar2/node_modules/readdirp"
],
"fixAvailable": true
},
"recursive-readdir": {
"name": "recursive-readdir",
"severity": "high",
"isDirect": false,
"via": [
"minimatch"
],
"effects": [
"react-dev-utils"
],
"range": "1.2.0 - 2.2.2",
"nodes": [
"node_modules/recursive-readdir"
],
"fixAvailable": true
},
"refractor": {
"name": "refractor",
"severity": "moderate",
"isDirect": false,
"via": [
"prismjs"
],
"effects": [
"react-syntax-highlighter"
],
"range": "<=4.6.0",
"nodes": [
"node_modules/refractor"
],
"fixAvailable": {
"name": "@storybook/addon-actions",
"version": "9.0.8",
"isSemVerMajor": true
}
},
"request": {
"name": "request",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1096727,
"name": "request",
"dependency": "request",
"title": "Server-Side Request Forgery in Request",
"url": "https://github.com/advisories/GHSA-p8p7-x288-28g6",
"severity": "moderate",
"cwe": [
"CWE-918"
],
"cvss": {
"score": 6.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
"range": "<=2.88.2"
},
"form-data",
"tough-cookie"
],
"effects": [
"jsdom",
"less",
"request-promise-core",
"request-promise-native"
],
"range": "*",
"nodes": [
"node_modules/request"
],
"fixAvailable": {
"name": "jsdom",
"version": "27.0.0",
"isSemVerMajor": true
}
},
"request-promise-core": {
"name": "request-promise-core",
"severity": "moderate",
"isDirect": false,
"via": [
"request"
],
"effects": [
"request-promise-native"
],
"range": "*",
"nodes": [
"node_modules/request-promise-core"
],
"fixAvailable": {
"name": "jsdom",
"version": "27.0.0",
"isSemVerMajor": true
}
},
"request-promise-native": {
"name": "request-promise-native",
"severity": "moderate",
"isDirect": false,
"via": [
"request",
"request-promise-core",
"tough-cookie"
],
"effects": [
"jsdom"
],
"range": ">=1.0.0",
"nodes": [
"node_modules/request-promise-native"
],
"fixAvailable": {
"name": "jsdom",
"version": "27.0.0",
"isSemVerMajor": true
}
},
"sane": {
"name": "sane",
"severity": "moderate",
"isDirect": false,
"via": [
"anymatch",
"micromatch"
],
"effects": [
"qunit"
],
"range": "1.5.0 - 4.1.0",
"nodes": [
"node_modules/sane"
],
"fixAvailable": {
"name": "@wikimedia/mw-node-qunit",
"version": "6.4.2",
"isSemVerMajor": false
}
},
"semver": {
"name": "semver",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1101088,
"name": "semver",
"dependency": "semver",
"title": "semver vulnerable to Regular Expression Denial of Service",
"url": "https://github.com/advisories/GHSA-c2qf-rxjj-qqgw",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=7.0.0 <7.5.2"
},
{
"source": 1101089,
"name": "semver",
"dependency": "semver",
"title": "semver vulnerable to Regular Expression Denial of Service",
"url": "https://github.com/advisories/GHSA-c2qf-rxjj-qqgw",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<5.7.2"
},
{
"source": 1101090,
"name": "semver",
"dependency": "semver",
"title": "semver vulnerable to Regular Expression Denial of Service",
"url": "https://github.com/advisories/GHSA-c2qf-rxjj-qqgw",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=6.0.0 <6.3.1"
}
],
"effects": [
"core-js-compat",
"eslint-plugin-compat"
],
"range": "<=5.7.1 || 6.0.0 - 6.3.0 || 7.0.0 - 7.5.1",
"nodes": [
"node_modules/@babel/helper-compilation-targets/node_modules/semver",
"node_modules/@npmcli/fs/node_modules/semver",
"node_modules/@storybook/builder-webpack4/node_modules/@babel/core/node_modules/semver",
"node_modules/@storybook/builder-webpack4/node_modules/@babel/helper-define-polyfill-provider/node_modules/semver",
"node_modules/@storybook/builder-webpack4/node_modules/@babel/preset-env/node_modules/semver",
"node_modules/@storybook/core-common/node_modules/@babel/register/node_modules/semver",
"node_modules/@storybook/core-common/node_modules/find-cache-dir/node_modules/semver",
"node_modules/@storybook/core-common/node_modules/semver",
"node_modules/@storybook/core-server/node_modules/semver",
"node_modules/@stylelint/postcss-css-in-js/node_modules/semver",
"node_modules/@wikimedia/mw-node-qunit/node_modules/semver",
"node_modules/babel-plugin-polyfill-corejs2/node_modules/semver",
"node_modules/babel-plugin-polyfill-corejs3/node_modules/semver",
"node_modules/babel-plugin-polyfill-regenerator/node_modules/semver",
"node_modules/core-js-compat/node_modules/semver",
"node_modules/css-loader/node_modules/semver",
"node_modules/eslint-plugin-compat/node_modules/semver",
"node_modules/eslint-plugin-jsdoc/node_modules/semver",
"node_modules/eslint-plugin-mediawiki/node_modules/semver",
"node_modules/eslint-plugin-node/node_modules/semver",
"node_modules/eslint-plugin-unicorn/node_modules/semver",
"node_modules/eslint-plugin-vue/node_modules/semver",
"node_modules/eslint-template-visitor/node_modules/semver",
"node_modules/eslint/node_modules/semver",
"node_modules/fork-ts-checker-webpack-plugin/node_modules/semver",
"node_modules/istanbul-lib-instrument/node_modules/semver",
"node_modules/make-dir/node_modules/semver",
"node_modules/meow/node_modules/semver",
"node_modules/nyc/node_modules/semver",
"node_modules/postcss-loader/node_modules/semver",
"node_modules/semver",
"node_modules/vue-eslint-parser/node_modules/semver"
],
"fixAvailable": {
"name": "eslint-config-wikimedia",
"version": "0.31.0",
"isSemVerMajor": true
}
},
"send": {
"name": "send",
"severity": "low",
"isDirect": false,
"via": [
{
"source": 1100526,
"name": "send",
"dependency": "send",
"title": "send vulnerable to template injection that can lead to XSS",
"url": "https://github.com/advisories/GHSA-m6fv-jmcg-4jfg",
"severity": "low",
"cwe": [
"CWE-79"
],
"cvss": {
"score": 5,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L"
},
"range": "<0.19.0"
}
],
"effects": [
"express",
"serve-static"
],
"range": "<0.19.0",
"nodes": [
"node_modules/send"
],
"fixAvailable": true
},
"serve-static": {
"name": "serve-static",
"severity": "low",
"isDirect": false,
"via": [
{
"source": 1100528,
"name": "serve-static",
"dependency": "serve-static",
"title": "serve-static vulnerable to template injection that can lead to XSS",
"url": "https://github.com/advisories/GHSA-cm22-4g7w-348p",
"severity": "low",
"cwe": [
"CWE-79"
],
"cvss": {
"score": 5,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L"
},
"range": "<1.16.0"
},
"send"
],
"effects": [],
"range": "<=1.16.0",
"nodes": [
"node_modules/serve-static"
],
"fixAvailable": true
},
"sha.js": {
"name": "sha.js",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1107537,
"name": "sha.js",
"dependency": "sha.js",
"title": "sha.js is missing type checks leading to hash rewind and passing on crafted data",
"url": "https://github.com/advisories/GHSA-95m3-7q98-8xr5",
"severity": "critical",
"cwe": [
"CWE-20"
],
"cvss": {
"score": 9.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
},
"range": "<=2.4.11"
}
],
"effects": [],
"range": "<=2.4.11",
"nodes": [
"node_modules/sha.js"
],
"fixAvailable": true
},
"shell-quote": {
"name": "shell-quote",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1107366,
"name": "shell-quote",
"dependency": "shell-quote",
"title": "Improper Neutralization of Special Elements used in a Command in Shell-quote",
"url": "https://github.com/advisories/GHSA-g4rg-993r-mgx7",
"severity": "critical",
"cwe": [
"CWE-77"
],
"cvss": {
"score": 9.8,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"range": ">=1.6.3 <=1.7.2"
}
],
"effects": [
"react-dev-utils"
],
"range": "1.6.3 - 1.7.2",
"nodes": [
"node_modules/shell-quote"
],
"fixAvailable": true
},
"simple-get": {
"name": "simple-get",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1090445,
"name": "simple-get",
"dependency": "simple-get",
"title": "Exposure of Sensitive Information in simple-get",
"url": "https://github.com/advisories/GHSA-wpg7-2c88-r8xv",
"severity": "high",
"cwe": [
"CWE-200"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
"range": ">=3.0.0 <3.1.1"
}
],
"effects": [],
"range": "3.0.0 - 3.1.0",
"nodes": [
"node_modules/simple-get"
],
"fixAvailable": true
},
"store2": {
"name": "store2",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1101527,
"name": "store2",
"dependency": "store2",
"title": "Cross Site Scripting vulnerability in store2",
"url": "https://github.com/advisories/GHSA-w5hq-hm5m-4548",
"severity": "moderate",
"cwe": [
"CWE-79"
],
"cvss": {
"score": 6.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
"range": "<2.14.4"
}
],
"effects": [],
"range": "<2.14.4",
"nodes": [
"node_modules/store2"
],
"fixAvailable": true
},
"stylelint": {
"name": "stylelint",
"severity": "moderate",
"isDirect": false,
"via": [
"autoprefixer",
"postcss",
"postcss-less",
"postcss-safe-parser",
"postcss-sass",
"postcss-scss",
"sugarss"
],
"effects": [
"stylelint-config-wikimedia"
],
"range": "0.1.0 - 13.13.1",
"nodes": [
"node_modules/stylelint"
],
"fixAvailable": {
"name": "stylelint-config-wikimedia",
"version": "0.18.0",
"isSemVerMajor": true
}
},
"stylelint-config-wikimedia": {
"name": "stylelint-config-wikimedia",
"severity": "moderate",
"isDirect": true,
"via": [
"stylelint"
],
"effects": [],
"range": "<=0.11.1",
"nodes": [
"node_modules/stylelint-config-wikimedia"
],
"fixAvailable": {
"name": "stylelint-config-wikimedia",
"version": "0.18.0",
"isSemVerMajor": true
}
},
"sugarss": {
"name": "sugarss",
"severity": "moderate",
"isDirect": false,
"via": [
"postcss"
],
"effects": [],
"range": "<=2.0.0",
"nodes": [
"node_modules/sugarss"
],
"fixAvailable": true
},
"taffydb": {
"name": "taffydb",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1089386,
"name": "taffydb",
"dependency": "taffydb",
"title": "TaffyDB can allow access to any data items in the DB",
"url": "https://github.com/advisories/GHSA-mxhp-79qh-mcx6",
"severity": "high",
"cwe": [
"CWE-20",
"CWE-668"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
"range": "<=2.7.3"
}
],
"effects": [
"jsdoc"
],
"range": "*",
"nodes": [
"node_modules/taffydb"
],
"fixAvailable": {
"name": "jsdoc",
"version": "3.6.11",
"isSemVerMajor": false
}
},
"tar": {
"name": "tar",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1097493,
"name": "tar",
"dependency": "tar",
"title": "Denial of service while parsing a tar file due to lack of folders count validation",
"url": "https://github.com/advisories/GHSA-f5x3-32g6-xq36",
"severity": "moderate",
"cwe": [
"CWE-400"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
"range": "<6.2.1"
}
],
"effects": [],
"range": "<6.2.1",
"nodes": [
"node_modules/tar"
],
"fixAvailable": true
},
"tar-fs": {
"name": "tar-fs",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1106930,
"name": "tar-fs",
"dependency": "tar-fs",
"title": "tar-fs can extract outside the specified dir with a specific tarball",
"url": "https://github.com/advisories/GHSA-8cj5-5rvv-wf4v",
"severity": "high",
"cwe": [
"CWE-22"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=2.0.0 <2.1.3"
},
{
"source": 1108293,
"name": "tar-fs",
"dependency": "tar-fs",
"title": "tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball",
"url": "https://github.com/advisories/GHSA-vj76-c3g6-qr5v",
"severity": "high",
"cwe": [
"CWE-22",
"CWE-61"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=2.0.0 <2.1.4"
},
{
"source": 1108411,
"name": "tar-fs",
"dependency": "tar-fs",
"title": "tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File",
"url": "https://github.com/advisories/GHSA-pq67-2wwv-3xjx",
"severity": "high",
"cwe": [
"CWE-22"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
},
"range": ">=2.0.0 <2.1.2"
}
],
"effects": [],
"range": "2.0.0 - 2.1.3",
"nodes": [
"node_modules/tar-fs"
],
"fixAvailable": true
},
"telejson": {
"name": "telejson",
"severity": "low",
"isDirect": false,
"via": [
"global"
],
"effects": [
"@storybook/channel-postmessage",
"@storybook/core-server"
],
"range": "<=6.0.8",
"nodes": [
"node_modules/telejson"
],
"fixAvailable": {
"name": "@storybook/addon-actions",
"version": "9.0.8",
"isSemVerMajor": true
}
},
"terser": {
"name": "terser",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1091691,
"name": "terser",
"dependency": "terser",
"title": "Terser insecure use of regular expressions leads to ReDoS",
"url": "https://github.com/advisories/GHSA-4wf5-vphf-c2xc",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<4.8.1"
}
],
"effects": [],
"range": "<4.8.1",
"nodes": [
"node_modules/terser"
],
"fixAvailable": true
},
"terser-webpack-plugin": {
"name": "terser-webpack-plugin",
"severity": "moderate",
"isDirect": false,
"via": [
"webpack"
],
"effects": [
"webpack"
],
"range": "<=2.2.1",
"nodes": [
"node_modules/webpack/node_modules/terser-webpack-plugin"
],
"fixAvailable": {
"name": "webpack",
"version": "5.102.0",
"isSemVerMajor": true
}
},
"tmp": {
"name": "tmp",
"severity": "low",
"isDirect": false,
"via": [
{
"source": 1106849,
"name": "tmp",
"dependency": "tmp",
"title": "tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter",
"url": "https://github.com/advisories/GHSA-52f5-9888-hmc6",
"severity": "low",
"cwe": [
"CWE-59"
],
"cvss": {
"score": 2.5,
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"
},
"range": "<=0.2.3"
}
],
"effects": [
"external-editor"
],
"range": "<=0.2.3",
"nodes": [
"node_modules/external-editor/node_modules/tmp"
],
"fixAvailable": {
"name": "eslint-config-wikimedia",
"version": "0.31.0",
"isSemVerMajor": true
}
},
"tough-cookie": {
"name": "tough-cookie",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1097682,
"name": "tough-cookie",
"dependency": "tough-cookie",
"title": "tough-cookie Prototype Pollution vulnerability",
"url": "https://github.com/advisories/GHSA-72xf-g2v4-qvf3",
"severity": "moderate",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
},
"range": "<4.1.3"
}
],
"effects": [
"jsdom",
"request",
"request-promise-native"
],
"range": "<4.1.3",
"nodes": [
"node_modules/tough-cookie"
],
"fixAvailable": {
"name": "jsdom",
"version": "27.0.0",
"isSemVerMajor": true
}
},
"watchpack": {
"name": "watchpack",
"severity": "high",
"isDirect": false,
"via": [
"watchpack-chokidar2"
],
"effects": [],
"range": "1.7.2 - 1.7.5",
"nodes": [
"node_modules/watchpack"
],
"fixAvailable": true
},
"watchpack-chokidar2": {
"name": "watchpack-chokidar2",
"severity": "high",
"isDirect": false,
"via": [
"chokidar"
],
"effects": [
"watchpack"
],
"range": "*",
"nodes": [
"node_modules/watchpack-chokidar2"
],
"fixAvailable": true
},
"webpack": {
"name": "webpack",
"severity": "moderate",
"isDirect": true,
"via": [
"micromatch",
"terser-webpack-plugin"
],
"effects": [
"@storybook/core-common",
"@storybook/core-server",
"terser-webpack-plugin",
"webpack-cli"
],
"range": "4.0.0-alpha.0 - 5.0.0-rc.6",
"nodes": [
"node_modules/webpack"
],
"fixAvailable": {
"name": "webpack",
"version": "5.102.0",
"isSemVerMajor": true
}
},
"webpack-cli": {
"name": "webpack-cli",
"severity": "high",
"isDirect": true,
"via": [
"cross-spawn",
"findup-sync",
"loader-utils",
"webpack"
],
"effects": [],
"range": "<=0.0.8-development || 1.3.0 - 2.0.9 || 2.0.11 - 4.0.0-rc.1",
"nodes": [
"node_modules/webpack-cli"
],
"fixAvailable": {
"name": "webpack-cli",
"version": "3.3.12",
"isSemVerMajor": false
}
},
"webpack-dev-middleware": {
"name": "webpack-dev-middleware",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1096729,
"name": "webpack-dev-middleware",
"dependency": "webpack-dev-middleware",
"title": "Path traversal in webpack-dev-middleware",
"url": "https://github.com/advisories/GHSA-wr3j-pwj9-hqq6",
"severity": "high",
"cwe": [
"CWE-22"
],
"cvss": {
"score": 7.4,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N"
},
"range": "<=5.3.3"
}
],
"effects": [
"@storybook/core-server"
],
"range": "<=5.3.3",
"nodes": [
"node_modules/webpack-dev-middleware"
],
"fixAvailable": true
},
"word-wrap": {
"name": "word-wrap",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1102444,
"name": "word-wrap",
"dependency": "word-wrap",
"title": "word-wrap vulnerable to Regular Expression Denial of Service",
"url": "https://github.com/advisories/GHSA-j8xg-fqg3-53r7",
"severity": "moderate",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": "<1.2.4"
}
],
"effects": [],
"range": "<1.2.4",
"nodes": [
"node_modules/word-wrap"
],
"fixAvailable": true
},
"ws": {
"name": "ws",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1098394,
"name": "ws",
"dependency": "ws",
"title": "ws affected by a DoS when handling a request with many HTTP headers",
"url": "https://github.com/advisories/GHSA-3h5v-q93c-6h6q",
"severity": "high",
"cwe": [
"CWE-476"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=6.0.0 <6.2.3"
}
],
"effects": [],
"range": "6.0.0 - 6.2.2",
"nodes": [
"node_modules/ws"
],
"fixAvailable": true
}
},
"metadata": {
"vulnerabilities": {
"info": 0,
"low": 19,
"moderate": 48,
"high": 41,
"critical": 14,
"total": 122
},
"dependencies": {
"prod": 2,
"dev": 2059,
"optional": 31,
"peer": 1,
"peerOptional": 0,
"total": 2060
}
}
}
--- end ---
$ /usr/bin/composer install
--- stderr ---
No composer.lock file present. Updating dependencies to latest instead of installing from lock file. See https://getcomposer.org/install for more information.
Loading composer repositories with package information
Updating dependencies
Lock file operations: 36 installs, 0 updates, 0 removals
- Locking composer/pcre (1.0.1)
- Locking composer/semver (3.4.4)
- Locking composer/spdx-licenses (1.5.9)
- Locking composer/xdebug-handler (2.0.5)
- Locking doctrine/deprecations (1.1.5)
- Locking felixfbecker/advanced-json-rpc (v3.2.1)
- Locking mediawiki/mediawiki-codesniffer (v38.0.0)
- Locking mediawiki/mediawiki-phan-config (0.11.1)
- Locking mediawiki/minus-x (1.1.1)
- Locking mediawiki/phan-taint-check-plugin (3.3.2)
- Locking microsoft/tolerant-php-parser (v0.1.2)
- Locking netresearch/jsonmapper (v4.5.0)
- Locking phan/phan (5.2.0)
- Locking php-parallel-lint/php-console-color (v0.3)
- Locking php-parallel-lint/php-console-highlighter (v0.5)
- Locking php-parallel-lint/php-parallel-lint (v1.3.1)
- Locking phpdocumentor/reflection-common (2.2.0)
- Locking phpdocumentor/reflection-docblock (5.6.3)
- Locking phpdocumentor/type-resolver (1.10.0)
- Locking phpstan/phpdoc-parser (2.3.0)
- Locking psr/container (2.0.2)
- Locking psr/log (2.0.0)
- Locking sabre/event (5.1.7)
- Locking squizlabs/php_codesniffer (3.6.1)
- Locking symfony/console (v5.4.47)
- Locking symfony/deprecation-contracts (v3.6.0)
- Locking symfony/polyfill-ctype (v1.33.0)
- Locking symfony/polyfill-intl-grapheme (v1.33.0)
- Locking symfony/polyfill-intl-normalizer (v1.33.0)
- Locking symfony/polyfill-mbstring (v1.33.0)
- Locking symfony/polyfill-php73 (v1.33.0)
- Locking symfony/polyfill-php80 (v1.33.0)
- Locking symfony/service-contracts (v3.6.0)
- Locking symfony/string (v6.4.26)
- Locking tysonandre/var_representation_polyfill (0.1.3)
- Locking webmozart/assert (1.11.0)
Writing lock file
Installing dependencies from lock file (including require-dev)
Package operations: 36 installs, 0 updates, 0 removals
0 [>---------------------------] 0 [->--------------------------]
- Installing composer/pcre (1.0.1): Extracting archive
- Installing squizlabs/php_codesniffer (3.6.1): Extracting archive
- Installing symfony/polyfill-mbstring (v1.33.0): Extracting archive
- Installing composer/spdx-licenses (1.5.9): Extracting archive
- Installing composer/semver (3.4.4): Extracting archive
- Installing mediawiki/mediawiki-codesniffer (v38.0.0): Extracting archive
- Installing tysonandre/var_representation_polyfill (0.1.3): Extracting archive
- Installing symfony/polyfill-php80 (v1.33.0): Extracting archive
- Installing symfony/polyfill-intl-normalizer (v1.33.0): Extracting archive
- Installing symfony/polyfill-intl-grapheme (v1.33.0): Extracting archive
- Installing symfony/polyfill-ctype (v1.33.0): Extracting archive
- Installing symfony/string (v6.4.26): Extracting archive
- Installing symfony/deprecation-contracts (v3.6.0): Extracting archive
- Installing psr/container (2.0.2): Extracting archive
- Installing symfony/service-contracts (v3.6.0): Extracting archive
- Installing symfony/polyfill-php73 (v1.33.0): Extracting archive
- Installing symfony/console (v5.4.47): Extracting archive
- Installing sabre/event (5.1.7): Extracting archive
- Installing netresearch/jsonmapper (v4.5.0): Extracting archive
- Installing microsoft/tolerant-php-parser (v0.1.2): Extracting archive
- Installing webmozart/assert (1.11.0): Extracting archive
- Installing phpstan/phpdoc-parser (2.3.0): Extracting archive
- Installing phpdocumentor/reflection-common (2.2.0): Extracting archive
- Installing doctrine/deprecations (1.1.5): Extracting archive
- Installing phpdocumentor/type-resolver (1.10.0): Extracting archive
- Installing phpdocumentor/reflection-docblock (5.6.3): Extracting archive
- Installing felixfbecker/advanced-json-rpc (v3.2.1): Extracting archive
- Installing psr/log (2.0.0): Extracting archive
- Installing composer/xdebug-handler (2.0.5): Extracting archive
- Installing phan/phan (5.2.0): Extracting archive
- Installing mediawiki/phan-taint-check-plugin (3.3.2): Extracting archive
- Installing mediawiki/mediawiki-phan-config (0.11.1): Extracting archive
- Installing mediawiki/minus-x (1.1.1): Extracting archive
- Installing php-parallel-lint/php-console-color (v0.3): Extracting archive
- Installing php-parallel-lint/php-console-highlighter (v0.5): Extracting archive
- Installing php-parallel-lint/php-parallel-lint (v1.3.1): Extracting archive
0/36 [>---------------------------] 0%
26/36 [====================>-------] 72%
36/36 [============================] 100%
3 package suggestions were added by new dependencies, use `composer suggest` to see details.
Generating autoload files
15 packages you are using are looking for funding.
Use the `composer fund` command to find out more!
--- stdout ---
--- end ---
$ /usr/bin/npm audit --json
--- stdout ---
{
"auditReportVersion": 2,
"vulnerabilities": {
"@babel/helpers": {
"name": "@babel/helpers",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1104001,
"name": "@babel/helpers",
"dependency": "@babel/helpers",
"title": "Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups",
"url": "https://github.com/advisories/GHSA-968p-4wvh-cqc8",
"severity": "moderate",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 6.2,
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<7.26.10"
}
],
"effects": [],
"range": "<7.26.10",
"nodes": [
"node_modules/@babel/helpers"
],
"fixAvailable": true
},
"@babel/runtime": {
"name": "@babel/runtime",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1104000,
"name": "@babel/runtime",
"dependency": "@babel/runtime",
"title": "Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups",
"url": "https://github.com/advisories/GHSA-968p-4wvh-cqc8",
"severity": "moderate",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 6.2,
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<7.26.10"
}
],
"effects": [],
"range": "<7.26.10",
"nodes": [
"node_modules/@babel/runtime"
],
"fixAvailable": true
},
"@babel/traverse": {
"name": "@babel/traverse",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1096886,
"name": "@babel/traverse",
"dependency": "@babel/traverse",
"title": "Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code",
"url": "https://github.com/advisories/GHSA-67hx-6x53-jw92",
"severity": "critical",
"cwe": [
"CWE-184",
"CWE-697"
],
"cvss": {
"score": 9.4,
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
},
"range": "<7.23.2"
}
],
"effects": [],
"range": "<7.23.2",
"nodes": [
"node_modules/@babel/traverse"
],
"fixAvailable": true
},
"@storybook/addon-actions": {
"name": "@storybook/addon-actions",
"severity": "low",
"isDirect": true,
"via": [
"@storybook/addons",
"@storybook/api",
"@storybook/client-api",
"@storybook/components",
"@storybook/theming",
"global"
],
"effects": [],
"range": "3.3.0-alpha.0 - 7.0.0-rc.11",
"nodes": [
"node_modules/@storybook/addon-actions"
],
"fixAvailable": {
"name": "@storybook/addon-actions",
"version": "9.0.8",
"isSemVerMajor": true
}
},
"@storybook/addons": {
"name": "@storybook/addons",
"severity": "low",
"isDirect": false,
"via": [
"@storybook/api",
"@storybook/client-logger",
"@storybook/router",
"@storybook/theming",
"global"
],
"effects": [
"@storybook/addon-actions",
"@storybook/html",
"@storybook/ui"
],
"range": "4.0.0-alpha.0 - 7.0.0-rc.11",
"nodes": [
"node_modules/@storybook/addons"
],
"fixAvailable": {
"name": "@storybook/addon-actions",
"version": "9.0.8",
"isSemVerMajor": true
}
},
"@storybook/api": {
"name": "@storybook/api",
"severity": "low",
"isDirect": false,
"via": [
"@storybook/client-logger",
"@storybook/router",
"@storybook/theming",
"global",
"telejson"
],
"effects": [
"@storybook/addon-actions",
"@storybook/addons",
"@storybook/ui"
],
"range": "<=7.0.0-rc.11",
"nodes": [
"node_modules/@storybook/api"
],
"fixAvailable": {
"name": "@storybook/addon-actions",
"version": "9.0.8",
"isSemVerMajor": true
}
},
"@storybook/builder-webpack4": {
"name": "@storybook/builder-webpack4",
"severity": "high",
"isDirect": false,
"via": [
"@storybook/addons",
"@storybook/api",
"@storybook/channel-postmessage",
"@storybook/client-api",
"@storybook/client-logger",
"@storybook/components",
"@storybook/core-common",
"@storybook/router",
"@storybook/theming",
"@storybook/ui",
"autoprefixer",
"css-loader",
"fork-ts-checker-webpack-plugin",
"global",
"postcss",
"postcss-flexbugs-fixes",
"react-dev-utils",
"webpack",
"webpack-dev-middleware"
],
"effects": [],
"range": "*",
"nodes": [
"node_modules/@storybook/builder-webpack4"
],
"fixAvailable": true
},
"@storybook/channel-postmessage": {
"name": "@storybook/channel-postmessage",
"severity": "low",
"isDirect": false,
"via": [
"@storybook/client-logger",
"global",
"telejson"
],
"effects": [
"@storybook/client-api"
],
"range": "3.1.2 - 7.0.0-rc.11",
"nodes": [
"node_modules/@storybook/channel-postmessage"
],
"fixAvailable": {
"name": "@storybook/addon-actions",
"version": "9.0.8",
"isSemVerMajor": true
}
},
"@storybook/client-api": {
"name": "@storybook/client-api",
"severity": "low",
"isDirect": false,
"via": [
"@storybook/addons",
"@storybook/channel-postmessage",
"@storybook/client-logger",
"global"
],
"effects": [
"@storybook/addon-actions",
"@storybook/html"
],
"range": "<=7.0.0-rc.11",
"nodes": [
"node_modules/@storybook/client-api"
],
"fixAvailable": {
"name": "@storybook/addon-actions",
"version": "9.0.8",
"isSemVerMajor": true
}
},
"@storybook/client-logger": {
"name": "@storybook/client-logger",
"severity": "low",
"isDirect": false,
"via": [
"global"
],
"effects": [
"@storybook/addons",
"@storybook/api",
"@storybook/channel-postmessage",
"@storybook/client-api",
"@storybook/components",
"@storybook/router",
"@storybook/theming",
"@storybook/ui"
],
"range": "6.0.0-alpha.0 - 7.0.0-rc.11",
"nodes": [
"node_modules/@storybook/client-logger"
],
"fixAvailable": {
"name": "@storybook/addon-actions",
"version": "9.0.8",
"isSemVerMajor": true
}
},
"@storybook/components": {
"name": "@storybook/components",
"severity": "moderate",
"isDirect": false,
"via": [
"@storybook/client-logger",
"@storybook/theming",
"global",
"react-syntax-highlighter"
],
"effects": [
"@storybook/addon-actions",
"@storybook/builder-webpack4",
"@storybook/ui"
],
"range": "4.0.0-alpha.0 - 7.0.0-rc.11",
"nodes": [
"node_modules/@storybook/components"
],
"fixAvailable": {
"name": "@storybook/addon-actions",
"version": "9.0.8",
"isSemVerMajor": true
}
},
"@storybook/core": {
"name": "@storybook/core",
"severity": "high",
"isDirect": false,
"via": [
"@storybook/core-client",
"@storybook/core-server"
],
"effects": [],
"range": "6.2.0-alpha.0 - 6.5.17-alpha.0",
"nodes": [
"node_modules/@storybook/core"
],
"fixAvailable": true
},
"@storybook/core-client": {
"name": "@storybook/core-client",
"severity": "moderate",
"isDirect": false,
"via": [
"@storybook/addons",
"@storybook/channel-postmessage",
"@storybook/client-api",
"@storybook/client-logger",
"@storybook/ui",
"global"
],
"effects": [
"@storybook/core",
"@storybook/core-server"
],
"range": "<=7.0.0-rc.11",
"nodes": [
"node_modules/@storybook/core-client"
],
"fixAvailable": true
},
"@storybook/core-common": {
"name": "@storybook/core-common",
"severity": "moderate",
"isDirect": false,
"via": [
"webpack"
],
"effects": [
"@storybook/html"
],
"range": "<=6.5.17-alpha.0",
"nodes": [
"node_modules/@storybook/core-common"
],
"fixAvailable": {
"name": "@storybook/html",
"version": "9.1.10",
"isSemVerMajor": true
}
},
"@storybook/core-server": {
"name": "@storybook/core-server",
"severity": "high",
"isDirect": false,
"via": [
"@storybook/addons",
"@storybook/builder-webpack4",
"@storybook/core-client",
"@storybook/core-common",
"@storybook/theming",
"@storybook/ui",
"cpy",
"css-loader",
"global",
"ip",
"telejson",
"webpack",
"webpack-dev-middleware"
],
"effects": [
"@storybook/core"
],
"range": "<=7.6.19 || 8.0.0-alpha.0 - 8.1.5 || 8.2.0-alpha.0 - 8.2.0-beta.3",
"nodes": [
"node_modules/@storybook/core-server"
],
"fixAvailable": true
},
"@storybook/html": {
"name": "@storybook/html",
"severity": "high",
"isDirect": true,
"via": [
"@storybook/addons",
"@storybook/client-api",
"@storybook/core",
"@storybook/core-common",
"global"
],
"effects": [],
"range": "<=7.0.0-rc.11",
"nodes": [
"node_modules/@storybook/html"
],
"fixAvailable": {
"name": "@storybook/html",
"version": "9.1.10",
"isSemVerMajor": true
}
},
"@storybook/router": {
"name": "@storybook/router",
"severity": "low",
"isDirect": false,
"via": [
"@storybook/client-logger",
"global"
],
"effects": [
"@storybook/addons",
"@storybook/api",
"@storybook/ui"
],
"range": "<=7.0.0-rc.11",
"nodes": [
"node_modules/@storybook/router"
],
"fixAvailable": {
"name": "@storybook/addon-actions",
"version": "9.0.8",
"isSemVerMajor": true
}
},
"@storybook/theming": {
"name": "@storybook/theming",
"severity": "low",
"isDirect": false,
"via": [
"@storybook/client-logger",
"global"
],
"effects": [
"@storybook/addon-actions",
"@storybook/components"
],
"range": "<=7.0.0-rc.11",
"nodes": [
"node_modules/@storybook/theming"
],
"fixAvailable": {
"name": "@storybook/addon-actions",
"version": "9.0.8",
"isSemVerMajor": true
}
},
"@storybook/ui": {
"name": "@storybook/ui",
"severity": "moderate",
"isDirect": false,
"via": [
"@storybook/addons",
"@storybook/api",
"@storybook/client-logger",
"@storybook/components",
"@storybook/router",
"@storybook/theming",
"global",
"markdown-to-jsx"
],
"effects": [
"@storybook/builder-webpack4",
"@storybook/core-client"
],
"range": "3.1.0 - 7.0.0-alpha.10",
"nodes": [
"node_modules/@storybook/ui"
],
"fixAvailable": true
},
"@wikimedia/mw-node-qunit": {
"name": "@wikimedia/mw-node-qunit",
"severity": "moderate",
"isDirect": true,
"via": [
"eslint-config-wikimedia",
"jsdom",
"qunit"
],
"effects": [],
"range": "<=6.2.1",
"nodes": [
"node_modules/@wikimedia/mw-node-qunit"
],
"fixAvailable": {
"name": "@wikimedia/mw-node-qunit",
"version": "6.4.2",
"isSemVerMajor": false
}
},
"ansi-regex": {
"name": "ansi-regex",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1094091,
"name": "ansi-regex",
"dependency": "ansi-regex",
"title": "Inefficient Regular Expression Complexity in chalk/ansi-regex",
"url": "https://github.com/advisories/GHSA-93q8-gq69-wqmw",
"severity": "high",
"cwe": [
"CWE-697",
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=4.0.0 <4.1.1"
}
],
"effects": [],
"range": "4.0.0 - 4.1.0",
"nodes": [
"node_modules/@wikimedia/mw-node-qunit/node_modules/ansi-regex",
"node_modules/webpack-cli/node_modules/ansi-regex"
],
"fixAvailable": true
},
"anymatch": {
"name": "anymatch",
"severity": "moderate",
"isDirect": false,
"via": [
"micromatch"
],
"effects": [
"chokidar",
"sane"
],
"range": "1.2.0 - 2.0.0",
"nodes": [
"node_modules/sane/node_modules/anymatch",
"node_modules/watchpack-chokidar2/node_modules/anymatch"
],
"fixAvailable": {
"name": "@wikimedia/mw-node-qunit",
"version": "6.4.2",
"isSemVerMajor": false
}
},
"autoprefixer": {
"name": "autoprefixer",
"severity": "moderate",
"isDirect": false,
"via": [
"postcss"
],
"effects": [
"stylelint"
],
"range": "1.0.20131222 - 9.8.8",
"nodes": [
"node_modules/autoprefixer"
],
"fixAvailable": {
"name": "stylelint-config-wikimedia",
"version": "0.18.0",
"isSemVerMajor": true
}
},
"axios": {
"name": "axios",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1097679,
"name": "axios",
"dependency": "axios",
"title": "Axios Cross-Site Request Forgery Vulnerability",
"url": "https://github.com/advisories/GHSA-wf5p-g6vw-rhxx",
"severity": "moderate",
"cwe": [
"CWE-352"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
},
"range": ">=0.8.1 <0.28.0"
},
{
"source": 1103617,
"name": "axios",
"dependency": "axios",
"title": "axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL",
"url": "https://github.com/advisories/GHSA-jr5f-v2jv-69x6",
"severity": "high",
"cwe": [
"CWE-918"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<0.30.0"
},
{
"source": 1108262,
"name": "axios",
"dependency": "axios",
"title": "Axios is vulnerable to DoS attack through lack of data size check",
"url": "https://github.com/advisories/GHSA-4hjh-wcwx-xvwj",
"severity": "high",
"cwe": [
"CWE-770"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<0.30.2"
}
],
"effects": [
"bundlesize",
"github-build"
],
"range": "<=0.30.1",
"nodes": [
"node_modules/axios",
"node_modules/github-build/node_modules/axios"
],
"fixAvailable": {
"name": "bundlesize",
"version": "0.18.2",
"isSemVerMajor": false
}
},
"body-parser": {
"name": "body-parser",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1099520,
"name": "body-parser",
"dependency": "body-parser",
"title": "body-parser vulnerable to denial of service when url encoding is enabled",
"url": "https://github.com/advisories/GHSA-qwcr-r2fm-qrc7",
"severity": "high",
"cwe": [
"CWE-405"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<1.20.3"
},
"qs"
],
"effects": [
"express"
],
"range": "<=1.20.2",
"nodes": [
"node_modules/body-parser"
],
"fixAvailable": true
},
"brace-expansion": {
"name": "brace-expansion",
"severity": "low",
"isDirect": false,
"via": [
{
"source": 1105443,
"name": "brace-expansion",
"dependency": "brace-expansion",
"title": "brace-expansion Regular Expression Denial of Service vulnerability",
"url": "https://github.com/advisories/GHSA-v6h2-p8h4-qcjw",
"severity": "low",
"cwe": [
"CWE-400"
],
"cvss": {
"score": 3.1,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L"
},
"range": ">=1.0.0 <=1.1.11"
}
],
"effects": [],
"range": "1.0.0 - 1.1.11",
"nodes": [
"node_modules/brace-expansion"
],
"fixAvailable": true
},
"braces": {
"name": "braces",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1098094,
"name": "braces",
"dependency": "braces",
"title": "Uncontrolled resource consumption in braces",
"url": "https://github.com/advisories/GHSA-grv7-fg5c-xmjg",
"severity": "high",
"cwe": [
"CWE-400",
"CWE-1050"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<3.0.3"
}
],
"effects": [
"chokidar",
"micromatch"
],
"range": "<3.0.3",
"nodes": [
"node_modules/@storybook/builder-webpack4/node_modules/braces",
"node_modules/braces",
"node_modules/fast-glob/node_modules/braces",
"node_modules/findup-sync/node_modules/braces",
"node_modules/react-dev-utils/node_modules/micromatch/node_modules/braces",
"node_modules/sane/node_modules/braces",
"node_modules/watchpack-chokidar2/node_modules/braces",
"node_modules/webpack-cli/node_modules/braces",
"node_modules/webpack/node_modules/braces"
],
"fixAvailable": {
"name": "webpack",
"version": "5.102.0",
"isSemVerMajor": true
}
},
"browserify-sign": {
"name": "browserify-sign",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1102445,
"name": "browserify-sign",
"dependency": "browserify-sign",
"title": "browserify-sign upper bound check issue in `dsaVerify` leads to a signature forgery attack",
"url": "https://github.com/advisories/GHSA-x9w5-v3q2-3rhw",
"severity": "high",
"cwe": [
"CWE-347"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
},
"range": ">=2.6.0 <=4.2.1"
}
],
"effects": [],
"range": "2.6.0 - 4.2.1",
"nodes": [
"node_modules/browserify-sign"
],
"fixAvailable": true
},
"browserslist": {
"name": "browserslist",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1093035,
"name": "browserslist",
"dependency": "browserslist",
"title": "Regular Expression Denial of Service in browserslist",
"url": "https://github.com/advisories/GHSA-w8qv-6jwh-64r5",
"severity": "moderate",
"cwe": [
"CWE-400",
"CWE-1333"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": ">=4.0.0 <4.16.5"
}
],
"effects": [
"react-dev-utils"
],
"range": "4.0.0 - 4.16.4",
"nodes": [
"node_modules/react-dev-utils/node_modules/browserslist"
],
"fixAvailable": true
},
"bundlesize": {
"name": "bundlesize",
"severity": "high",
"isDirect": true,
"via": [
"axios"
],
"effects": [],
"range": "0.3.0 - 0.18.1 || >=1.0.0-beta.1",
"nodes": [
"node_modules/bundlesize"
],
"fixAvailable": {
"name": "bundlesize",
"version": "0.18.2",
"isSemVerMajor": false
}
},
"chokidar": {
"name": "chokidar",
"severity": "high",
"isDirect": false,
"via": [
"anymatch",
"braces",
"readdirp"
],
"effects": [
"watchpack-chokidar2"
],
"range": "1.3.0 - 2.1.8",
"nodes": [
"node_modules/watchpack-chokidar2/node_modules/chokidar"
],
"fixAvailable": true
},
"cipher-base": {
"name": "cipher-base",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1107538,
"name": "cipher-base",
"dependency": "cipher-base",
"title": "cipher-base is missing type checks, leading to hash rewind and passing on crafted data",
"url": "https://github.com/advisories/GHSA-cpq7-6gpm-g9rc",
"severity": "critical",
"cwe": [
"CWE-20"
],
"cvss": {
"score": 9.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
},
"range": "<=1.0.4"
}
],
"effects": [],
"range": "<=1.0.4",
"nodes": [
"node_modules/cipher-base"
],
"fixAvailable": true
},
"cookie": {
"name": "cookie",
"severity": "low",
"isDirect": false,
"via": [
{
"source": 1103907,
"name": "cookie",
"dependency": "cookie",
"title": "cookie accepts cookie name, path, and domain with out of bounds characters",
"url": "https://github.com/advisories/GHSA-pxg6-pf52-xh8x",
"severity": "low",
"cwe": [
"CWE-74"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<0.7.0"
}
],
"effects": [
"express"
],
"range": "<0.7.0",
"nodes": [
"node_modules/cookie"
],
"fixAvailable": true
},
"core-js-compat": {
"name": "core-js-compat",
"severity": "high",
"isDirect": false,
"via": [
"semver"
],
"effects": [],
"range": "3.6.0 - 3.25.0",
"nodes": [
"node_modules/core-js-compat"
],
"fixAvailable": true
},
"cpy": {
"name": "cpy",
"severity": "moderate",
"isDirect": false,
"via": [
"globby"
],
"effects": [
"@storybook/core-server"
],
"range": "7.0.0 - 8.1.2",
"nodes": [
"node_modules/cpy"
],
"fixAvailable": true
},
"cross-spawn": {
"name": "cross-spawn",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1104663,
"name": "cross-spawn",
"dependency": "cross-spawn",
"title": "Regular Expression Denial of Service (ReDoS) in cross-spawn",
"url": "https://github.com/advisories/GHSA-3xgq-45jj-v275",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<6.0.6"
},
{
"source": 1104664,
"name": "cross-spawn",
"dependency": "cross-spawn",
"title": "Regular Expression Denial of Service (ReDoS) in cross-spawn",
"url": "https://github.com/advisories/GHSA-3xgq-45jj-v275",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=7.0.0 <7.0.5"
}
],
"effects": [
"pre-commit",
"react-dev-utils",
"webpack-cli"
],
"range": "<6.0.6 || >=7.0.0 <7.0.5",
"nodes": [
"node_modules/cross-spawn",
"node_modules/eslint/node_modules/cross-spawn",
"node_modules/foreground-child/node_modules/cross-spawn",
"node_modules/istanbul-lib-processinfo/node_modules/cross-spawn",
"node_modules/pre-commit/node_modules/cross-spawn",
"node_modules/react-dev-utils/node_modules/cross-spawn"
],
"fixAvailable": {
"name": "pre-commit",
"version": "1.0.10",
"isSemVerMajor": true
}
},
"css-loader": {
"name": "css-loader",
"severity": "moderate",
"isDirect": false,
"via": [
"icss-utils",
"postcss",
"postcss-modules-extract-imports",
"postcss-modules-local-by-default",
"postcss-modules-scope",
"postcss-modules-values"
],
"effects": [],
"range": "0.15.0 - 4.3.0",
"nodes": [
"node_modules/css-loader"
],
"fixAvailable": true
},
"decode-uri-component": {
"name": "decode-uri-component",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1094087,
"name": "decode-uri-component",
"dependency": "decode-uri-component",
"title": "decode-uri-component vulnerable to Denial of Service (DoS)",
"url": "https://github.com/advisories/GHSA-w573-4hg7-7wgq",
"severity": "high",
"cwe": [
"CWE-20"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<0.2.1"
}
],
"effects": [],
"range": "<0.2.1",
"nodes": [
"node_modules/decode-uri-component"
],
"fixAvailable": true
},
"elliptic": {
"name": "elliptic",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1098593,
"name": "elliptic",
"dependency": "elliptic",
"title": "Elliptic's EDDSA missing signature length check",
"url": "https://github.com/advisories/GHSA-f7q4-pwc6-w24p",
"severity": "low",
"cwe": [
"CWE-347"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
},
"range": ">=4.0.0 <=6.5.6"
},
{
"source": 1098594,
"name": "elliptic",
"dependency": "elliptic",
"title": "Elliptic's ECDSA missing check for whether leading bit of r and s is zero",
"url": "https://github.com/advisories/GHSA-977x-g7h5-7qgw",
"severity": "low",
"cwe": [
"CWE-130"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
},
"range": ">=2.0.0 <=6.5.6"
},
{
"source": 1098595,
"name": "elliptic",
"dependency": "elliptic",
"title": "Elliptic allows BER-encoded signatures",
"url": "https://github.com/advisories/GHSA-49q7-c7j4-3p7m",
"severity": "low",
"cwe": [
"CWE-347"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
},
"range": ">=5.2.1 <=6.5.6"
},
{
"source": 1101424,
"name": "elliptic",
"dependency": "elliptic",
"title": "Elliptic's verify function omits uniqueness validation",
"url": "https://github.com/advisories/GHSA-434g-2637-qmqr",
"severity": "low",
"cwe": [
"CWE-347"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
"range": "<6.5.6"
},
{
"source": 1102901,
"name": "elliptic",
"dependency": "elliptic",
"title": "Elliptic's private key extraction in ECDSA upon signing a malformed input (e.g. a string)",
"url": "https://github.com/advisories/GHSA-vjh7-7g9h-fjfh",
"severity": "critical",
"cwe": [
"CWE-200"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<=6.6.0"
},
{
"source": 1105750,
"name": "elliptic",
"dependency": "elliptic",
"title": "Valid ECDSA signatures erroneously rejected in Elliptic",
"url": "https://github.com/advisories/GHSA-fc9h-whq2-v747",
"severity": "low",
"cwe": [
"CWE-347"
],
"cvss": {
"score": 4.8,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"
},
"range": "<6.6.0"
}
],
"effects": [],
"range": "<=6.6.0",
"nodes": [
"node_modules/elliptic"
],
"fixAvailable": true
},
"eslint": {
"name": "eslint",
"severity": "low",
"isDirect": false,
"via": [
"inquirer"
],
"effects": [
"eslint-config-wikimedia"
],
"range": "4.0.0-alpha.0 - 7.2.0",
"nodes": [
"node_modules/@wikimedia/mw-node-qunit/node_modules/eslint"
],
"fixAvailable": {
"name": "eslint-config-wikimedia",
"version": "0.31.0",
"isSemVerMajor": true
}
},
"eslint-config-wikimedia": {
"name": "eslint-config-wikimedia",
"severity": "high",
"isDirect": true,
"via": [
"eslint",
"eslint-plugin-compat"
],
"effects": [
"@wikimedia/mw-node-qunit"
],
"range": "0.18.0 - 0.21.0 || 0.9.0 - 0.15.3",
"nodes": [
"node_modules/@wikimedia/mw-node-qunit/node_modules/eslint-config-wikimedia",
"node_modules/eslint-config-wikimedia"
],
"fixAvailable": {
"name": "eslint-config-wikimedia",
"version": "0.31.0",
"isSemVerMajor": true
}
},
"eslint-plugin-compat": {
"name": "eslint-plugin-compat",
"severity": "high",
"isDirect": false,
"via": [
"semver"
],
"effects": [
"eslint-config-wikimedia"
],
"range": "3.6.0-0 - 4.1.4",
"nodes": [
"node_modules/eslint-plugin-compat"
],
"fixAvailable": {
"name": "eslint-config-wikimedia",
"version": "0.31.0",
"isSemVerMajor": true
}
},
"express": {
"name": "express",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1096820,
"name": "express",
"dependency": "express",
"title": "Express.js Open Redirect in malformed URLs",
"url": "https://github.com/advisories/GHSA-rv95-896h-c2vc",
"severity": "moderate",
"cwe": [
"CWE-601",
"CWE-1286"
],
"cvss": {
"score": 6.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
"range": "<4.19.2"
},
{
"source": 1100530,
"name": "express",
"dependency": "express",
"title": "express vulnerable to XSS via response.redirect()",
"url": "https://github.com/advisories/GHSA-qw6h-vgh9-j6wx",
"severity": "low",
"cwe": [
"CWE-79"
],
"cvss": {
"score": 5,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L"
},
"range": "<4.20.0"
},
"body-parser",
"cookie",
"path-to-regexp",
"qs",
"send",
"serve-static"
],
"effects": [],
"range": "<=4.21.0 || 5.0.0-alpha.1 - 5.0.0",
"nodes": [
"node_modules/express"
],
"fixAvailable": true
},
"external-editor": {
"name": "external-editor",
"severity": "low",
"isDirect": false,
"via": [
"tmp"
],
"effects": [
"inquirer"
],
"range": ">=1.1.1",
"nodes": [
"node_modules/external-editor"
],
"fixAvailable": {
"name": "eslint-config-wikimedia",
"version": "0.31.0",
"isSemVerMajor": true
}
},
"fast-glob": {
"name": "fast-glob",
"severity": "moderate",
"isDirect": false,
"via": [
"micromatch"
],
"effects": [
"globby"
],
"range": "<=2.2.7",
"nodes": [
"node_modules/fast-glob"
],
"fixAvailable": true
},
"findup-sync": {
"name": "findup-sync",
"severity": "moderate",
"isDirect": false,
"via": [
"micromatch"
],
"effects": [
"qunit",
"webpack-cli"
],
"range": "0.4.0 - 3.0.0",
"nodes": [
"node_modules/findup-sync",
"node_modules/webpack-cli/node_modules/findup-sync"
],
"fixAvailable": {
"name": "@wikimedia/mw-node-qunit",
"version": "6.4.2",
"isSemVerMajor": false
}
},
"follow-redirects": {
"name": "follow-redirects",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1092623,
"name": "follow-redirects",
"dependency": "follow-redirects",
"title": "Exposure of Sensitive Information to an Unauthorized Actor in follow-redirects",
"url": "https://github.com/advisories/GHSA-pw2r-vq6v-hr8c",
"severity": "moderate",
"cwe": [
"CWE-200",
"CWE-212"
],
"cvss": {
"score": 5.9,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
"range": "<1.14.8"
},
{
"source": 1096353,
"name": "follow-redirects",
"dependency": "follow-redirects",
"title": "Follow Redirects improperly handles URLs in the url.parse() function",
"url": "https://github.com/advisories/GHSA-jchw-25xp-jwwc",
"severity": "moderate",
"cwe": [
"CWE-20",
"CWE-601"
],
"cvss": {
"score": 6.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
"range": "<1.15.4"
},
{
"source": 1096856,
"name": "follow-redirects",
"dependency": "follow-redirects",
"title": "follow-redirects' Proxy-Authorization header kept across hosts",
"url": "https://github.com/advisories/GHSA-cxjh-pqwp-8mfp",
"severity": "moderate",
"cwe": [
"CWE-200"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
},
"range": "<=1.15.5"
},
{
"source": 1102323,
"name": "follow-redirects",
"dependency": "follow-redirects",
"title": "Exposure of sensitive information in follow-redirects",
"url": "https://github.com/advisories/GHSA-74fj-2j2h-c42q",
"severity": "high",
"cwe": [
"CWE-359"
],
"cvss": {
"score": 8,
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
},
"range": "<1.14.7"
}
],
"effects": [],
"range": "<=1.15.5",
"nodes": [
"node_modules/follow-redirects"
],
"fixAvailable": true
},
"fork-ts-checker-webpack-plugin": {
"name": "fork-ts-checker-webpack-plugin",
"severity": "moderate",
"isDirect": false,
"via": [
"micromatch"
],
"effects": [
"react-dev-utils"
],
"range": "0.4.14 - 4.1.6",
"nodes": [
"node_modules/@storybook/builder-webpack4/node_modules/fork-ts-checker-webpack-plugin",
"node_modules/react-dev-utils/node_modules/fork-ts-checker-webpack-plugin"
],
"fixAvailable": true
},
"form-data": {
"name": "form-data",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1106508,
"name": "form-data",
"dependency": "form-data",
"title": "form-data uses unsafe random function in form-data for choosing boundary",
"url": "https://github.com/advisories/GHSA-fjxv-7rqg-78g4",
"severity": "critical",
"cwe": [
"CWE-330"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=3.0.0 <3.0.4"
},
{
"source": 1106509,
"name": "form-data",
"dependency": "form-data",
"title": "form-data uses unsafe random function in form-data for choosing boundary",
"url": "https://github.com/advisories/GHSA-fjxv-7rqg-78g4",
"severity": "critical",
"cwe": [
"CWE-330"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<2.5.4"
}
],
"effects": [
"request"
],
"range": ">=3.0.0 <3.0.4 || <2.5.4",
"nodes": [
"node_modules/form-data",
"node_modules/request/node_modules/form-data"
],
"fixAvailable": {
"name": "jsdom",
"version": "27.0.0",
"isSemVerMajor": true
}
},
"github-build": {
"name": "github-build",
"severity": "high",
"isDirect": false,
"via": [
"axios"
],
"effects": [],
"range": "<=1.2.3",
"nodes": [
"node_modules/github-build"
],
"fixAvailable": true
},
"global": {
"name": "global",
"severity": "low",
"isDirect": false,
"via": [
"min-document"
],
"effects": [
"@storybook/addon-actions",
"@storybook/addons",
"@storybook/api",
"@storybook/channel-postmessage",
"@storybook/client-api",
"@storybook/client-logger",
"@storybook/components",
"@storybook/core-client",
"@storybook/core-server",
"@storybook/html",
"@storybook/router",
"@storybook/theming",
"@storybook/ui",
"telejson"
],
"range": ">=2.0.3",
"nodes": [
"node_modules/global"
],
"fixAvailable": {
"name": "@storybook/addon-actions",
"version": "9.0.8",
"isSemVerMajor": true
}
},
"globby": {
"name": "globby",
"severity": "moderate",
"isDirect": false,
"via": [
"fast-glob"
],
"effects": [
"cpy"
],
"range": "8.0.0 - 9.2.0",
"nodes": [
"node_modules/globby"
],
"fixAvailable": true
},
"icss-utils": {
"name": "icss-utils",
"severity": "moderate",
"isDirect": false,
"via": [
"postcss"
],
"effects": [
"css-loader",
"postcss-modules-local-by-default",
"postcss-modules-values"
],
"range": "<=4.1.1",
"nodes": [
"node_modules/icss-utils"
],
"fixAvailable": true
},
"immer": {
"name": "immer",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1097196,
"name": "immer",
"dependency": "immer",
"title": "Prototype Pollution in immer",
"url": "https://github.com/advisories/GHSA-c36v-fmgq-m8hx",
"severity": "high",
"cwe": [
"CWE-915",
"CWE-1321"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=7.0.0 <9.0.6"
},
{
"source": 1097209,
"name": "immer",
"dependency": "immer",
"title": "Prototype Pollution in immer",
"url": "https://github.com/advisories/GHSA-33f9-j839-rf8h",
"severity": "critical",
"cwe": [
"CWE-843",
"CWE-1321"
],
"cvss": {
"score": 9.8,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"range": ">=7.0.0 <9.0.6"
}
],
"effects": [],
"range": "7.0.0 - 9.0.5",
"nodes": [
"node_modules/immer"
],
"fixAvailable": true
},
"inquirer": {
"name": "inquirer",
"severity": "low",
"isDirect": false,
"via": [
"external-editor"
],
"effects": [
"eslint"
],
"range": "3.0.0 - 8.2.6 || 9.0.0 - 9.3.7",
"nodes": [
"node_modules/@wikimedia/mw-node-qunit/node_modules/inquirer"
],
"fixAvailable": {
"name": "eslint-config-wikimedia",
"version": "0.31.0",
"isSemVerMajor": true
}
},
"ip": {
"name": "ip",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1097720,
"name": "ip",
"dependency": "ip",
"title": "NPM IP package incorrectly identifies some private IP addresses as public",
"url": "https://github.com/advisories/GHSA-78xj-cgh5-2h22",
"severity": "low",
"cwe": [
"CWE-918"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<1.1.9"
},
{
"source": 1101851,
"name": "ip",
"dependency": "ip",
"title": "ip SSRF improper categorization in isPublic",
"url": "https://github.com/advisories/GHSA-2p57-rm9w-gvfp",
"severity": "high",
"cwe": [
"CWE-918"
],
"cvss": {
"score": 8.1,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"range": "<=2.0.1"
}
],
"effects": [
"@storybook/core-server"
],
"range": "*",
"nodes": [
"node_modules/ip"
],
"fixAvailable": true
},
"jsdoc": {
"name": "jsdoc",
"severity": "high",
"isDirect": true,
"via": [
"markdown-it",
"marked",
"taffydb"
],
"effects": [],
"range": "3.2.0-dev - 3.6.11",
"nodes": [
"node_modules/jsdoc"
],
"fixAvailable": {
"name": "jsdoc",
"version": "3.6.11",
"isSemVerMajor": false
}
},
"jsdom": {
"name": "jsdom",
"severity": "moderate",
"isDirect": true,
"via": [
"request",
"request-promise-native",
"tough-cookie"
],
"effects": [
"@wikimedia/mw-node-qunit"
],
"range": "0.1.20 || 0.2.0 - 16.5.3",
"nodes": [
"node_modules/jsdom"
],
"fixAvailable": {
"name": "jsdom",
"version": "27.0.0",
"isSemVerMajor": true
}
},
"json-schema": {
"name": "json-schema",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1101855,
"name": "json-schema",
"dependency": "json-schema",
"title": "json-schema is vulnerable to Prototype Pollution",
"url": "https://github.com/advisories/GHSA-896r-f27r-55mw",
"severity": "critical",
"cwe": [
"CWE-915",
"CWE-1321"
],
"cvss": {
"score": 9.8,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"range": "<0.4.0"
}
],
"effects": [
"jsprim"
],
"range": "<0.4.0",
"nodes": [
"node_modules/json-schema"
],
"fixAvailable": true
},
"json5": {
"name": "json5",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1096543,
"name": "json5",
"dependency": "json5",
"title": "Prototype Pollution in JSON5 via Parse Method",
"url": "https://github.com/advisories/GHSA-9c47-m6qq-7p4h",
"severity": "high",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 7.1,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H"
},
"range": "<1.0.2"
},
{
"source": 1096544,
"name": "json5",
"dependency": "json5",
"title": "Prototype Pollution in JSON5 via Parse Method",
"url": "https://github.com/advisories/GHSA-9c47-m6qq-7p4h",
"severity": "high",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 7.1,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H"
},
"range": ">=2.0.0 <2.2.2"
}
],
"effects": [],
"range": "<1.0.2 || >=2.0.0 <2.2.2",
"nodes": [
"node_modules/json5",
"node_modules/loader-utils/node_modules/json5",
"node_modules/webpack-cli/node_modules/json5"
],
"fixAvailable": true
},
"jsprim": {
"name": "jsprim",
"severity": "critical",
"isDirect": false,
"via": [
"json-schema"
],
"effects": [],
"range": "0.3.0 - 1.4.1 || 2.0.0 - 2.0.1",
"nodes": [
"node_modules/jsprim"
],
"fixAvailable": true
},
"less": {
"name": "less",
"severity": "moderate",
"isDirect": true,
"via": [
"request"
],
"effects": [],
"range": "1.4.0-b1 - 2.6.1 || 2.7.2 - 3.11.3",
"nodes": [
"node_modules/less"
],
"fixAvailable": {
"name": "less",
"version": "3.13.1",
"isSemVerMajor": false
}
},
"loader-utils": {
"name": "loader-utils",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1094088,
"name": "loader-utils",
"dependency": "loader-utils",
"title": "Prototype pollution in webpack loader-utils",
"url": "https://github.com/advisories/GHSA-76p3-8jx3-jpfq",
"severity": "critical",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 9.8,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"range": "<1.4.1"
},
{
"source": 1094089,
"name": "loader-utils",
"dependency": "loader-utils",
"title": "Prototype pollution in webpack loader-utils",
"url": "https://github.com/advisories/GHSA-76p3-8jx3-jpfq",
"severity": "critical",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 9.8,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"range": ">=2.0.0 <2.0.3"
},
{
"source": 1095054,
"name": "loader-utils",
"dependency": "loader-utils",
"title": "loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS) via url variable",
"url": "https://github.com/advisories/GHSA-3rfm-jhwj-7488",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=2.0.0 <2.0.4"
},
{
"source": 1095055,
"name": "loader-utils",
"dependency": "loader-utils",
"title": "loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS) via url variable",
"url": "https://github.com/advisories/GHSA-3rfm-jhwj-7488",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=1.0.0 <1.4.2"
},
{
"source": 1097142,
"name": "loader-utils",
"dependency": "loader-utils",
"title": "loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS)",
"url": "https://github.com/advisories/GHSA-hhq3-ff78-jv3g",
"severity": "high",
"cwe": [
"CWE-400",
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=2.0.0 <2.0.4"
},
{
"source": 1097143,
"name": "loader-utils",
"dependency": "loader-utils",
"title": "loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS)",
"url": "https://github.com/advisories/GHSA-hhq3-ff78-jv3g",
"severity": "high",
"cwe": [
"CWE-400",
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=1.0.0 <1.4.2"
}
],
"effects": [
"react-dev-utils",
"webpack-cli"
],
"range": "<=1.4.1 || 2.0.0 - 2.0.3",
"nodes": [
"node_modules/file-loader/node_modules/loader-utils",
"node_modules/html-loader/node_modules/loader-utils",
"node_modules/loader-utils",
"node_modules/postcss-loader/node_modules/loader-utils",
"node_modules/raw-loader/node_modules/loader-utils",
"node_modules/react-dev-utils/node_modules/loader-utils",
"node_modules/style-loader/node_modules/loader-utils",
"node_modules/url-loader/node_modules/loader-utils",
"node_modules/webpack-cli/node_modules/loader-utils"
],
"fixAvailable": {
"name": "webpack-cli",
"version": "3.3.12",
"isSemVerMajor": false
}
},
"markdown-it": {
"name": "markdown-it",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1092663,
"name": "markdown-it",
"dependency": "markdown-it",
"title": "Uncontrolled Resource Consumption in markdown-it",
"url": "https://github.com/advisories/GHSA-6vfc-qv3f-vr6c",
"severity": "moderate",
"cwe": [
"CWE-400",
"CWE-1333"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": "<12.3.2"
}
],
"effects": [
"jsdoc"
],
"range": "<12.3.2",
"nodes": [
"node_modules/markdown-it"
],
"fixAvailable": {
"name": "jsdoc",
"version": "3.6.11",
"isSemVerMajor": false
}
},
"markdown-to-jsx": {
"name": "markdown-to-jsx",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1100074,
"name": "markdown-to-jsx",
"dependency": "markdown-to-jsx",
"title": "Cross site scripting in markdown-to-jsx",
"url": "https://github.com/advisories/GHSA-4wx3-54gh-9fr9",
"severity": "moderate",
"cwe": [
"CWE-79"
],
"cvss": {
"score": 6.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
"range": "<7.4.0"
}
],
"effects": [
"@storybook/ui"
],
"range": "<7.4.0",
"nodes": [
"node_modules/@storybook/ui/node_modules/markdown-to-jsx",
"node_modules/markdown-to-jsx"
],
"fixAvailable": true
},
"marked": {
"name": "marked",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1095051,
"name": "marked",
"dependency": "marked",
"title": "Inefficient Regular Expression Complexity in marked",
"url": "https://github.com/advisories/GHSA-rrrm-qjm4-v8hf",
"severity": "high",
"cwe": [
"CWE-400",
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<4.0.10"
},
{
"source": 1095052,
"name": "marked",
"dependency": "marked",
"title": "Inefficient Regular Expression Complexity in marked",
"url": "https://github.com/advisories/GHSA-5v2h-r2cx-5xgj",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<4.0.10"
}
],
"effects": [
"jsdoc"
],
"range": "<=4.0.9",
"nodes": [
"node_modules/marked"
],
"fixAvailable": {
"name": "jsdoc",
"version": "3.6.11",
"isSemVerMajor": false
}
},
"micromatch": {
"name": "micromatch",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1098681,
"name": "micromatch",
"dependency": "micromatch",
"title": "Regular Expression Denial of Service (ReDoS) in micromatch",
"url": "https://github.com/advisories/GHSA-952p-6rrq-rcjv",
"severity": "moderate",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": "<4.0.8"
},
"braces"
],
"effects": [
"anymatch",
"fast-glob",
"findup-sync",
"fork-ts-checker-webpack-plugin",
"readdirp",
"sane",
"webpack"
],
"range": "<=4.0.7",
"nodes": [
"node_modules/@storybook/builder-webpack4/node_modules/micromatch",
"node_modules/fast-glob/node_modules/micromatch",
"node_modules/findup-sync/node_modules/micromatch",
"node_modules/micromatch",
"node_modules/react-dev-utils/node_modules/fast-glob/node_modules/micromatch",
"node_modules/react-dev-utils/node_modules/micromatch",
"node_modules/sane/node_modules/micromatch",
"node_modules/watchpack-chokidar2/node_modules/micromatch",
"node_modules/webpack-cli/node_modules/micromatch",
"node_modules/webpack/node_modules/micromatch"
],
"fixAvailable": {
"name": "webpack",
"version": "5.102.0",
"isSemVerMajor": true
}
},
"min-document": {
"name": "min-document",
"severity": "low",
"isDirect": false,
"via": [
{
"source": 1108264,
"name": "min-document",
"dependency": "min-document",
"title": "min-document vulnerable to prototype pollution",
"url": "https://github.com/advisories/GHSA-rx8g-88g5-qh64",
"severity": "low",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<=2.19.0"
}
],
"effects": [
"global"
],
"range": "*",
"nodes": [
"node_modules/min-document"
],
"fixAvailable": {
"name": "@storybook/addon-actions",
"version": "9.0.8",
"isSemVerMajor": true
}
},
"minimatch": {
"name": "minimatch",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1096485,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch ReDoS vulnerability",
"url": "https://github.com/advisories/GHSA-f8q6-p94x-37v3",
"severity": "high",
"cwe": [
"CWE-400",
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<3.0.5"
}
],
"effects": [
"recursive-readdir"
],
"range": "<3.0.5",
"nodes": [
"node_modules/minimatch"
],
"fixAvailable": true
},
"minimist": {
"name": "minimist",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1097678,
"name": "minimist",
"dependency": "minimist",
"title": "Prototype Pollution in minimist",
"url": "https://github.com/advisories/GHSA-xvch-5gv4-984h",
"severity": "critical",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 9.8,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"range": ">=1.0.0 <1.2.6"
}
],
"effects": [],
"range": "1.0.0 - 1.2.5",
"nodes": [
"node_modules/minimist"
],
"fixAvailable": true
},
"nanoid": {
"name": "nanoid",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1089011,
"name": "nanoid",
"dependency": "nanoid",
"title": "Exposure of Sensitive Information to an Unauthorized Actor in nanoid",
"url": "https://github.com/advisories/GHSA-qrpm-p2h7-hrv2",
"severity": "moderate",
"cwe": [
"CWE-200"
],
"cvss": {
"score": 5.5,
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
},
"range": ">=3.0.0 <3.1.31"
},
{
"source": 1101163,
"name": "nanoid",
"dependency": "nanoid",
"title": "Predictable results in nanoid generation when given non-integer values",
"url": "https://github.com/advisories/GHSA-mwcw-c2x4-8c55",
"severity": "moderate",
"cwe": [
"CWE-835"
],
"cvss": {
"score": 4.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
},
"range": "<3.3.8"
}
],
"effects": [],
"range": "<=3.3.7",
"nodes": [
"node_modules/doiuse/node_modules/nanoid",
"node_modules/stylelint-no-unsupported-browser-features/node_modules/nanoid"
],
"fixAvailable": true
},
"node-fetch": {
"name": "node-fetch",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1095073,
"name": "node-fetch",
"dependency": "node-fetch",
"title": "node-fetch forwards secure headers to untrusted sites",
"url": "https://github.com/advisories/GHSA-r683-j2x4-v87g",
"severity": "high",
"cwe": [
"CWE-173",
"CWE-200",
"CWE-601"
],
"cvss": {
"score": 8.8,
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
},
"range": "<2.6.7"
}
],
"effects": [],
"range": "<2.6.7",
"nodes": [
"node_modules/node-fetch"
],
"fixAvailable": true
},
"path-to-regexp": {
"name": "path-to-regexp",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1101849,
"name": "path-to-regexp",
"dependency": "path-to-regexp",
"title": "path-to-regexp outputs backtracking regular expressions",
"url": "https://github.com/advisories/GHSA-9wv6-86v2-598j",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=0.2.0 <1.9.0"
},
{
"source": 1101850,
"name": "path-to-regexp",
"dependency": "path-to-regexp",
"title": "path-to-regexp outputs backtracking regular expressions",
"url": "https://github.com/advisories/GHSA-9wv6-86v2-598j",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<0.1.10"
},
{
"source": 1105199,
"name": "path-to-regexp",
"dependency": "path-to-regexp",
"title": "path-to-regexp contains a ReDoS",
"url": "https://github.com/advisories/GHSA-rhx6-c78j-4q9w",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<0.1.12"
}
],
"effects": [
"express"
],
"range": "<=0.1.11 || 0.2.0 - 1.8.0",
"nodes": [
"node_modules/nise/node_modules/path-to-regexp",
"node_modules/path-to-regexp"
],
"fixAvailable": true
},
"pbkdf2": {
"name": "pbkdf2",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1105691,
"name": "pbkdf2",
"dependency": "pbkdf2",
"title": "pbkdf2 silently disregards Uint8Array input, returning static keys",
"url": "https://github.com/advisories/GHSA-v62p-rq8g-8h59",
"severity": "critical",
"cwe": [
"CWE-20"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<=3.1.2"
},
{
"source": 1105692,
"name": "pbkdf2",
"dependency": "pbkdf2",
"title": "pbkdf2 returns predictable uninitialized/zero-filled memory for non-normalized or unimplemented algos",
"url": "https://github.com/advisories/GHSA-h7cp-r72f-jxh6",
"severity": "critical",
"cwe": [
"CWE-20"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=3.0.10 <=3.1.2"
}
],
"effects": [],
"range": "<=3.1.2",
"nodes": [
"node_modules/pbkdf2"
],
"fixAvailable": true
},
"postcss": {
"name": "postcss",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1094544,
"name": "postcss",
"dependency": "postcss",
"title": "PostCSS line return parsing error",
"url": "https://github.com/advisories/GHSA-7fh5-64p2-3v2j",
"severity": "moderate",
"cwe": [
"CWE-74",
"CWE-144"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
"range": "<8.4.31"
}
],
"effects": [
"@storybook/builder-webpack4",
"autoprefixer",
"css-loader",
"icss-utils",
"postcss-flexbugs-fixes",
"postcss-less",
"postcss-modules-extract-imports",
"postcss-modules-local-by-default",
"postcss-modules-scope",
"postcss-modules-values",
"postcss-safe-parser",
"postcss-sass",
"postcss-scss",
"stylelint",
"sugarss"
],
"range": "<8.4.31",
"nodes": [
"node_modules/doiuse/node_modules/postcss",
"node_modules/postcss",
"node_modules/stylelint-no-unsupported-browser-features/node_modules/postcss"
],
"fixAvailable": {
"name": "stylelint-config-wikimedia",
"version": "0.18.0",
"isSemVerMajor": true
}
},
"postcss-flexbugs-fixes": {
"name": "postcss-flexbugs-fixes",
"severity": "moderate",
"isDirect": false,
"via": [
"postcss"
],
"effects": [],
"range": "<=4.2.1",
"nodes": [
"node_modules/postcss-flexbugs-fixes"
],
"fixAvailable": true
},
"postcss-less": {
"name": "postcss-less",
"severity": "moderate",
"isDirect": false,
"via": [
"postcss"
],
"effects": [
"stylelint"
],
"range": "<=3.1.4",
"nodes": [
"node_modules/postcss-less"
],
"fixAvailable": {
"name": "stylelint-config-wikimedia",
"version": "0.18.0",
"isSemVerMajor": true
}
},
"postcss-modules-extract-imports": {
"name": "postcss-modules-extract-imports",
"severity": "moderate",
"isDirect": false,
"via": [
"postcss"
],
"effects": [],
"range": "<=2.0.0",
"nodes": [
"node_modules/postcss-modules-extract-imports"
],
"fixAvailable": true
},
"postcss-modules-local-by-default": {
"name": "postcss-modules-local-by-default",
"severity": "moderate",
"isDirect": false,
"via": [
"icss-utils",
"postcss"
],
"effects": [],
"range": "<=4.0.0-rc.4",
"nodes": [
"node_modules/postcss-modules-local-by-default"
],
"fixAvailable": true
},
"postcss-modules-scope": {
"name": "postcss-modules-scope",
"severity": "moderate",
"isDirect": false,
"via": [
"postcss"
],
"effects": [],
"range": "<=2.2.0",
"nodes": [
"node_modules/postcss-modules-scope"
],
"fixAvailable": true
},
"postcss-modules-values": {
"name": "postcss-modules-values",
"severity": "moderate",
"isDirect": false,
"via": [
"icss-utils",
"postcss"
],
"effects": [
"css-loader"
],
"range": "<=4.0.0-rc.5",
"nodes": [
"node_modules/postcss-modules-values"
],
"fixAvailable": true
},
"postcss-safe-parser": {
"name": "postcss-safe-parser",
"severity": "moderate",
"isDirect": false,
"via": [
"postcss"
],
"effects": [
"stylelint"
],
"range": "<=4.0.2",
"nodes": [
"node_modules/postcss-safe-parser"
],
"fixAvailable": {
"name": "stylelint-config-wikimedia",
"version": "0.18.0",
"isSemVerMajor": true
}
},
"postcss-sass": {
"name": "postcss-sass",
"severity": "moderate",
"isDirect": false,
"via": [
"postcss"
],
"effects": [
"stylelint"
],
"range": "<=0.4.4",
"nodes": [
"node_modules/postcss-sass"
],
"fixAvailable": {
"name": "stylelint-config-wikimedia",
"version": "0.18.0",
"isSemVerMajor": true
}
},
"postcss-scss": {
"name": "postcss-scss",
"severity": "moderate",
"isDirect": false,
"via": [
"postcss"
],
"effects": [
"stylelint"
],
"range": "<=2.1.1",
"nodes": [
"node_modules/postcss-scss"
],
"fixAvailable": {
"name": "stylelint-config-wikimedia",
"version": "0.18.0",
"isSemVerMajor": true
}
},
"pre-commit": {
"name": "pre-commit",
"severity": "high",
"isDirect": true,
"via": [
"cross-spawn"
],
"effects": [],
"range": ">=1.1.0",
"nodes": [
"node_modules/pre-commit"
],
"fixAvailable": {
"name": "pre-commit",
"version": "1.0.10",
"isSemVerMajor": true
}
},
"prismjs": {
"name": "prismjs",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1090424,
"name": "prismjs",
"dependency": "prismjs",
"title": "Cross-site Scripting in Prism",
"url": "https://github.com/advisories/GHSA-3949-f494-cm99",
"severity": "high",
"cwe": [
"CWE-79"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:L"
},
"range": ">=1.14.0 <1.27.0"
},
{
"source": 1105770,
"name": "prismjs",
"dependency": "prismjs",
"title": "PrismJS DOM Clobbering vulnerability",
"url": "https://github.com/advisories/GHSA-x7hr-w5r2-h6wg",
"severity": "moderate",
"cwe": [
"CWE-79",
"CWE-94"
],
"cvss": {
"score": 4.9,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N"
},
"range": "<1.30.0"
}
],
"effects": [
"refractor"
],
"range": "<=1.29.0",
"nodes": [
"node_modules/prismjs"
],
"fixAvailable": {
"name": "@storybook/addon-actions",
"version": "9.0.8",
"isSemVerMajor": true
}
},
"qs": {
"name": "qs",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1104118,
"name": "qs",
"dependency": "qs",
"title": "qs vulnerable to Prototype Pollution",
"url": "https://github.com/advisories/GHSA-hrpp-h998-j3pp",
"severity": "high",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=6.5.0 <6.5.3"
},
{
"source": 1104120,
"name": "qs",
"dependency": "qs",
"title": "qs vulnerable to Prototype Pollution",
"url": "https://github.com/advisories/GHSA-hrpp-h998-j3pp",
"severity": "high",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=6.7.0 <6.7.3"
},
{
"source": 1104123,
"name": "qs",
"dependency": "qs",
"title": "qs vulnerable to Prototype Pollution",
"url": "https://github.com/advisories/GHSA-hrpp-h998-j3pp",
"severity": "high",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=6.10.0 <6.10.3"
}
],
"effects": [
"body-parser",
"express"
],
"range": "6.5.0 - 6.5.2 || 6.7.0 - 6.7.2 || 6.10.0 - 6.10.2",
"nodes": [
"node_modules/body-parser/node_modules/qs",
"node_modules/express/node_modules/qs",
"node_modules/qs",
"node_modules/request/node_modules/qs"
],
"fixAvailable": true
},
"qunit": {
"name": "qunit",
"severity": "moderate",
"isDirect": false,
"via": [
"findup-sync",
"sane"
],
"effects": [
"@wikimedia/mw-node-qunit"
],
"range": "2.4.1 - 2.8.0",
"nodes": [
"node_modules/@wikimedia/mw-node-qunit/node_modules/qunit"
],
"fixAvailable": {
"name": "@wikimedia/mw-node-qunit",
"version": "6.4.2",
"isSemVerMajor": false
}
},
"react-dev-utils": {
"name": "react-dev-utils",
"severity": "critical",
"isDirect": false,
"via": [
"browserslist",
"cross-spawn",
"fork-ts-checker-webpack-plugin",
"immer",
"loader-utils",
"recursive-readdir",
"shell-quote"
],
"effects": [
"@storybook/builder-webpack4"
],
"range": "0.5.2 - 12.0.0-next.60",
"nodes": [
"node_modules/react-dev-utils"
],
"fixAvailable": true
},
"react-syntax-highlighter": {
"name": "react-syntax-highlighter",
"severity": "moderate",
"isDirect": false,
"via": [
"refractor"
],
"effects": [
"@storybook/components"
],
"range": ">=6.0.0",
"nodes": [
"node_modules/react-syntax-highlighter"
],
"fixAvailable": {
"name": "@storybook/addon-actions",
"version": "9.0.8",
"isSemVerMajor": true
}
},
"readdirp": {
"name": "readdirp",
"severity": "moderate",
"isDirect": false,
"via": [
"micromatch"
],
"effects": [
"chokidar"
],
"range": "2.2.0 - 2.2.1",
"nodes": [
"node_modules/watchpack-chokidar2/node_modules/readdirp"
],
"fixAvailable": true
},
"recursive-readdir": {
"name": "recursive-readdir",
"severity": "high",
"isDirect": false,
"via": [
"minimatch"
],
"effects": [
"react-dev-utils"
],
"range": "1.2.0 - 2.2.2",
"nodes": [
"node_modules/recursive-readdir"
],
"fixAvailable": true
},
"refractor": {
"name": "refractor",
"severity": "moderate",
"isDirect": false,
"via": [
"prismjs"
],
"effects": [
"react-syntax-highlighter"
],
"range": "<=4.6.0",
"nodes": [
"node_modules/refractor"
],
"fixAvailable": {
"name": "@storybook/addon-actions",
"version": "9.0.8",
"isSemVerMajor": true
}
},
"request": {
"name": "request",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1096727,
"name": "request",
"dependency": "request",
"title": "Server-Side Request Forgery in Request",
"url": "https://github.com/advisories/GHSA-p8p7-x288-28g6",
"severity": "moderate",
"cwe": [
"CWE-918"
],
"cvss": {
"score": 6.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
"range": "<=2.88.2"
},
"form-data",
"tough-cookie"
],
"effects": [
"jsdom",
"less",
"request-promise-core",
"request-promise-native"
],
"range": "*",
"nodes": [
"node_modules/request"
],
"fixAvailable": {
"name": "jsdom",
"version": "27.0.0",
"isSemVerMajor": true
}
},
"request-promise-core": {
"name": "request-promise-core",
"severity": "moderate",
"isDirect": false,
"via": [
"request"
],
"effects": [
"request-promise-native"
],
"range": "*",
"nodes": [
"node_modules/request-promise-core"
],
"fixAvailable": {
"name": "jsdom",
"version": "27.0.0",
"isSemVerMajor": true
}
},
"request-promise-native": {
"name": "request-promise-native",
"severity": "moderate",
"isDirect": false,
"via": [
"request",
"request-promise-core",
"tough-cookie"
],
"effects": [
"jsdom"
],
"range": ">=1.0.0",
"nodes": [
"node_modules/request-promise-native"
],
"fixAvailable": {
"name": "jsdom",
"version": "27.0.0",
"isSemVerMajor": true
}
},
"sane": {
"name": "sane",
"severity": "moderate",
"isDirect": false,
"via": [
"anymatch",
"micromatch"
],
"effects": [
"qunit"
],
"range": "1.5.0 - 4.1.0",
"nodes": [
"node_modules/sane"
],
"fixAvailable": {
"name": "@wikimedia/mw-node-qunit",
"version": "6.4.2",
"isSemVerMajor": false
}
},
"semver": {
"name": "semver",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1101088,
"name": "semver",
"dependency": "semver",
"title": "semver vulnerable to Regular Expression Denial of Service",
"url": "https://github.com/advisories/GHSA-c2qf-rxjj-qqgw",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=7.0.0 <7.5.2"
},
{
"source": 1101089,
"name": "semver",
"dependency": "semver",
"title": "semver vulnerable to Regular Expression Denial of Service",
"url": "https://github.com/advisories/GHSA-c2qf-rxjj-qqgw",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<5.7.2"
},
{
"source": 1101090,
"name": "semver",
"dependency": "semver",
"title": "semver vulnerable to Regular Expression Denial of Service",
"url": "https://github.com/advisories/GHSA-c2qf-rxjj-qqgw",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=6.0.0 <6.3.1"
}
],
"effects": [
"core-js-compat",
"eslint-plugin-compat"
],
"range": "<=5.7.1 || 6.0.0 - 6.3.0 || 7.0.0 - 7.5.1",
"nodes": [
"node_modules/@babel/helper-compilation-targets/node_modules/semver",
"node_modules/@npmcli/fs/node_modules/semver",
"node_modules/@storybook/builder-webpack4/node_modules/@babel/core/node_modules/semver",
"node_modules/@storybook/builder-webpack4/node_modules/@babel/helper-define-polyfill-provider/node_modules/semver",
"node_modules/@storybook/builder-webpack4/node_modules/@babel/preset-env/node_modules/semver",
"node_modules/@storybook/core-common/node_modules/@babel/register/node_modules/semver",
"node_modules/@storybook/core-common/node_modules/find-cache-dir/node_modules/semver",
"node_modules/@storybook/core-common/node_modules/semver",
"node_modules/@storybook/core-server/node_modules/semver",
"node_modules/@stylelint/postcss-css-in-js/node_modules/semver",
"node_modules/@wikimedia/mw-node-qunit/node_modules/semver",
"node_modules/babel-plugin-polyfill-corejs2/node_modules/semver",
"node_modules/babel-plugin-polyfill-corejs3/node_modules/semver",
"node_modules/babel-plugin-polyfill-regenerator/node_modules/semver",
"node_modules/core-js-compat/node_modules/semver",
"node_modules/css-loader/node_modules/semver",
"node_modules/eslint-plugin-compat/node_modules/semver",
"node_modules/eslint-plugin-jsdoc/node_modules/semver",
"node_modules/eslint-plugin-mediawiki/node_modules/semver",
"node_modules/eslint-plugin-node/node_modules/semver",
"node_modules/eslint-plugin-unicorn/node_modules/semver",
"node_modules/eslint-plugin-vue/node_modules/semver",
"node_modules/eslint-template-visitor/node_modules/semver",
"node_modules/eslint/node_modules/semver",
"node_modules/fork-ts-checker-webpack-plugin/node_modules/semver",
"node_modules/istanbul-lib-instrument/node_modules/semver",
"node_modules/make-dir/node_modules/semver",
"node_modules/meow/node_modules/semver",
"node_modules/nyc/node_modules/semver",
"node_modules/postcss-loader/node_modules/semver",
"node_modules/semver",
"node_modules/vue-eslint-parser/node_modules/semver"
],
"fixAvailable": {
"name": "eslint-config-wikimedia",
"version": "0.31.0",
"isSemVerMajor": true
}
},
"send": {
"name": "send",
"severity": "low",
"isDirect": false,
"via": [
{
"source": 1100526,
"name": "send",
"dependency": "send",
"title": "send vulnerable to template injection that can lead to XSS",
"url": "https://github.com/advisories/GHSA-m6fv-jmcg-4jfg",
"severity": "low",
"cwe": [
"CWE-79"
],
"cvss": {
"score": 5,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L"
},
"range": "<0.19.0"
}
],
"effects": [
"express",
"serve-static"
],
"range": "<0.19.0",
"nodes": [
"node_modules/send"
],
"fixAvailable": true
},
"serve-static": {
"name": "serve-static",
"severity": "low",
"isDirect": false,
"via": [
{
"source": 1100528,
"name": "serve-static",
"dependency": "serve-static",
"title": "serve-static vulnerable to template injection that can lead to XSS",
"url": "https://github.com/advisories/GHSA-cm22-4g7w-348p",
"severity": "low",
"cwe": [
"CWE-79"
],
"cvss": {
"score": 5,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L"
},
"range": "<1.16.0"
},
"send"
],
"effects": [],
"range": "<=1.16.0",
"nodes": [
"node_modules/serve-static"
],
"fixAvailable": true
},
"sha.js": {
"name": "sha.js",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1107537,
"name": "sha.js",
"dependency": "sha.js",
"title": "sha.js is missing type checks leading to hash rewind and passing on crafted data",
"url": "https://github.com/advisories/GHSA-95m3-7q98-8xr5",
"severity": "critical",
"cwe": [
"CWE-20"
],
"cvss": {
"score": 9.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
},
"range": "<=2.4.11"
}
],
"effects": [],
"range": "<=2.4.11",
"nodes": [
"node_modules/sha.js"
],
"fixAvailable": true
},
"shell-quote": {
"name": "shell-quote",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1107366,
"name": "shell-quote",
"dependency": "shell-quote",
"title": "Improper Neutralization of Special Elements used in a Command in Shell-quote",
"url": "https://github.com/advisories/GHSA-g4rg-993r-mgx7",
"severity": "critical",
"cwe": [
"CWE-77"
],
"cvss": {
"score": 9.8,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"range": ">=1.6.3 <=1.7.2"
}
],
"effects": [
"react-dev-utils"
],
"range": "1.6.3 - 1.7.2",
"nodes": [
"node_modules/shell-quote"
],
"fixAvailable": true
},
"simple-get": {
"name": "simple-get",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1090445,
"name": "simple-get",
"dependency": "simple-get",
"title": "Exposure of Sensitive Information in simple-get",
"url": "https://github.com/advisories/GHSA-wpg7-2c88-r8xv",
"severity": "high",
"cwe": [
"CWE-200"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
"range": ">=3.0.0 <3.1.1"
}
],
"effects": [],
"range": "3.0.0 - 3.1.0",
"nodes": [
"node_modules/simple-get"
],
"fixAvailable": true
},
"store2": {
"name": "store2",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1101527,
"name": "store2",
"dependency": "store2",
"title": "Cross Site Scripting vulnerability in store2",
"url": "https://github.com/advisories/GHSA-w5hq-hm5m-4548",
"severity": "moderate",
"cwe": [
"CWE-79"
],
"cvss": {
"score": 6.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
"range": "<2.14.4"
}
],
"effects": [],
"range": "<2.14.4",
"nodes": [
"node_modules/store2"
],
"fixAvailable": true
},
"stylelint": {
"name": "stylelint",
"severity": "moderate",
"isDirect": false,
"via": [
"autoprefixer",
"postcss",
"postcss-less",
"postcss-safe-parser",
"postcss-sass",
"postcss-scss",
"sugarss"
],
"effects": [
"stylelint-config-wikimedia"
],
"range": "0.1.0 - 13.13.1",
"nodes": [
"node_modules/stylelint"
],
"fixAvailable": {
"name": "stylelint-config-wikimedia",
"version": "0.18.0",
"isSemVerMajor": true
}
},
"stylelint-config-wikimedia": {
"name": "stylelint-config-wikimedia",
"severity": "moderate",
"isDirect": true,
"via": [
"stylelint"
],
"effects": [],
"range": "<=0.11.1",
"nodes": [
"node_modules/stylelint-config-wikimedia"
],
"fixAvailable": {
"name": "stylelint-config-wikimedia",
"version": "0.18.0",
"isSemVerMajor": true
}
},
"sugarss": {
"name": "sugarss",
"severity": "moderate",
"isDirect": false,
"via": [
"postcss"
],
"effects": [],
"range": "<=2.0.0",
"nodes": [
"node_modules/sugarss"
],
"fixAvailable": true
},
"taffydb": {
"name": "taffydb",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1089386,
"name": "taffydb",
"dependency": "taffydb",
"title": "TaffyDB can allow access to any data items in the DB",
"url": "https://github.com/advisories/GHSA-mxhp-79qh-mcx6",
"severity": "high",
"cwe": [
"CWE-20",
"CWE-668"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
"range": "<=2.7.3"
}
],
"effects": [
"jsdoc"
],
"range": "*",
"nodes": [
"node_modules/taffydb"
],
"fixAvailable": {
"name": "jsdoc",
"version": "3.6.11",
"isSemVerMajor": false
}
},
"tar": {
"name": "tar",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1097493,
"name": "tar",
"dependency": "tar",
"title": "Denial of service while parsing a tar file due to lack of folders count validation",
"url": "https://github.com/advisories/GHSA-f5x3-32g6-xq36",
"severity": "moderate",
"cwe": [
"CWE-400"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
"range": "<6.2.1"
}
],
"effects": [],
"range": "<6.2.1",
"nodes": [
"node_modules/tar"
],
"fixAvailable": true
},
"tar-fs": {
"name": "tar-fs",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1106930,
"name": "tar-fs",
"dependency": "tar-fs",
"title": "tar-fs can extract outside the specified dir with a specific tarball",
"url": "https://github.com/advisories/GHSA-8cj5-5rvv-wf4v",
"severity": "high",
"cwe": [
"CWE-22"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=2.0.0 <2.1.3"
},
{
"source": 1108293,
"name": "tar-fs",
"dependency": "tar-fs",
"title": "tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball",
"url": "https://github.com/advisories/GHSA-vj76-c3g6-qr5v",
"severity": "high",
"cwe": [
"CWE-22",
"CWE-61"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=2.0.0 <2.1.4"
},
{
"source": 1108411,
"name": "tar-fs",
"dependency": "tar-fs",
"title": "tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File",
"url": "https://github.com/advisories/GHSA-pq67-2wwv-3xjx",
"severity": "high",
"cwe": [
"CWE-22"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
},
"range": ">=2.0.0 <2.1.2"
}
],
"effects": [],
"range": "2.0.0 - 2.1.3",
"nodes": [
"node_modules/tar-fs"
],
"fixAvailable": true
},
"telejson": {
"name": "telejson",
"severity": "low",
"isDirect": false,
"via": [
"global"
],
"effects": [
"@storybook/channel-postmessage",
"@storybook/core-server"
],
"range": "<=6.0.8",
"nodes": [
"node_modules/telejson"
],
"fixAvailable": {
"name": "@storybook/addon-actions",
"version": "9.0.8",
"isSemVerMajor": true
}
},
"terser": {
"name": "terser",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1091691,
"name": "terser",
"dependency": "terser",
"title": "Terser insecure use of regular expressions leads to ReDoS",
"url": "https://github.com/advisories/GHSA-4wf5-vphf-c2xc",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<4.8.1"
}
],
"effects": [],
"range": "<4.8.1",
"nodes": [
"node_modules/terser"
],
"fixAvailable": true
},
"terser-webpack-plugin": {
"name": "terser-webpack-plugin",
"severity": "moderate",
"isDirect": false,
"via": [
"webpack"
],
"effects": [
"webpack"
],
"range": "<=2.2.1",
"nodes": [
"node_modules/webpack/node_modules/terser-webpack-plugin"
],
"fixAvailable": {
"name": "webpack",
"version": "5.102.0",
"isSemVerMajor": true
}
},
"tmp": {
"name": "tmp",
"severity": "low",
"isDirect": false,
"via": [
{
"source": 1106849,
"name": "tmp",
"dependency": "tmp",
"title": "tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter",
"url": "https://github.com/advisories/GHSA-52f5-9888-hmc6",
"severity": "low",
"cwe": [
"CWE-59"
],
"cvss": {
"score": 2.5,
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"
},
"range": "<=0.2.3"
}
],
"effects": [
"external-editor"
],
"range": "<=0.2.3",
"nodes": [
"node_modules/external-editor/node_modules/tmp"
],
"fixAvailable": {
"name": "eslint-config-wikimedia",
"version": "0.31.0",
"isSemVerMajor": true
}
},
"tough-cookie": {
"name": "tough-cookie",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1097682,
"name": "tough-cookie",
"dependency": "tough-cookie",
"title": "tough-cookie Prototype Pollution vulnerability",
"url": "https://github.com/advisories/GHSA-72xf-g2v4-qvf3",
"severity": "moderate",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
},
"range": "<4.1.3"
}
],
"effects": [
"jsdom",
"request",
"request-promise-native"
],
"range": "<4.1.3",
"nodes": [
"node_modules/tough-cookie"
],
"fixAvailable": {
"name": "jsdom",
"version": "27.0.0",
"isSemVerMajor": true
}
},
"watchpack": {
"name": "watchpack",
"severity": "high",
"isDirect": false,
"via": [
"watchpack-chokidar2"
],
"effects": [],
"range": "1.7.2 - 1.7.5",
"nodes": [
"node_modules/watchpack"
],
"fixAvailable": true
},
"watchpack-chokidar2": {
"name": "watchpack-chokidar2",
"severity": "high",
"isDirect": false,
"via": [
"chokidar"
],
"effects": [
"watchpack"
],
"range": "*",
"nodes": [
"node_modules/watchpack-chokidar2"
],
"fixAvailable": true
},
"webpack": {
"name": "webpack",
"severity": "moderate",
"isDirect": true,
"via": [
"micromatch",
"terser-webpack-plugin"
],
"effects": [
"@storybook/core-common",
"@storybook/core-server",
"terser-webpack-plugin",
"webpack-cli"
],
"range": "4.0.0-alpha.0 - 5.0.0-rc.6",
"nodes": [
"node_modules/webpack"
],
"fixAvailable": {
"name": "webpack",
"version": "5.102.0",
"isSemVerMajor": true
}
},
"webpack-cli": {
"name": "webpack-cli",
"severity": "high",
"isDirect": true,
"via": [
"cross-spawn",
"findup-sync",
"loader-utils",
"webpack"
],
"effects": [],
"range": "<=0.0.8-development || 1.3.0 - 2.0.9 || 2.0.11 - 4.0.0-rc.1",
"nodes": [
"node_modules/webpack-cli"
],
"fixAvailable": {
"name": "webpack-cli",
"version": "3.3.12",
"isSemVerMajor": false
}
},
"webpack-dev-middleware": {
"name": "webpack-dev-middleware",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1096729,
"name": "webpack-dev-middleware",
"dependency": "webpack-dev-middleware",
"title": "Path traversal in webpack-dev-middleware",
"url": "https://github.com/advisories/GHSA-wr3j-pwj9-hqq6",
"severity": "high",
"cwe": [
"CWE-22"
],
"cvss": {
"score": 7.4,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N"
},
"range": "<=5.3.3"
}
],
"effects": [
"@storybook/core-server"
],
"range": "<=5.3.3",
"nodes": [
"node_modules/webpack-dev-middleware"
],
"fixAvailable": true
},
"word-wrap": {
"name": "word-wrap",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1102444,
"name": "word-wrap",
"dependency": "word-wrap",
"title": "word-wrap vulnerable to Regular Expression Denial of Service",
"url": "https://github.com/advisories/GHSA-j8xg-fqg3-53r7",
"severity": "moderate",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": "<1.2.4"
}
],
"effects": [],
"range": "<1.2.4",
"nodes": [
"node_modules/word-wrap"
],
"fixAvailable": true
},
"ws": {
"name": "ws",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1098394,
"name": "ws",
"dependency": "ws",
"title": "ws affected by a DoS when handling a request with many HTTP headers",
"url": "https://github.com/advisories/GHSA-3h5v-q93c-6h6q",
"severity": "high",
"cwe": [
"CWE-476"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=6.0.0 <6.2.3"
}
],
"effects": [],
"range": "6.0.0 - 6.2.2",
"nodes": [
"node_modules/ws"
],
"fixAvailable": true
}
},
"metadata": {
"vulnerabilities": {
"info": 0,
"low": 19,
"moderate": 48,
"high": 41,
"critical": 14,
"total": 122
},
"dependencies": {
"prod": 2,
"dev": 2059,
"optional": 31,
"peer": 1,
"peerOptional": 0,
"total": 2060
}
}
}
--- end ---
Attempting to npm audit fix
$ /usr/bin/npm audit fix --dry-run --only=dev --json
--- stderr ---
npm WARN invalid config only="dev" set in command line options
npm WARN invalid config Must be one of: null, prod, production
npm WARN ERESOLVE overriding peer dependency
npm WARN While resolving: babel-loader@8.2.3
npm WARN Found: webpack@4.43.0
npm WARN node_modules/webpack
npm WARN dev webpack@"4.43.0" from the root project
npm WARN 24 more (@storybook/builder-webpack4, babel-loader, ...)
npm WARN
npm WARN Could not resolve dependency:
npm WARN peer webpack@">=2" from babel-loader@8.2.3
npm WARN node_modules/@storybook/builder-webpack4/node_modules/babel-loader
npm WARN babel-loader@"^8.2.2" from @storybook/builder-webpack4@6.2.3
npm WARN node_modules/@storybook/builder-webpack4
npm WARN
npm WARN Conflicting peer dependency: webpack@5.102.0
npm WARN node_modules/webpack
npm WARN peer webpack@">=2" from babel-loader@8.2.3
npm WARN node_modules/@storybook/builder-webpack4/node_modules/babel-loader
npm WARN babel-loader@"^8.2.2" from @storybook/builder-webpack4@6.2.3
npm WARN node_modules/@storybook/builder-webpack4
npm WARN ERESOLVE overriding peer dependency
npm WARN While resolving: babel-loader@8.2.3
npm WARN Found: webpack@4.43.0
npm WARN node_modules/webpack
npm WARN dev webpack@"4.43.0" from the root project
npm WARN 24 more (@storybook/builder-webpack4, babel-loader, ...)
npm WARN
npm WARN Could not resolve dependency:
npm WARN peer webpack@">=2" from babel-loader@8.2.3
npm WARN node_modules/@storybook/core-common/node_modules/babel-loader
npm WARN babel-loader@"^8.2.2" from @storybook/core-common@6.2.3
npm WARN node_modules/@storybook/core-common
npm WARN
npm WARN Conflicting peer dependency: webpack@5.102.0
npm WARN node_modules/webpack
npm WARN peer webpack@">=2" from babel-loader@8.2.3
npm WARN node_modules/@storybook/core-common/node_modules/babel-loader
npm WARN babel-loader@"^8.2.2" from @storybook/core-common@6.2.3
npm WARN node_modules/@storybook/core-common
npm WARN ERESOLVE overriding peer dependency
npm WARN While resolving: babel-loader@8.2.3
npm WARN Found: webpack@4.43.0
npm WARN node_modules/webpack
npm WARN dev webpack@"4.43.0" from the root project
npm WARN 24 more (@storybook/builder-webpack4, babel-loader, ...)
npm WARN
npm WARN Could not resolve dependency:
npm WARN peer webpack@">=2" from babel-loader@8.2.3
npm WARN node_modules/@storybook/core-server/node_modules/babel-loader
npm WARN babel-loader@"^8.2.2" from @storybook/core-server@6.2.3
npm WARN node_modules/@storybook/core-server
npm WARN
npm WARN Conflicting peer dependency: webpack@5.102.0
npm WARN node_modules/webpack
npm WARN peer webpack@">=2" from babel-loader@8.2.3
npm WARN node_modules/@storybook/core-server/node_modules/babel-loader
npm WARN babel-loader@"^8.2.2" from @storybook/core-server@6.2.3
npm WARN node_modules/@storybook/core-server
npm WARN ERESOLVE overriding peer dependency
npm WARN While resolving: @babel/helper-define-polyfill-provider@0.2.4
npm WARN Found: @babel/core@7.2.2
npm WARN node_modules/@babel/core
npm WARN dev @babel/core@"7.2.2" from the root project
npm WARN 85 more (@babel/helper-compilation-targets, ...)
npm WARN
npm WARN Could not resolve dependency:
npm WARN peer @babel/core@"^7.4.0-0" from @babel/helper-define-polyfill-provider@0.2.4
npm WARN node_modules/babel-plugin-polyfill-corejs2/node_modules/@babel/helper-define-polyfill-provider
npm WARN @babel/helper-define-polyfill-provider@"^0.2.4" from babel-plugin-polyfill-corejs2@0.2.3
npm WARN node_modules/babel-plugin-polyfill-corejs2
npm WARN
npm WARN Conflicting peer dependency: @babel/core@7.28.4
npm WARN node_modules/@babel/core
npm WARN peer @babel/core@"^7.4.0-0" from @babel/helper-define-polyfill-provider@0.2.4
npm WARN node_modules/babel-plugin-polyfill-corejs2/node_modules/@babel/helper-define-polyfill-provider
npm WARN @babel/helper-define-polyfill-provider@"^0.2.4" from babel-plugin-polyfill-corejs2@0.2.3
npm WARN node_modules/babel-plugin-polyfill-corejs2
npm WARN ERESOLVE overriding peer dependency
npm WARN While resolving: @babel/helper-define-polyfill-provider@0.1.5
npm WARN Found: @babel/core@7.2.2
npm WARN node_modules/@babel/core
npm WARN dev @babel/core@"7.2.2" from the root project
npm WARN 85 more (@babel/helper-compilation-targets, ...)
npm WARN
npm WARN Could not resolve dependency:
npm WARN peer @babel/core@"^7.4.0-0" from @babel/helper-define-polyfill-provider@0.1.5
npm WARN node_modules/babel-plugin-polyfill-corejs3/node_modules/@babel/helper-define-polyfill-provider
npm WARN @babel/helper-define-polyfill-provider@"^0.1.5" from babel-plugin-polyfill-corejs3@0.1.7
npm WARN node_modules/babel-plugin-polyfill-corejs3
npm WARN
npm WARN Conflicting peer dependency: @babel/core@7.28.4
npm WARN node_modules/@babel/core
npm WARN peer @babel/core@"^7.4.0-0" from @babel/helper-define-polyfill-provider@0.1.5
npm WARN node_modules/babel-plugin-polyfill-corejs3/node_modules/@babel/helper-define-polyfill-provider
npm WARN @babel/helper-define-polyfill-provider@"^0.1.5" from babel-plugin-polyfill-corejs3@0.1.7
npm WARN node_modules/babel-plugin-polyfill-corejs3
npm WARN ERESOLVE overriding peer dependency
npm WARN While resolving: @babel/helper-define-polyfill-provider@0.2.4
npm WARN Found: @babel/core@7.2.2
npm WARN node_modules/@babel/core
npm WARN dev @babel/core@"7.2.2" from the root project
npm WARN 85 more (@babel/helper-compilation-targets, ...)
npm WARN
npm WARN Could not resolve dependency:
npm WARN peer @babel/core@"^7.4.0-0" from @babel/helper-define-polyfill-provider@0.2.4
npm WARN node_modules/babel-plugin-polyfill-regenerator/node_modules/@babel/helper-define-polyfill-provider
npm WARN @babel/helper-define-polyfill-provider@"^0.2.4" from babel-plugin-polyfill-regenerator@0.2.3
npm WARN node_modules/babel-plugin-polyfill-regenerator
npm WARN
npm WARN Conflicting peer dependency: @babel/core@7.28.4
npm WARN node_modules/@babel/core
npm WARN peer @babel/core@"^7.4.0-0" from @babel/helper-define-polyfill-provider@0.2.4
npm WARN node_modules/babel-plugin-polyfill-regenerator/node_modules/@babel/helper-define-polyfill-provider
npm WARN @babel/helper-define-polyfill-provider@"^0.2.4" from babel-plugin-polyfill-regenerator@0.2.3
npm WARN node_modules/babel-plugin-polyfill-regenerator
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: undefined,
npm WARN EBADENGINE required: { node: '12.22.5' },
npm WARN EBADENGINE current: { node: 'v20.19.2', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: '@es-joy/jsdoccomment@0.12.0',
npm WARN EBADENGINE required: { node: '^12 || ^14 || ^16 || ^17' },
npm WARN EBADENGINE current: { node: 'v20.19.2', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: 'eslint-plugin-jsdoc@37.0.3',
npm WARN EBADENGINE required: { node: '^12 || ^14 || ^16 || ^17' },
npm WARN EBADENGINE current: { node: 'v20.19.2', npm: '9.2.0' }
npm WARN EBADENGINE }
--- stdout ---
{
"added": 2088,
"removed": 0,
"changed": 0,
"audited": 2089,
"funding": 213,
"audit": {
"auditReportVersion": 2,
"vulnerabilities": {
"@babel/helpers": {
"name": "@babel/helpers",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1104001,
"name": "@babel/helpers",
"dependency": "@babel/helpers",
"title": "Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups",
"url": "https://github.com/advisories/GHSA-968p-4wvh-cqc8",
"severity": "moderate",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 6.2,
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<7.26.10"
}
],
"effects": [],
"range": "<7.26.10",
"nodes": [
""
],
"fixAvailable": true
},
"@babel/runtime": {
"name": "@babel/runtime",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1104000,
"name": "@babel/runtime",
"dependency": "@babel/runtime",
"title": "Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups",
"url": "https://github.com/advisories/GHSA-968p-4wvh-cqc8",
"severity": "moderate",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 6.2,
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<7.26.10"
}
],
"effects": [],
"range": "<7.26.10",
"nodes": [
""
],
"fixAvailable": true
},
"@babel/traverse": {
"name": "@babel/traverse",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1096886,
"name": "@babel/traverse",
"dependency": "@babel/traverse",
"title": "Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code",
"url": "https://github.com/advisories/GHSA-67hx-6x53-jw92",
"severity": "critical",
"cwe": [
"CWE-184",
"CWE-697"
],
"cvss": {
"score": 9.4,
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
},
"range": "<7.23.2"
}
],
"effects": [],
"range": "<7.23.2",
"nodes": [
""
],
"fixAvailable": true
},
"@storybook/addon-actions": {
"name": "@storybook/addon-actions",
"severity": "low",
"isDirect": true,
"via": [
"@storybook/addons",
"@storybook/api",
"@storybook/client-api",
"@storybook/components",
"@storybook/theming",
"global"
],
"effects": [],
"range": "3.3.0-alpha.0 - 7.0.0-rc.11",
"nodes": [
"node_modules/@storybook/addon-actions"
],
"fixAvailable": {
"name": "@storybook/addon-actions",
"version": "9.0.8",
"isSemVerMajor": true
}
},
"@storybook/addons": {
"name": "@storybook/addons",
"severity": "low",
"isDirect": false,
"via": [
"@storybook/api",
"@storybook/client-logger",
"@storybook/router",
"@storybook/theming",
"global"
],
"effects": [
"@storybook/addon-actions",
"@storybook/html",
"@storybook/ui"
],
"range": "4.0.0-alpha.0 - 7.0.0-rc.11",
"nodes": [
"node_modules/@storybook/addons"
],
"fixAvailable": {
"name": "@storybook/addon-actions",
"version": "9.0.8",
"isSemVerMajor": true
}
},
"@storybook/api": {
"name": "@storybook/api",
"severity": "low",
"isDirect": false,
"via": [
"@storybook/client-logger",
"@storybook/router",
"@storybook/theming",
"global",
"telejson"
],
"effects": [
"@storybook/addon-actions",
"@storybook/addons",
"@storybook/ui"
],
"range": "<=7.0.0-rc.11",
"nodes": [
"node_modules/@storybook/api"
],
"fixAvailable": {
"name": "@storybook/addon-actions",
"version": "9.0.8",
"isSemVerMajor": true
}
},
"@storybook/builder-webpack4": {
"name": "@storybook/builder-webpack4",
"severity": "high",
"isDirect": false,
"via": [
"@storybook/addons",
"@storybook/api",
"@storybook/channel-postmessage",
"@storybook/client-api",
"@storybook/client-logger",
"@storybook/components",
"@storybook/core-common",
"@storybook/router",
"@storybook/theming",
"@storybook/ui",
"autoprefixer",
"css-loader",
"fork-ts-checker-webpack-plugin",
"global",
"postcss",
"postcss-flexbugs-fixes",
"react-dev-utils",
"webpack",
"webpack-dev-middleware"
],
"effects": [],
"range": "*",
"nodes": [
"node_modules/@storybook/builder-webpack4"
],
"fixAvailable": true
},
"@storybook/channel-postmessage": {
"name": "@storybook/channel-postmessage",
"severity": "low",
"isDirect": false,
"via": [
"@storybook/client-logger",
"global",
"telejson"
],
"effects": [
"@storybook/client-api"
],
"range": "3.1.2 - 7.0.0-rc.11",
"nodes": [
"node_modules/@storybook/channel-postmessage"
],
"fixAvailable": {
"name": "@storybook/addon-actions",
"version": "9.0.8",
"isSemVerMajor": true
}
},
"@storybook/client-api": {
"name": "@storybook/client-api",
"severity": "low",
"isDirect": false,
"via": [
"@storybook/addons",
"@storybook/channel-postmessage",
"@storybook/client-logger",
"global"
],
"effects": [
"@storybook/addon-actions",
"@storybook/html"
],
"range": "<=7.0.0-rc.11",
"nodes": [
"node_modules/@storybook/client-api"
],
"fixAvailable": {
"name": "@storybook/addon-actions",
"version": "9.0.8",
"isSemVerMajor": true
}
},
"@storybook/client-logger": {
"name": "@storybook/client-logger",
"severity": "low",
"isDirect": false,
"via": [
"global"
],
"effects": [
"@storybook/addons",
"@storybook/api",
"@storybook/channel-postmessage",
"@storybook/client-api",
"@storybook/components",
"@storybook/router",
"@storybook/theming",
"@storybook/ui"
],
"range": "6.0.0-alpha.0 - 7.0.0-rc.11",
"nodes": [
"node_modules/@storybook/client-logger"
],
"fixAvailable": {
"name": "@storybook/addon-actions",
"version": "9.0.8",
"isSemVerMajor": true
}
},
"@storybook/components": {
"name": "@storybook/components",
"severity": "moderate",
"isDirect": false,
"via": [
"@storybook/client-logger",
"@storybook/theming",
"global",
"react-syntax-highlighter"
],
"effects": [
"@storybook/addon-actions",
"@storybook/builder-webpack4",
"@storybook/ui"
],
"range": "4.0.0-alpha.0 - 7.0.0-rc.11",
"nodes": [
"node_modules/@storybook/components"
],
"fixAvailable": {
"name": "@storybook/addon-actions",
"version": "9.0.8",
"isSemVerMajor": true
}
},
"@storybook/core": {
"name": "@storybook/core",
"severity": "high",
"isDirect": false,
"via": [
"@storybook/core-client",
"@storybook/core-server"
],
"effects": [],
"range": "6.2.0-alpha.0 - 6.5.17-alpha.0",
"nodes": [
"node_modules/@storybook/core"
],
"fixAvailable": true
},
"@storybook/core-client": {
"name": "@storybook/core-client",
"severity": "moderate",
"isDirect": false,
"via": [
"@storybook/addons",
"@storybook/channel-postmessage",
"@storybook/client-api",
"@storybook/client-logger",
"@storybook/ui",
"global"
],
"effects": [
"@storybook/core",
"@storybook/core-server"
],
"range": "<=7.0.0-rc.11",
"nodes": [
"node_modules/@storybook/core-client"
],
"fixAvailable": true
},
"@storybook/core-common": {
"name": "@storybook/core-common",
"severity": "moderate",
"isDirect": false,
"via": [
"webpack"
],
"effects": [
"@storybook/html"
],
"range": "<=6.5.17-alpha.0",
"nodes": [
"node_modules/@storybook/core-common"
],
"fixAvailable": {
"name": "@storybook/html",
"version": "9.1.10",
"isSemVerMajor": true
}
},
"@storybook/core-server": {
"name": "@storybook/core-server",
"severity": "high",
"isDirect": false,
"via": [
"@storybook/addons",
"@storybook/builder-webpack4",
"@storybook/core-client",
"@storybook/core-common",
"@storybook/theming",
"@storybook/ui",
"cpy",
"css-loader",
"global",
"ip",
"telejson",
"webpack",
"webpack-dev-middleware"
],
"effects": [
"@storybook/core"
],
"range": "<=7.6.19 || 8.0.0-alpha.0 - 8.1.5 || 8.2.0-alpha.0 - 8.2.0-beta.3",
"nodes": [
"node_modules/@storybook/core-server"
],
"fixAvailable": true
},
"@storybook/html": {
"name": "@storybook/html",
"severity": "high",
"isDirect": true,
"via": [
"@storybook/addons",
"@storybook/client-api",
"@storybook/core",
"@storybook/core-common",
"global"
],
"effects": [],
"range": "<=7.0.0-rc.11",
"nodes": [
"node_modules/@storybook/html"
],
"fixAvailable": {
"name": "@storybook/html",
"version": "9.1.10",
"isSemVerMajor": true
}
},
"@storybook/router": {
"name": "@storybook/router",
"severity": "low",
"isDirect": false,
"via": [
"@storybook/client-logger",
"global"
],
"effects": [
"@storybook/addons",
"@storybook/api",
"@storybook/ui"
],
"range": "<=7.0.0-rc.11",
"nodes": [
"node_modules/@storybook/router"
],
"fixAvailable": {
"name": "@storybook/addon-actions",
"version": "9.0.8",
"isSemVerMajor": true
}
},
"@storybook/theming": {
"name": "@storybook/theming",
"severity": "low",
"isDirect": false,
"via": [
"@storybook/client-logger",
"global"
],
"effects": [
"@storybook/addon-actions",
"@storybook/components"
],
"range": "<=7.0.0-rc.11",
"nodes": [
"node_modules/@storybook/theming"
],
"fixAvailable": {
"name": "@storybook/addon-actions",
"version": "9.0.8",
"isSemVerMajor": true
}
},
"@storybook/ui": {
"name": "@storybook/ui",
"severity": "moderate",
"isDirect": false,
"via": [
"@storybook/addons",
"@storybook/api",
"@storybook/client-logger",
"@storybook/components",
"@storybook/router",
"@storybook/theming",
"global",
"markdown-to-jsx"
],
"effects": [
"@storybook/builder-webpack4",
"@storybook/core-client"
],
"range": "3.1.0 - 7.0.0-alpha.10",
"nodes": [
"node_modules/@storybook/ui"
],
"fixAvailable": true
},
"@wikimedia/mw-node-qunit": {
"name": "@wikimedia/mw-node-qunit",
"severity": "moderate",
"isDirect": true,
"via": [
"eslint-config-wikimedia",
"jsdom",
"qunit"
],
"effects": [],
"range": "<=6.2.1",
"nodes": [
"node_modules/@wikimedia/mw-node-qunit"
],
"fixAvailable": {
"name": "@wikimedia/mw-node-qunit",
"version": "6.4.2",
"isSemVerMajor": false
}
},
"ansi-regex": {
"name": "ansi-regex",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1094091,
"name": "ansi-regex",
"dependency": "ansi-regex",
"title": "Inefficient Regular Expression Complexity in chalk/ansi-regex",
"url": "https://github.com/advisories/GHSA-93q8-gq69-wqmw",
"severity": "high",
"cwe": [
"CWE-697",
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=4.0.0 <4.1.1"
}
],
"effects": [],
"range": "4.0.0 - 4.1.0",
"nodes": [
"",
""
],
"fixAvailable": true
},
"anymatch": {
"name": "anymatch",
"severity": "moderate",
"isDirect": false,
"via": [
"micromatch"
],
"effects": [
"chokidar",
"sane"
],
"range": "1.2.0 - 2.0.0",
"nodes": [
"node_modules/sane/node_modules/anymatch",
"node_modules/watchpack-chokidar2/node_modules/anymatch"
],
"fixAvailable": {
"name": "@wikimedia/mw-node-qunit",
"version": "6.4.2",
"isSemVerMajor": false
}
},
"autoprefixer": {
"name": "autoprefixer",
"severity": "moderate",
"isDirect": false,
"via": [
"postcss"
],
"effects": [
"stylelint"
],
"range": "1.0.20131222 - 9.8.8",
"nodes": [
"node_modules/autoprefixer"
],
"fixAvailable": {
"name": "stylelint-config-wikimedia",
"version": "0.18.0",
"isSemVerMajor": true
}
},
"axios": {
"name": "axios",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1097679,
"name": "axios",
"dependency": "axios",
"title": "Axios Cross-Site Request Forgery Vulnerability",
"url": "https://github.com/advisories/GHSA-wf5p-g6vw-rhxx",
"severity": "moderate",
"cwe": [
"CWE-352"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
},
"range": ">=0.8.1 <0.28.0"
},
{
"source": 1103617,
"name": "axios",
"dependency": "axios",
"title": "axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL",
"url": "https://github.com/advisories/GHSA-jr5f-v2jv-69x6",
"severity": "high",
"cwe": [
"CWE-918"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<0.30.0"
},
{
"source": 1108262,
"name": "axios",
"dependency": "axios",
"title": "Axios is vulnerable to DoS attack through lack of data size check",
"url": "https://github.com/advisories/GHSA-4hjh-wcwx-xvwj",
"severity": "high",
"cwe": [
"CWE-770"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<0.30.2"
}
],
"effects": [
"bundlesize",
"github-build"
],
"range": "<=0.30.1",
"nodes": [
"",
"node_modules/axios"
],
"fixAvailable": {
"name": "bundlesize",
"version": "0.18.2",
"isSemVerMajor": false
}
},
"body-parser": {
"name": "body-parser",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1099520,
"name": "body-parser",
"dependency": "body-parser",
"title": "body-parser vulnerable to denial of service when url encoding is enabled",
"url": "https://github.com/advisories/GHSA-qwcr-r2fm-qrc7",
"severity": "high",
"cwe": [
"CWE-405"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<1.20.3"
},
"qs"
],
"effects": [
"express"
],
"range": "<=1.20.2",
"nodes": [
""
],
"fixAvailable": true
},
"brace-expansion": {
"name": "brace-expansion",
"severity": "low",
"isDirect": false,
"via": [
{
"source": 1105443,
"name": "brace-expansion",
"dependency": "brace-expansion",
"title": "brace-expansion Regular Expression Denial of Service vulnerability",
"url": "https://github.com/advisories/GHSA-v6h2-p8h4-qcjw",
"severity": "low",
"cwe": [
"CWE-400"
],
"cvss": {
"score": 3.1,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L"
},
"range": ">=1.0.0 <=1.1.11"
}
],
"effects": [],
"range": "1.0.0 - 1.1.11",
"nodes": [
""
],
"fixAvailable": true
},
"braces": {
"name": "braces",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1098094,
"name": "braces",
"dependency": "braces",
"title": "Uncontrolled resource consumption in braces",
"url": "https://github.com/advisories/GHSA-grv7-fg5c-xmjg",
"severity": "high",
"cwe": [
"CWE-400",
"CWE-1050"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<3.0.3"
}
],
"effects": [
"chokidar",
"micromatch"
],
"range": "<3.0.3",
"nodes": [
"",
"node_modules/@storybook/builder-webpack4/node_modules/braces",
"node_modules/fast-glob/node_modules/braces",
"node_modules/findup-sync/node_modules/braces",
"node_modules/react-dev-utils/node_modules/micromatch/node_modules/braces",
"node_modules/sane/node_modules/braces",
"node_modules/watchpack-chokidar2/node_modules/braces",
"node_modules/webpack-cli/node_modules/braces",
"node_modules/webpack/node_modules/braces"
],
"fixAvailable": {
"name": "webpack",
"version": "5.102.0",
"isSemVerMajor": true
}
},
"browserify-sign": {
"name": "browserify-sign",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1102445,
"name": "browserify-sign",
"dependency": "browserify-sign",
"title": "browserify-sign upper bound check issue in `dsaVerify` leads to a signature forgery attack",
"url": "https://github.com/advisories/GHSA-x9w5-v3q2-3rhw",
"severity": "high",
"cwe": [
"CWE-347"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
},
"range": ">=2.6.0 <=4.2.1"
}
],
"effects": [],
"range": "2.6.0 - 4.2.1",
"nodes": [
""
],
"fixAvailable": true
},
"browserslist": {
"name": "browserslist",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1093035,
"name": "browserslist",
"dependency": "browserslist",
"title": "Regular Expression Denial of Service in browserslist",
"url": "https://github.com/advisories/GHSA-w8qv-6jwh-64r5",
"severity": "moderate",
"cwe": [
"CWE-400",
"CWE-1333"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": ">=4.0.0 <4.16.5"
}
],
"effects": [
"react-dev-utils"
],
"range": "4.0.0 - 4.16.4",
"nodes": [
"node_modules/react-dev-utils/node_modules/browserslist"
],
"fixAvailable": true
},
"bundlesize": {
"name": "bundlesize",
"severity": "high",
"isDirect": true,
"via": [
"axios"
],
"effects": [],
"range": "0.3.0 - 0.18.1 || >=1.0.0-beta.1",
"nodes": [
"node_modules/bundlesize"
],
"fixAvailable": {
"name": "bundlesize",
"version": "0.18.2",
"isSemVerMajor": false
}
},
"chokidar": {
"name": "chokidar",
"severity": "high",
"isDirect": false,
"via": [
"anymatch",
"braces",
"readdirp"
],
"effects": [
"watchpack-chokidar2"
],
"range": "1.3.0 - 2.1.8",
"nodes": [
"node_modules/watchpack-chokidar2/node_modules/chokidar"
],
"fixAvailable": true
},
"cipher-base": {
"name": "cipher-base",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1107538,
"name": "cipher-base",
"dependency": "cipher-base",
"title": "cipher-base is missing type checks, leading to hash rewind and passing on crafted data",
"url": "https://github.com/advisories/GHSA-cpq7-6gpm-g9rc",
"severity": "critical",
"cwe": [
"CWE-20"
],
"cvss": {
"score": 9.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
},
"range": "<=1.0.4"
}
],
"effects": [],
"range": "<=1.0.4",
"nodes": [
""
],
"fixAvailable": true
},
"cookie": {
"name": "cookie",
"severity": "low",
"isDirect": false,
"via": [
{
"source": 1103907,
"name": "cookie",
"dependency": "cookie",
"title": "cookie accepts cookie name, path, and domain with out of bounds characters",
"url": "https://github.com/advisories/GHSA-pxg6-pf52-xh8x",
"severity": "low",
"cwe": [
"CWE-74"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<0.7.0"
}
],
"effects": [
"express"
],
"range": "<0.7.0",
"nodes": [
""
],
"fixAvailable": true
},
"core-js-compat": {
"name": "core-js-compat",
"severity": "high",
"isDirect": false,
"via": [
"semver"
],
"effects": [],
"range": "3.6.0 - 3.25.0",
"nodes": [
""
],
"fixAvailable": true
},
"cpy": {
"name": "cpy",
"severity": "moderate",
"isDirect": false,
"via": [
"globby"
],
"effects": [
"@storybook/core-server"
],
"range": "7.0.0 - 8.1.2",
"nodes": [
"node_modules/cpy"
],
"fixAvailable": true
},
"cross-spawn": {
"name": "cross-spawn",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1104663,
"name": "cross-spawn",
"dependency": "cross-spawn",
"title": "Regular Expression Denial of Service (ReDoS) in cross-spawn",
"url": "https://github.com/advisories/GHSA-3xgq-45jj-v275",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<6.0.6"
},
{
"source": 1104664,
"name": "cross-spawn",
"dependency": "cross-spawn",
"title": "Regular Expression Denial of Service (ReDoS) in cross-spawn",
"url": "https://github.com/advisories/GHSA-3xgq-45jj-v275",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=7.0.0 <7.0.5"
}
],
"effects": [
"pre-commit",
"react-dev-utils",
"webpack-cli"
],
"range": "<6.0.6 || >=7.0.0 <7.0.5",
"nodes": [
"",
"",
"",
"",
"node_modules/cross-spawn",
"node_modules/react-dev-utils/node_modules/cross-spawn"
],
"fixAvailable": {
"name": "pre-commit",
"version": "1.0.10",
"isSemVerMajor": true
}
},
"css-loader": {
"name": "css-loader",
"severity": "moderate",
"isDirect": false,
"via": [
"icss-utils",
"postcss",
"postcss-modules-extract-imports",
"postcss-modules-local-by-default",
"postcss-modules-scope",
"postcss-modules-values"
],
"effects": [],
"range": "0.15.0 - 4.3.0",
"nodes": [
"node_modules/css-loader"
],
"fixAvailable": true
},
"decode-uri-component": {
"name": "decode-uri-component",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1094087,
"name": "decode-uri-component",
"dependency": "decode-uri-component",
"title": "decode-uri-component vulnerable to Denial of Service (DoS)",
"url": "https://github.com/advisories/GHSA-w573-4hg7-7wgq",
"severity": "high",
"cwe": [
"CWE-20"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<0.2.1"
}
],
"effects": [],
"range": "<0.2.1",
"nodes": [
""
],
"fixAvailable": true
},
"elliptic": {
"name": "elliptic",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1098593,
"name": "elliptic",
"dependency": "elliptic",
"title": "Elliptic's EDDSA missing signature length check",
"url": "https://github.com/advisories/GHSA-f7q4-pwc6-w24p",
"severity": "low",
"cwe": [
"CWE-347"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
},
"range": ">=4.0.0 <=6.5.6"
},
{
"source": 1098594,
"name": "elliptic",
"dependency": "elliptic",
"title": "Elliptic's ECDSA missing check for whether leading bit of r and s is zero",
"url": "https://github.com/advisories/GHSA-977x-g7h5-7qgw",
"severity": "low",
"cwe": [
"CWE-130"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
},
"range": ">=2.0.0 <=6.5.6"
},
{
"source": 1098595,
"name": "elliptic",
"dependency": "elliptic",
"title": "Elliptic allows BER-encoded signatures",
"url": "https://github.com/advisories/GHSA-49q7-c7j4-3p7m",
"severity": "low",
"cwe": [
"CWE-347"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
},
"range": ">=5.2.1 <=6.5.6"
},
{
"source": 1101424,
"name": "elliptic",
"dependency": "elliptic",
"title": "Elliptic's verify function omits uniqueness validation",
"url": "https://github.com/advisories/GHSA-434g-2637-qmqr",
"severity": "low",
"cwe": [
"CWE-347"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
"range": "<6.5.6"
},
{
"source": 1102901,
"name": "elliptic",
"dependency": "elliptic",
"title": "Elliptic's private key extraction in ECDSA upon signing a malformed input (e.g. a string)",
"url": "https://github.com/advisories/GHSA-vjh7-7g9h-fjfh",
"severity": "critical",
"cwe": [
"CWE-200"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<=6.6.0"
},
{
"source": 1105750,
"name": "elliptic",
"dependency": "elliptic",
"title": "Valid ECDSA signatures erroneously rejected in Elliptic",
"url": "https://github.com/advisories/GHSA-fc9h-whq2-v747",
"severity": "low",
"cwe": [
"CWE-347"
],
"cvss": {
"score": 4.8,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"
},
"range": "<6.6.0"
}
],
"effects": [],
"range": "<=6.6.0",
"nodes": [
""
],
"fixAvailable": true
},
"eslint": {
"name": "eslint",
"severity": "low",
"isDirect": false,
"via": [
"inquirer"
],
"effects": [
"eslint-config-wikimedia"
],
"range": "4.0.0-alpha.0 - 7.2.0",
"nodes": [
"node_modules/@wikimedia/mw-node-qunit/node_modules/eslint"
],
"fixAvailable": {
"name": "eslint-config-wikimedia",
"version": "0.31.0",
"isSemVerMajor": true
}
},
"eslint-config-wikimedia": {
"name": "eslint-config-wikimedia",
"severity": "high",
"isDirect": true,
"via": [
"eslint",
"eslint-plugin-compat"
],
"effects": [
"@wikimedia/mw-node-qunit"
],
"range": "0.18.0 - 0.21.0 || 0.9.0 - 0.15.3",
"nodes": [
"node_modules/@wikimedia/mw-node-qunit/node_modules/eslint-config-wikimedia",
"node_modules/eslint-config-wikimedia"
],
"fixAvailable": {
"name": "eslint-config-wikimedia",
"version": "0.31.0",
"isSemVerMajor": true
}
},
"eslint-plugin-compat": {
"name": "eslint-plugin-compat",
"severity": "high",
"isDirect": false,
"via": [
"semver"
],
"effects": [
"eslint-config-wikimedia"
],
"range": "3.6.0-0 - 4.1.4",
"nodes": [
"node_modules/eslint-plugin-compat"
],
"fixAvailable": {
"name": "eslint-config-wikimedia",
"version": "0.31.0",
"isSemVerMajor": true
}
},
"express": {
"name": "express",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1096820,
"name": "express",
"dependency": "express",
"title": "Express.js Open Redirect in malformed URLs",
"url": "https://github.com/advisories/GHSA-rv95-896h-c2vc",
"severity": "moderate",
"cwe": [
"CWE-601",
"CWE-1286"
],
"cvss": {
"score": 6.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
"range": "<4.19.2"
},
{
"source": 1100530,
"name": "express",
"dependency": "express",
"title": "express vulnerable to XSS via response.redirect()",
"url": "https://github.com/advisories/GHSA-qw6h-vgh9-j6wx",
"severity": "low",
"cwe": [
"CWE-79"
],
"cvss": {
"score": 5,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L"
},
"range": "<4.20.0"
},
"body-parser",
"cookie",
"path-to-regexp",
"qs",
"send",
"serve-static"
],
"effects": [],
"range": "<=4.21.0 || 5.0.0-alpha.1 - 5.0.0",
"nodes": [
""
],
"fixAvailable": true
},
"external-editor": {
"name": "external-editor",
"severity": "low",
"isDirect": false,
"via": [
"tmp"
],
"effects": [
"inquirer"
],
"range": ">=1.1.1",
"nodes": [
"node_modules/external-editor"
],
"fixAvailable": {
"name": "eslint-config-wikimedia",
"version": "0.31.0",
"isSemVerMajor": true
}
},
"fast-glob": {
"name": "fast-glob",
"severity": "moderate",
"isDirect": false,
"via": [
"micromatch"
],
"effects": [
"globby"
],
"range": "<=2.2.7",
"nodes": [
"node_modules/fast-glob"
],
"fixAvailable": true
},
"findup-sync": {
"name": "findup-sync",
"severity": "moderate",
"isDirect": false,
"via": [
"micromatch"
],
"effects": [
"qunit",
"webpack-cli"
],
"range": "0.4.0 - 3.0.0",
"nodes": [
"",
"node_modules/webpack-cli/node_modules/findup-sync"
],
"fixAvailable": {
"name": "@wikimedia/mw-node-qunit",
"version": "6.4.2",
"isSemVerMajor": false
}
},
"follow-redirects": {
"name": "follow-redirects",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1092623,
"name": "follow-redirects",
"dependency": "follow-redirects",
"title": "Exposure of Sensitive Information to an Unauthorized Actor in follow-redirects",
"url": "https://github.com/advisories/GHSA-pw2r-vq6v-hr8c",
"severity": "moderate",
"cwe": [
"CWE-200",
"CWE-212"
],
"cvss": {
"score": 5.9,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
"range": "<1.14.8"
},
{
"source": 1096353,
"name": "follow-redirects",
"dependency": "follow-redirects",
"title": "Follow Redirects improperly handles URLs in the url.parse() function",
"url": "https://github.com/advisories/GHSA-jchw-25xp-jwwc",
"severity": "moderate",
"cwe": [
"CWE-20",
"CWE-601"
],
"cvss": {
"score": 6.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
"range": "<1.15.4"
},
{
"source": 1096856,
"name": "follow-redirects",
"dependency": "follow-redirects",
"title": "follow-redirects' Proxy-Authorization header kept across hosts",
"url": "https://github.com/advisories/GHSA-cxjh-pqwp-8mfp",
"severity": "moderate",
"cwe": [
"CWE-200"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
},
"range": "<=1.15.5"
},
{
"source": 1102323,
"name": "follow-redirects",
"dependency": "follow-redirects",
"title": "Exposure of sensitive information in follow-redirects",
"url": "https://github.com/advisories/GHSA-74fj-2j2h-c42q",
"severity": "high",
"cwe": [
"CWE-359"
],
"cvss": {
"score": 8,
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
},
"range": "<1.14.7"
}
],
"effects": [],
"range": "<=1.15.5",
"nodes": [
""
],
"fixAvailable": true
},
"fork-ts-checker-webpack-plugin": {
"name": "fork-ts-checker-webpack-plugin",
"severity": "moderate",
"isDirect": false,
"via": [
"micromatch"
],
"effects": [
"react-dev-utils"
],
"range": "0.4.14 - 4.1.6",
"nodes": [
"node_modules/@storybook/builder-webpack4/node_modules/fork-ts-checker-webpack-plugin",
"node_modules/react-dev-utils/node_modules/fork-ts-checker-webpack-plugin"
],
"fixAvailable": true
},
"form-data": {
"name": "form-data",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1106508,
"name": "form-data",
"dependency": "form-data",
"title": "form-data uses unsafe random function in form-data for choosing boundary",
"url": "https://github.com/advisories/GHSA-fjxv-7rqg-78g4",
"severity": "critical",
"cwe": [
"CWE-330"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=3.0.0 <3.0.4"
},
{
"source": 1106509,
"name": "form-data",
"dependency": "form-data",
"title": "form-data uses unsafe random function in form-data for choosing boundary",
"url": "https://github.com/advisories/GHSA-fjxv-7rqg-78g4",
"severity": "critical",
"cwe": [
"CWE-330"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<2.5.4"
}
],
"effects": [
"request"
],
"range": ">=3.0.0 <3.0.4 || <2.5.4",
"nodes": [
"",
"node_modules/request/node_modules/form-data"
],
"fixAvailable": {
"name": "jsdom",
"version": "27.0.0",
"isSemVerMajor": true
}
},
"github-build": {
"name": "github-build",
"severity": "high",
"isDirect": false,
"via": [
"axios"
],
"effects": [],
"range": "<=1.2.3",
"nodes": [
""
],
"fixAvailable": true
},
"global": {
"name": "global",
"severity": "low",
"isDirect": false,
"via": [
"min-document"
],
"effects": [
"@storybook/addon-actions",
"@storybook/addons",
"@storybook/api",
"@storybook/channel-postmessage",
"@storybook/client-api",
"@storybook/client-logger",
"@storybook/components",
"@storybook/core-client",
"@storybook/core-server",
"@storybook/html",
"@storybook/router",
"@storybook/theming",
"@storybook/ui",
"telejson"
],
"range": ">=2.0.3",
"nodes": [
"node_modules/global"
],
"fixAvailable": {
"name": "@storybook/html",
"version": "9.1.10",
"isSemVerMajor": true
}
},
"globby": {
"name": "globby",
"severity": "moderate",
"isDirect": false,
"via": [
"fast-glob"
],
"effects": [
"cpy"
],
"range": "8.0.0 - 9.2.0",
"nodes": [
"node_modules/globby"
],
"fixAvailable": true
},
"icss-utils": {
"name": "icss-utils",
"severity": "moderate",
"isDirect": false,
"via": [
"postcss"
],
"effects": [
"css-loader",
"postcss-modules-local-by-default",
"postcss-modules-values"
],
"range": "<=4.1.1",
"nodes": [
"node_modules/icss-utils"
],
"fixAvailable": true
},
"immer": {
"name": "immer",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1097196,
"name": "immer",
"dependency": "immer",
"title": "Prototype Pollution in immer",
"url": "https://github.com/advisories/GHSA-c36v-fmgq-m8hx",
"severity": "high",
"cwe": [
"CWE-915",
"CWE-1321"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=7.0.0 <9.0.6"
},
{
"source": 1097209,
"name": "immer",
"dependency": "immer",
"title": "Prototype Pollution in immer",
"url": "https://github.com/advisories/GHSA-33f9-j839-rf8h",
"severity": "critical",
"cwe": [
"CWE-843",
"CWE-1321"
],
"cvss": {
"score": 9.8,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"range": ">=7.0.0 <9.0.6"
}
],
"effects": [],
"range": "7.0.0 - 9.0.5",
"nodes": [
"node_modules/immer"
],
"fixAvailable": true
},
"inquirer": {
"name": "inquirer",
"severity": "low",
"isDirect": false,
"via": [
"external-editor"
],
"effects": [
"eslint"
],
"range": "3.0.0 - 8.2.6 || 9.0.0 - 9.3.7",
"nodes": [
""
],
"fixAvailable": {
"name": "eslint-config-wikimedia",
"version": "0.31.0",
"isSemVerMajor": true
}
},
"ip": {
"name": "ip",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1097720,
"name": "ip",
"dependency": "ip",
"title": "NPM IP package incorrectly identifies some private IP addresses as public",
"url": "https://github.com/advisories/GHSA-78xj-cgh5-2h22",
"severity": "low",
"cwe": [
"CWE-918"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<1.1.9"
},
{
"source": 1101851,
"name": "ip",
"dependency": "ip",
"title": "ip SSRF improper categorization in isPublic",
"url": "https://github.com/advisories/GHSA-2p57-rm9w-gvfp",
"severity": "high",
"cwe": [
"CWE-918"
],
"cvss": {
"score": 8.1,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"range": "<=2.0.1"
}
],
"effects": [
"@storybook/core-server"
],
"range": "*",
"nodes": [
""
],
"fixAvailable": true
},
"jsdoc": {
"name": "jsdoc",
"severity": "high",
"isDirect": true,
"via": [
"markdown-it",
"marked",
"taffydb"
],
"effects": [],
"range": "3.2.0-dev - 3.6.11",
"nodes": [
"node_modules/jsdoc"
],
"fixAvailable": {
"name": "jsdoc",
"version": "3.6.11",
"isSemVerMajor": false
}
},
"jsdom": {
"name": "jsdom",
"severity": "moderate",
"isDirect": true,
"via": [
"request",
"request-promise-native",
"tough-cookie"
],
"effects": [
"@wikimedia/mw-node-qunit"
],
"range": "0.1.20 || 0.2.0 - 16.5.3",
"nodes": [
"node_modules/jsdom"
],
"fixAvailable": {
"name": "jsdom",
"version": "27.0.0",
"isSemVerMajor": true
}
},
"json-schema": {
"name": "json-schema",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1101855,
"name": "json-schema",
"dependency": "json-schema",
"title": "json-schema is vulnerable to Prototype Pollution",
"url": "https://github.com/advisories/GHSA-896r-f27r-55mw",
"severity": "critical",
"cwe": [
"CWE-915",
"CWE-1321"
],
"cvss": {
"score": 9.8,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"range": "<0.4.0"
}
],
"effects": [
"jsprim"
],
"range": "<0.4.0",
"nodes": [
""
],
"fixAvailable": true
},
"json5": {
"name": "json5",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1096543,
"name": "json5",
"dependency": "json5",
"title": "Prototype Pollution in JSON5 via Parse Method",
"url": "https://github.com/advisories/GHSA-9c47-m6qq-7p4h",
"severity": "high",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 7.1,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H"
},
"range": "<1.0.2"
},
{
"source": 1096544,
"name": "json5",
"dependency": "json5",
"title": "Prototype Pollution in JSON5 via Parse Method",
"url": "https://github.com/advisories/GHSA-9c47-m6qq-7p4h",
"severity": "high",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 7.1,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H"
},
"range": ">=2.0.0 <2.2.2"
}
],
"effects": [],
"range": "<1.0.2 || >=2.0.0 <2.2.2",
"nodes": [
"",
"",
""
],
"fixAvailable": true
},
"jsprim": {
"name": "jsprim",
"severity": "critical",
"isDirect": false,
"via": [
"json-schema"
],
"effects": [],
"range": "0.3.0 - 1.4.1 || 2.0.0 - 2.0.1",
"nodes": [
""
],
"fixAvailable": true
},
"less": {
"name": "less",
"severity": "moderate",
"isDirect": true,
"via": [
"request"
],
"effects": [],
"range": "1.4.0-b1 - 2.6.1 || 2.7.2 - 3.11.3",
"nodes": [
"node_modules/less"
],
"fixAvailable": {
"name": "less",
"version": "3.13.1",
"isSemVerMajor": false
}
},
"loader-utils": {
"name": "loader-utils",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1094088,
"name": "loader-utils",
"dependency": "loader-utils",
"title": "Prototype pollution in webpack loader-utils",
"url": "https://github.com/advisories/GHSA-76p3-8jx3-jpfq",
"severity": "critical",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 9.8,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"range": "<1.4.1"
},
{
"source": 1094089,
"name": "loader-utils",
"dependency": "loader-utils",
"title": "Prototype pollution in webpack loader-utils",
"url": "https://github.com/advisories/GHSA-76p3-8jx3-jpfq",
"severity": "critical",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 9.8,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"range": ">=2.0.0 <2.0.3"
},
{
"source": 1095054,
"name": "loader-utils",
"dependency": "loader-utils",
"title": "loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS) via url variable",
"url": "https://github.com/advisories/GHSA-3rfm-jhwj-7488",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=2.0.0 <2.0.4"
},
{
"source": 1095055,
"name": "loader-utils",
"dependency": "loader-utils",
"title": "loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS) via url variable",
"url": "https://github.com/advisories/GHSA-3rfm-jhwj-7488",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=1.0.0 <1.4.2"
},
{
"source": 1097142,
"name": "loader-utils",
"dependency": "loader-utils",
"title": "loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS)",
"url": "https://github.com/advisories/GHSA-hhq3-ff78-jv3g",
"severity": "high",
"cwe": [
"CWE-400",
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=2.0.0 <2.0.4"
},
{
"source": 1097143,
"name": "loader-utils",
"dependency": "loader-utils",
"title": "loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS)",
"url": "https://github.com/advisories/GHSA-hhq3-ff78-jv3g",
"severity": "high",
"cwe": [
"CWE-400",
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=1.0.0 <1.4.2"
}
],
"effects": [
"react-dev-utils",
"webpack-cli"
],
"range": "<=1.4.1 || 2.0.0 - 2.0.3",
"nodes": [
"",
"",
"",
"",
"",
"",
"",
"node_modules/react-dev-utils/node_modules/loader-utils",
"node_modules/webpack-cli/node_modules/loader-utils"
],
"fixAvailable": {
"name": "webpack-cli",
"version": "3.3.12",
"isSemVerMajor": false
}
},
"markdown-it": {
"name": "markdown-it",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1092663,
"name": "markdown-it",
"dependency": "markdown-it",
"title": "Uncontrolled Resource Consumption in markdown-it",
"url": "https://github.com/advisories/GHSA-6vfc-qv3f-vr6c",
"severity": "moderate",
"cwe": [
"CWE-400",
"CWE-1333"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": "<12.3.2"
}
],
"effects": [
"jsdoc"
],
"range": "<12.3.2",
"nodes": [
"node_modules/markdown-it"
],
"fixAvailable": {
"name": "jsdoc",
"version": "3.6.11",
"isSemVerMajor": false
}
},
"markdown-to-jsx": {
"name": "markdown-to-jsx",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1100074,
"name": "markdown-to-jsx",
"dependency": "markdown-to-jsx",
"title": "Cross site scripting in markdown-to-jsx",
"url": "https://github.com/advisories/GHSA-4wx3-54gh-9fr9",
"severity": "moderate",
"cwe": [
"CWE-79"
],
"cvss": {
"score": 6.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
"range": "<7.4.0"
}
],
"effects": [
"@storybook/ui"
],
"range": "<7.4.0",
"nodes": [
"",
"node_modules/@storybook/ui/node_modules/markdown-to-jsx"
],
"fixAvailable": true
},
"marked": {
"name": "marked",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1095051,
"name": "marked",
"dependency": "marked",
"title": "Inefficient Regular Expression Complexity in marked",
"url": "https://github.com/advisories/GHSA-rrrm-qjm4-v8hf",
"severity": "high",
"cwe": [
"CWE-400",
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<4.0.10"
},
{
"source": 1095052,
"name": "marked",
"dependency": "marked",
"title": "Inefficient Regular Expression Complexity in marked",
"url": "https://github.com/advisories/GHSA-5v2h-r2cx-5xgj",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<4.0.10"
}
],
"effects": [
"jsdoc"
],
"range": "<=4.0.9",
"nodes": [
"node_modules/marked"
],
"fixAvailable": {
"name": "jsdoc",
"version": "3.6.11",
"isSemVerMajor": false
}
},
"micromatch": {
"name": "micromatch",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1098681,
"name": "micromatch",
"dependency": "micromatch",
"title": "Regular Expression Denial of Service (ReDoS) in micromatch",
"url": "https://github.com/advisories/GHSA-952p-6rrq-rcjv",
"severity": "moderate",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": "<4.0.8"
},
"braces"
],
"effects": [
"anymatch",
"fast-glob",
"findup-sync",
"fork-ts-checker-webpack-plugin",
"readdirp",
"sane",
"webpack"
],
"range": "<=4.0.7",
"nodes": [
"",
"",
"node_modules/@storybook/builder-webpack4/node_modules/micromatch",
"node_modules/fast-glob/node_modules/micromatch",
"node_modules/findup-sync/node_modules/micromatch",
"node_modules/react-dev-utils/node_modules/micromatch",
"node_modules/sane/node_modules/micromatch",
"node_modules/watchpack-chokidar2/node_modules/micromatch",
"node_modules/webpack-cli/node_modules/micromatch",
"node_modules/webpack/node_modules/micromatch"
],
"fixAvailable": {
"name": "webpack",
"version": "5.102.0",
"isSemVerMajor": true
}
},
"min-document": {
"name": "min-document",
"severity": "low",
"isDirect": false,
"via": [
{
"source": 1108264,
"name": "min-document",
"dependency": "min-document",
"title": "min-document vulnerable to prototype pollution",
"url": "https://github.com/advisories/GHSA-rx8g-88g5-qh64",
"severity": "low",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<=2.19.0"
}
],
"effects": [
"global"
],
"range": "*",
"nodes": [
""
],
"fixAvailable": {
"name": "@storybook/html",
"version": "9.1.10",
"isSemVerMajor": true
}
},
"minimatch": {
"name": "minimatch",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1096485,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch ReDoS vulnerability",
"url": "https://github.com/advisories/GHSA-f8q6-p94x-37v3",
"severity": "high",
"cwe": [
"CWE-400",
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<3.0.5"
}
],
"effects": [
"recursive-readdir"
],
"range": "<3.0.5",
"nodes": [
"node_modules/minimatch"
],
"fixAvailable": true
},
"minimist": {
"name": "minimist",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1097678,
"name": "minimist",
"dependency": "minimist",
"title": "Prototype Pollution in minimist",
"url": "https://github.com/advisories/GHSA-xvch-5gv4-984h",
"severity": "critical",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 9.8,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"range": ">=1.0.0 <1.2.6"
}
],
"effects": [],
"range": "1.0.0 - 1.2.5",
"nodes": [
""
],
"fixAvailable": true
},
"nanoid": {
"name": "nanoid",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1089011,
"name": "nanoid",
"dependency": "nanoid",
"title": "Exposure of Sensitive Information to an Unauthorized Actor in nanoid",
"url": "https://github.com/advisories/GHSA-qrpm-p2h7-hrv2",
"severity": "moderate",
"cwe": [
"CWE-200"
],
"cvss": {
"score": 5.5,
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
},
"range": ">=3.0.0 <3.1.31"
},
{
"source": 1101163,
"name": "nanoid",
"dependency": "nanoid",
"title": "Predictable results in nanoid generation when given non-integer values",
"url": "https://github.com/advisories/GHSA-mwcw-c2x4-8c55",
"severity": "moderate",
"cwe": [
"CWE-835"
],
"cvss": {
"score": 4.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
},
"range": "<3.3.8"
}
],
"effects": [],
"range": "<=3.3.7",
"nodes": [
"",
""
],
"fixAvailable": true
},
"node-fetch": {
"name": "node-fetch",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1095073,
"name": "node-fetch",
"dependency": "node-fetch",
"title": "node-fetch forwards secure headers to untrusted sites",
"url": "https://github.com/advisories/GHSA-r683-j2x4-v87g",
"severity": "high",
"cwe": [
"CWE-173",
"CWE-200",
"CWE-601"
],
"cvss": {
"score": 8.8,
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
},
"range": "<2.6.7"
}
],
"effects": [],
"range": "<2.6.7",
"nodes": [
""
],
"fixAvailable": true
},
"path-to-regexp": {
"name": "path-to-regexp",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1101849,
"name": "path-to-regexp",
"dependency": "path-to-regexp",
"title": "path-to-regexp outputs backtracking regular expressions",
"url": "https://github.com/advisories/GHSA-9wv6-86v2-598j",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=0.2.0 <1.9.0"
},
{
"source": 1101850,
"name": "path-to-regexp",
"dependency": "path-to-regexp",
"title": "path-to-regexp outputs backtracking regular expressions",
"url": "https://github.com/advisories/GHSA-9wv6-86v2-598j",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<0.1.10"
},
{
"source": 1105199,
"name": "path-to-regexp",
"dependency": "path-to-regexp",
"title": "path-to-regexp contains a ReDoS",
"url": "https://github.com/advisories/GHSA-rhx6-c78j-4q9w",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<0.1.12"
}
],
"effects": [
"express"
],
"range": "<=0.1.11 || 0.2.0 - 1.8.0",
"nodes": [
"",
""
],
"fixAvailable": true
},
"pbkdf2": {
"name": "pbkdf2",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1105691,
"name": "pbkdf2",
"dependency": "pbkdf2",
"title": "pbkdf2 silently disregards Uint8Array input, returning static keys",
"url": "https://github.com/advisories/GHSA-v62p-rq8g-8h59",
"severity": "critical",
"cwe": [
"CWE-20"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<=3.1.2"
},
{
"source": 1105692,
"name": "pbkdf2",
"dependency": "pbkdf2",
"title": "pbkdf2 returns predictable uninitialized/zero-filled memory for non-normalized or unimplemented algos",
"url": "https://github.com/advisories/GHSA-h7cp-r72f-jxh6",
"severity": "critical",
"cwe": [
"CWE-20"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=3.0.10 <=3.1.2"
}
],
"effects": [],
"range": "<=3.1.2",
"nodes": [
""
],
"fixAvailable": true
},
"postcss": {
"name": "postcss",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1094544,
"name": "postcss",
"dependency": "postcss",
"title": "PostCSS line return parsing error",
"url": "https://github.com/advisories/GHSA-7fh5-64p2-3v2j",
"severity": "moderate",
"cwe": [
"CWE-74",
"CWE-144"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
"range": "<8.4.31"
}
],
"effects": [
"@storybook/builder-webpack4",
"autoprefixer",
"css-loader",
"icss-utils",
"postcss-flexbugs-fixes",
"postcss-less",
"postcss-modules-extract-imports",
"postcss-modules-local-by-default",
"postcss-modules-scope",
"postcss-modules-values",
"postcss-safe-parser",
"postcss-sass",
"postcss-scss",
"stylelint",
"sugarss"
],
"range": "<8.4.31",
"nodes": [
"",
"",
"node_modules/postcss"
],
"fixAvailable": {
"name": "stylelint-config-wikimedia",
"version": "0.18.0",
"isSemVerMajor": true
}
},
"postcss-flexbugs-fixes": {
"name": "postcss-flexbugs-fixes",
"severity": "moderate",
"isDirect": false,
"via": [
"postcss"
],
"effects": [],
"range": "<=4.2.1",
"nodes": [
"node_modules/postcss-flexbugs-fixes"
],
"fixAvailable": true
},
"postcss-less": {
"name": "postcss-less",
"severity": "moderate",
"isDirect": false,
"via": [
"postcss"
],
"effects": [
"stylelint"
],
"range": "<=3.1.4",
"nodes": [
"node_modules/postcss-less"
],
"fixAvailable": {
"name": "stylelint-config-wikimedia",
"version": "0.18.0",
"isSemVerMajor": true
}
},
"postcss-modules-extract-imports": {
"name": "postcss-modules-extract-imports",
"severity": "moderate",
"isDirect": false,
"via": [
"postcss"
],
"effects": [],
"range": "<=2.0.0",
"nodes": [
"node_modules/postcss-modules-extract-imports"
],
"fixAvailable": true
},
"postcss-modules-local-by-default": {
"name": "postcss-modules-local-by-default",
"severity": "moderate",
"isDirect": false,
"via": [
"icss-utils",
"postcss"
],
"effects": [],
"range": "<=4.0.0-rc.4",
"nodes": [
"node_modules/postcss-modules-local-by-default"
],
"fixAvailable": true
},
"postcss-modules-scope": {
"name": "postcss-modules-scope",
"severity": "moderate",
"isDirect": false,
"via": [
"postcss"
],
"effects": [],
"range": "<=2.2.0",
"nodes": [
"node_modules/postcss-modules-scope"
],
"fixAvailable": true
},
"postcss-modules-values": {
"name": "postcss-modules-values",
"severity": "moderate",
"isDirect": false,
"via": [
"icss-utils",
"postcss"
],
"effects": [
"css-loader"
],
"range": "<=4.0.0-rc.5",
"nodes": [
"node_modules/postcss-modules-values"
],
"fixAvailable": true
},
"postcss-safe-parser": {
"name": "postcss-safe-parser",
"severity": "moderate",
"isDirect": false,
"via": [
"postcss"
],
"effects": [
"stylelint"
],
"range": "<=4.0.2",
"nodes": [
"node_modules/postcss-safe-parser"
],
"fixAvailable": {
"name": "stylelint-config-wikimedia",
"version": "0.18.0",
"isSemVerMajor": true
}
},
"postcss-sass": {
"name": "postcss-sass",
"severity": "moderate",
"isDirect": false,
"via": [
"postcss"
],
"effects": [
"stylelint"
],
"range": "<=0.4.4",
"nodes": [
"node_modules/postcss-sass"
],
"fixAvailable": {
"name": "stylelint-config-wikimedia",
"version": "0.18.0",
"isSemVerMajor": true
}
},
"postcss-scss": {
"name": "postcss-scss",
"severity": "moderate",
"isDirect": false,
"via": [
"postcss"
],
"effects": [
"stylelint"
],
"range": "<=2.1.1",
"nodes": [
"node_modules/postcss-scss"
],
"fixAvailable": {
"name": "stylelint-config-wikimedia",
"version": "0.18.0",
"isSemVerMajor": true
}
},
"pre-commit": {
"name": "pre-commit",
"severity": "high",
"isDirect": false,
"via": [
"cross-spawn"
],
"effects": [],
"range": ">=1.1.0",
"nodes": [
""
],
"fixAvailable": {
"name": "pre-commit",
"version": "1.0.10",
"isSemVerMajor": true
}
},
"prismjs": {
"name": "prismjs",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1090424,
"name": "prismjs",
"dependency": "prismjs",
"title": "Cross-site Scripting in Prism",
"url": "https://github.com/advisories/GHSA-3949-f494-cm99",
"severity": "high",
"cwe": [
"CWE-79"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:L"
},
"range": ">=1.14.0 <1.27.0"
},
{
"source": 1105770,
"name": "prismjs",
"dependency": "prismjs",
"title": "PrismJS DOM Clobbering vulnerability",
"url": "https://github.com/advisories/GHSA-x7hr-w5r2-h6wg",
"severity": "moderate",
"cwe": [
"CWE-79",
"CWE-94"
],
"cvss": {
"score": 4.9,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N"
},
"range": "<1.30.0"
}
],
"effects": [
"refractor"
],
"range": "<=1.29.0",
"nodes": [
""
],
"fixAvailable": {
"name": "@storybook/addon-actions",
"version": "9.0.8",
"isSemVerMajor": true
}
},
"qs": {
"name": "qs",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1104118,
"name": "qs",
"dependency": "qs",
"title": "qs vulnerable to Prototype Pollution",
"url": "https://github.com/advisories/GHSA-hrpp-h998-j3pp",
"severity": "high",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=6.5.0 <6.5.3"
},
{
"source": 1104120,
"name": "qs",
"dependency": "qs",
"title": "qs vulnerable to Prototype Pollution",
"url": "https://github.com/advisories/GHSA-hrpp-h998-j3pp",
"severity": "high",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=6.7.0 <6.7.3"
},
{
"source": 1104123,
"name": "qs",
"dependency": "qs",
"title": "qs vulnerable to Prototype Pollution",
"url": "https://github.com/advisories/GHSA-hrpp-h998-j3pp",
"severity": "high",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=6.10.0 <6.10.3"
}
],
"effects": [
"body-parser",
"express"
],
"range": "6.5.0 - 6.5.2 || 6.7.0 - 6.7.2 || 6.10.0 - 6.10.2",
"nodes": [
"",
"",
"",
""
],
"fixAvailable": true
},
"qunit": {
"name": "qunit",
"severity": "moderate",
"isDirect": false,
"via": [
"findup-sync",
"sane"
],
"effects": [
"@wikimedia/mw-node-qunit"
],
"range": "2.4.1 - 2.8.0",
"nodes": [
"node_modules/@wikimedia/mw-node-qunit/node_modules/qunit"
],
"fixAvailable": {
"name": "@wikimedia/mw-node-qunit",
"version": "6.4.2",
"isSemVerMajor": false
}
},
"react-dev-utils": {
"name": "react-dev-utils",
"severity": "critical",
"isDirect": false,
"via": [
"browserslist",
"cross-spawn",
"fork-ts-checker-webpack-plugin",
"immer",
"loader-utils",
"recursive-readdir",
"shell-quote"
],
"effects": [
"@storybook/builder-webpack4"
],
"range": "0.5.2 - 12.0.0-next.60",
"nodes": [
"node_modules/react-dev-utils"
],
"fixAvailable": true
},
"react-syntax-highlighter": {
"name": "react-syntax-highlighter",
"severity": "moderate",
"isDirect": false,
"via": [
"refractor"
],
"effects": [
"@storybook/components"
],
"range": ">=6.0.0",
"nodes": [
"node_modules/react-syntax-highlighter"
],
"fixAvailable": {
"name": "@storybook/addon-actions",
"version": "9.0.8",
"isSemVerMajor": true
}
},
"readdirp": {
"name": "readdirp",
"severity": "moderate",
"isDirect": false,
"via": [
"micromatch"
],
"effects": [
"chokidar"
],
"range": "2.2.0 - 2.2.1",
"nodes": [
"node_modules/watchpack-chokidar2/node_modules/readdirp"
],
"fixAvailable": true
},
"recursive-readdir": {
"name": "recursive-readdir",
"severity": "high",
"isDirect": false,
"via": [
"minimatch"
],
"effects": [
"react-dev-utils"
],
"range": "1.2.0 - 2.2.2",
"nodes": [
"node_modules/recursive-readdir"
],
"fixAvailable": true
},
"refractor": {
"name": "refractor",
"severity": "moderate",
"isDirect": false,
"via": [
"prismjs"
],
"effects": [
"react-syntax-highlighter"
],
"range": "<=4.6.0",
"nodes": [
""
],
"fixAvailable": {
"name": "@storybook/addon-actions",
"version": "9.0.8",
"isSemVerMajor": true
}
},
"request": {
"name": "request",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1096727,
"name": "request",
"dependency": "request",
"title": "Server-Side Request Forgery in Request",
"url": "https://github.com/advisories/GHSA-p8p7-x288-28g6",
"severity": "moderate",
"cwe": [
"CWE-918"
],
"cvss": {
"score": 6.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
"range": "<=2.88.2"
},
"form-data",
"tough-cookie"
],
"effects": [
"jsdom",
"less",
"request-promise-core",
"request-promise-native"
],
"range": "*",
"nodes": [
"node_modules/request"
],
"fixAvailable": {
"name": "jsdom",
"version": "27.0.0",
"isSemVerMajor": true
}
},
"request-promise-core": {
"name": "request-promise-core",
"severity": "moderate",
"isDirect": false,
"via": [
"request"
],
"effects": [
"request-promise-native"
],
"range": "*",
"nodes": [
"node_modules/request-promise-core"
],
"fixAvailable": {
"name": "jsdom",
"version": "27.0.0",
"isSemVerMajor": true
}
},
"request-promise-native": {
"name": "request-promise-native",
"severity": "moderate",
"isDirect": false,
"via": [
"request",
"request-promise-core",
"tough-cookie"
],
"effects": [
"jsdom"
],
"range": ">=1.0.0",
"nodes": [
"node_modules/request-promise-native"
],
"fixAvailable": {
"name": "jsdom",
"version": "27.0.0",
"isSemVerMajor": true
}
},
"sane": {
"name": "sane",
"severity": "moderate",
"isDirect": false,
"via": [
"anymatch",
"micromatch"
],
"effects": [
"qunit"
],
"range": "1.5.0 - 4.1.0",
"nodes": [
"node_modules/sane"
],
"fixAvailable": {
"name": "@wikimedia/mw-node-qunit",
"version": "6.4.2",
"isSemVerMajor": false
}
},
"semver": {
"name": "semver",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1101088,
"name": "semver",
"dependency": "semver",
"title": "semver vulnerable to Regular Expression Denial of Service",
"url": "https://github.com/advisories/GHSA-c2qf-rxjj-qqgw",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=7.0.0 <7.5.2"
},
{
"source": 1101089,
"name": "semver",
"dependency": "semver",
"title": "semver vulnerable to Regular Expression Denial of Service",
"url": "https://github.com/advisories/GHSA-c2qf-rxjj-qqgw",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<5.7.2"
},
{
"source": 1101090,
"name": "semver",
"dependency": "semver",
"title": "semver vulnerable to Regular Expression Denial of Service",
"url": "https://github.com/advisories/GHSA-c2qf-rxjj-qqgw",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=6.0.0 <6.3.1"
}
],
"effects": [
"core-js-compat",
"eslint-plugin-compat"
],
"range": "<=5.7.1 || 6.0.0 - 6.3.0 || 7.0.0 - 7.5.1",
"nodes": [
"",
"",
"",
"",
"",
"",
"",
"",
"",
"",
"",
"",
"",
"",
"",
"",
"",
"",
"",
"",
"",
"",
"",
"",
"",
"",
"",
"",
"",
"",
"",
"node_modules/eslint-plugin-compat/node_modules/semver"
],
"fixAvailable": {
"name": "eslint-config-wikimedia",
"version": "0.31.0",
"isSemVerMajor": true
}
},
"send": {
"name": "send",
"severity": "low",
"isDirect": false,
"via": [
{
"source": 1100526,
"name": "send",
"dependency": "send",
"title": "send vulnerable to template injection that can lead to XSS",
"url": "https://github.com/advisories/GHSA-m6fv-jmcg-4jfg",
"severity": "low",
"cwe": [
"CWE-79"
],
"cvss": {
"score": 5,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L"
},
"range": "<0.19.0"
}
],
"effects": [
"express",
"serve-static"
],
"range": "<0.19.0",
"nodes": [
""
],
"fixAvailable": true
},
"serve-static": {
"name": "serve-static",
"severity": "low",
"isDirect": false,
"via": [
{
"source": 1100528,
"name": "serve-static",
"dependency": "serve-static",
"title": "serve-static vulnerable to template injection that can lead to XSS",
"url": "https://github.com/advisories/GHSA-cm22-4g7w-348p",
"severity": "low",
"cwe": [
"CWE-79"
],
"cvss": {
"score": 5,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L"
},
"range": "<1.16.0"
},
"send"
],
"effects": [],
"range": "<=1.16.0",
"nodes": [
""
],
"fixAvailable": true
},
"sha.js": {
"name": "sha.js",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1107537,
"name": "sha.js",
"dependency": "sha.js",
"title": "sha.js is missing type checks leading to hash rewind and passing on crafted data",
"url": "https://github.com/advisories/GHSA-95m3-7q98-8xr5",
"severity": "critical",
"cwe": [
"CWE-20"
],
"cvss": {
"score": 9.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
},
"range": "<=2.4.11"
}
],
"effects": [],
"range": "<=2.4.11",
"nodes": [
""
],
"fixAvailable": true
},
"shell-quote": {
"name": "shell-quote",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1107366,
"name": "shell-quote",
"dependency": "shell-quote",
"title": "Improper Neutralization of Special Elements used in a Command in Shell-quote",
"url": "https://github.com/advisories/GHSA-g4rg-993r-mgx7",
"severity": "critical",
"cwe": [
"CWE-77"
],
"cvss": {
"score": 9.8,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"range": ">=1.6.3 <=1.7.2"
}
],
"effects": [
"react-dev-utils"
],
"range": "1.6.3 - 1.7.2",
"nodes": [
"node_modules/shell-quote"
],
"fixAvailable": true
},
"simple-get": {
"name": "simple-get",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1090445,
"name": "simple-get",
"dependency": "simple-get",
"title": "Exposure of Sensitive Information in simple-get",
"url": "https://github.com/advisories/GHSA-wpg7-2c88-r8xv",
"severity": "high",
"cwe": [
"CWE-200"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
"range": ">=3.0.0 <3.1.1"
}
],
"effects": [],
"range": "3.0.0 - 3.1.0",
"nodes": [
""
],
"fixAvailable": true
},
"store2": {
"name": "store2",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1101527,
"name": "store2",
"dependency": "store2",
"title": "Cross Site Scripting vulnerability in store2",
"url": "https://github.com/advisories/GHSA-w5hq-hm5m-4548",
"severity": "moderate",
"cwe": [
"CWE-79"
],
"cvss": {
"score": 6.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
"range": "<2.14.4"
}
],
"effects": [],
"range": "<2.14.4",
"nodes": [
""
],
"fixAvailable": true
},
"stylelint": {
"name": "stylelint",
"severity": "moderate",
"isDirect": false,
"via": [
"autoprefixer",
"postcss",
"postcss-less",
"postcss-safe-parser",
"postcss-sass",
"postcss-scss",
"sugarss"
],
"effects": [
"stylelint-config-wikimedia"
],
"range": "0.1.0 - 13.13.1",
"nodes": [
"node_modules/stylelint"
],
"fixAvailable": {
"name": "stylelint-config-wikimedia",
"version": "0.18.0",
"isSemVerMajor": true
}
},
"stylelint-config-wikimedia": {
"name": "stylelint-config-wikimedia",
"severity": "moderate",
"isDirect": true,
"via": [
"stylelint"
],
"effects": [],
"range": "<=0.11.1",
"nodes": [
"node_modules/stylelint-config-wikimedia"
],
"fixAvailable": {
"name": "stylelint-config-wikimedia",
"version": "0.18.0",
"isSemVerMajor": true
}
},
"sugarss": {
"name": "sugarss",
"severity": "moderate",
"isDirect": false,
"via": [
"postcss"
],
"effects": [],
"range": "<=2.0.0",
"nodes": [
"node_modules/sugarss"
],
"fixAvailable": true
},
"taffydb": {
"name": "taffydb",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1089386,
"name": "taffydb",
"dependency": "taffydb",
"title": "TaffyDB can allow access to any data items in the DB",
"url": "https://github.com/advisories/GHSA-mxhp-79qh-mcx6",
"severity": "high",
"cwe": [
"CWE-20",
"CWE-668"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
"range": "<=2.7.3"
}
],
"effects": [
"jsdoc"
],
"range": "*",
"nodes": [
""
],
"fixAvailable": {
"name": "jsdoc",
"version": "3.6.11",
"isSemVerMajor": false
}
},
"tar": {
"name": "tar",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1097493,
"name": "tar",
"dependency": "tar",
"title": "Denial of service while parsing a tar file due to lack of folders count validation",
"url": "https://github.com/advisories/GHSA-f5x3-32g6-xq36",
"severity": "moderate",
"cwe": [
"CWE-400"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
"range": "<6.2.1"
}
],
"effects": [],
"range": "<6.2.1",
"nodes": [
""
],
"fixAvailable": true
},
"tar-fs": {
"name": "tar-fs",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1106930,
"name": "tar-fs",
"dependency": "tar-fs",
"title": "tar-fs can extract outside the specified dir with a specific tarball",
"url": "https://github.com/advisories/GHSA-8cj5-5rvv-wf4v",
"severity": "high",
"cwe": [
"CWE-22"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=2.0.0 <2.1.3"
},
{
"source": 1108293,
"name": "tar-fs",
"dependency": "tar-fs",
"title": "tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball",
"url": "https://github.com/advisories/GHSA-vj76-c3g6-qr5v",
"severity": "high",
"cwe": [
"CWE-22",
"CWE-61"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=2.0.0 <2.1.4"
},
{
"source": 1108411,
"name": "tar-fs",
"dependency": "tar-fs",
"title": "tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File",
"url": "https://github.com/advisories/GHSA-pq67-2wwv-3xjx",
"severity": "high",
"cwe": [
"CWE-22"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
},
"range": ">=2.0.0 <2.1.2"
}
],
"effects": [],
"range": "2.0.0 - 2.1.3",
"nodes": [
""
],
"fixAvailable": true
},
"telejson": {
"name": "telejson",
"severity": "low",
"isDirect": false,
"via": [
"global"
],
"effects": [
"@storybook/channel-postmessage",
"@storybook/core-server"
],
"range": "<=6.0.8",
"nodes": [
"node_modules/telejson"
],
"fixAvailable": {
"name": "@storybook/addon-actions",
"version": "9.0.8",
"isSemVerMajor": true
}
},
"terser": {
"name": "terser",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1091691,
"name": "terser",
"dependency": "terser",
"title": "Terser insecure use of regular expressions leads to ReDoS",
"url": "https://github.com/advisories/GHSA-4wf5-vphf-c2xc",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<4.8.1"
}
],
"effects": [],
"range": "<4.8.1",
"nodes": [
""
],
"fixAvailable": true
},
"terser-webpack-plugin": {
"name": "terser-webpack-plugin",
"severity": "moderate",
"isDirect": false,
"via": [
"webpack"
],
"effects": [
"webpack"
],
"range": "<=2.2.1",
"nodes": [
""
],
"fixAvailable": {
"name": "webpack",
"version": "5.102.0",
"isSemVerMajor": true
}
},
"tmp": {
"name": "tmp",
"severity": "low",
"isDirect": false,
"via": [
{
"source": 1106849,
"name": "tmp",
"dependency": "tmp",
"title": "tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter",
"url": "https://github.com/advisories/GHSA-52f5-9888-hmc6",
"severity": "low",
"cwe": [
"CWE-59"
],
"cvss": {
"score": 2.5,
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"
},
"range": "<=0.2.3"
}
],
"effects": [
"external-editor"
],
"range": "<=0.2.3",
"nodes": [
""
],
"fixAvailable": {
"name": "eslint-config-wikimedia",
"version": "0.31.0",
"isSemVerMajor": true
}
},
"tough-cookie": {
"name": "tough-cookie",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1097682,
"name": "tough-cookie",
"dependency": "tough-cookie",
"title": "tough-cookie Prototype Pollution vulnerability",
"url": "https://github.com/advisories/GHSA-72xf-g2v4-qvf3",
"severity": "moderate",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
},
"range": "<4.1.3"
}
],
"effects": [
"jsdom",
"request",
"request-promise-native"
],
"range": "<4.1.3",
"nodes": [
"node_modules/tough-cookie"
],
"fixAvailable": {
"name": "jsdom",
"version": "27.0.0",
"isSemVerMajor": true
}
},
"watchpack": {
"name": "watchpack",
"severity": "high",
"isDirect": false,
"via": [
"watchpack-chokidar2"
],
"effects": [],
"range": "1.7.2 - 1.7.5",
"nodes": [
"node_modules/watchpack"
],
"fixAvailable": true
},
"watchpack-chokidar2": {
"name": "watchpack-chokidar2",
"severity": "high",
"isDirect": false,
"via": [
"chokidar"
],
"effects": [
"watchpack"
],
"range": "*",
"nodes": [
"node_modules/watchpack-chokidar2"
],
"fixAvailable": true
},
"webpack": {
"name": "webpack",
"severity": "moderate",
"isDirect": true,
"via": [
"micromatch",
"terser-webpack-plugin"
],
"effects": [
"@storybook/core-common",
"@storybook/core-server",
"terser-webpack-plugin",
"webpack-cli"
],
"range": "4.0.0-alpha.0 - 5.0.0-rc.6",
"nodes": [
"node_modules/webpack"
],
"fixAvailable": {
"name": "webpack",
"version": "5.102.0",
"isSemVerMajor": true
}
},
"webpack-cli": {
"name": "webpack-cli",
"severity": "high",
"isDirect": true,
"via": [
"cross-spawn",
"findup-sync",
"loader-utils",
"webpack"
],
"effects": [],
"range": "<=0.0.8-development || 1.3.0 - 2.0.9 || 2.0.11 - 4.0.0-rc.1",
"nodes": [
"node_modules/webpack-cli"
],
"fixAvailable": {
"name": "webpack-cli",
"version": "3.3.12",
"isSemVerMajor": false
}
},
"webpack-dev-middleware": {
"name": "webpack-dev-middleware",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1096729,
"name": "webpack-dev-middleware",
"dependency": "webpack-dev-middleware",
"title": "Path traversal in webpack-dev-middleware",
"url": "https://github.com/advisories/GHSA-wr3j-pwj9-hqq6",
"severity": "high",
"cwe": [
"CWE-22"
],
"cvss": {
"score": 7.4,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N"
},
"range": "<=5.3.3"
}
],
"effects": [
"@storybook/core-server"
],
"range": "<=5.3.3",
"nodes": [
"node_modules/webpack-dev-middleware"
],
"fixAvailable": true
},
"word-wrap": {
"name": "word-wrap",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1102444,
"name": "word-wrap",
"dependency": "word-wrap",
"title": "word-wrap vulnerable to Regular Expression Denial of Service",
"url": "https://github.com/advisories/GHSA-j8xg-fqg3-53r7",
"severity": "moderate",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": "<1.2.4"
}
],
"effects": [],
"range": "<1.2.4",
"nodes": [
""
],
"fixAvailable": true
},
"ws": {
"name": "ws",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1098394,
"name": "ws",
"dependency": "ws",
"title": "ws affected by a DoS when handling a request with many HTTP headers",
"url": "https://github.com/advisories/GHSA-3h5v-q93c-6h6q",
"severity": "high",
"cwe": [
"CWE-476"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=6.0.0 <6.2.3"
}
],
"effects": [],
"range": "6.0.0 - 6.2.2",
"nodes": [
""
],
"fixAvailable": true
}
},
"metadata": {
"vulnerabilities": {
"info": 0,
"low": 19,
"moderate": 48,
"high": 41,
"critical": 14,
"total": 122
},
"dependencies": {
"prod": 2,
"dev": 2087,
"optional": 31,
"peer": 1,
"peerOptional": 0,
"total": 2088
}
}
}
}
--- end ---
{"added": 2088, "removed": 0, "changed": 0, "audited": 2089, "funding": 213, "audit": {"auditReportVersion": 2, "vulnerabilities": {"@babel/helpers": {"name": "@babel/helpers", "severity": "moderate", "isDirect": false, "via": [{"source": 1104001, "name": "@babel/helpers", "dependency": "@babel/helpers", "title": "Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups", "url": "https://github.com/advisories/GHSA-968p-4wvh-cqc8", "severity": "moderate", "cwe": ["CWE-1333"], "cvss": {"score": 6.2, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": "<7.26.10"}], "effects": [], "range": "<7.26.10", "nodes": [""], "fixAvailable": true}, "@babel/runtime": {"name": "@babel/runtime", "severity": "moderate", "isDirect": false, "via": [{"source": 1104000, "name": "@babel/runtime", "dependency": "@babel/runtime", "title": "Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups", "url": "https://github.com/advisories/GHSA-968p-4wvh-cqc8", "severity": "moderate", "cwe": ["CWE-1333"], "cvss": {"score": 6.2, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": "<7.26.10"}], "effects": [], "range": "<7.26.10", "nodes": [""], "fixAvailable": true}, "@babel/traverse": {"name": "@babel/traverse", "severity": "critical", "isDirect": false, "via": [{"source": 1096886, "name": "@babel/traverse", "dependency": "@babel/traverse", "title": "Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code", "url": "https://github.com/advisories/GHSA-67hx-6x53-jw92", "severity": "critical", "cwe": ["CWE-184", "CWE-697"], "cvss": {"score": 9.4, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"}, "range": "<7.23.2"}], "effects": [], "range": "<7.23.2", "nodes": [""], "fixAvailable": true}, "@storybook/addon-actions": {"name": "@storybook/addon-actions", "severity": "low", "isDirect": true, "via": ["@storybook/addons", "@storybook/api", "@storybook/client-api", "@storybook/components", "@storybook/theming", "global"], "effects": [], "range": "3.3.0-alpha.0 - 7.0.0-rc.11", "nodes": ["node_modules/@storybook/addon-actions"], "fixAvailable": {"name": "@storybook/addon-actions", "version": "9.0.8", "isSemVerMajor": true}}, "@storybook/addons": {"name": "@storybook/addons", "severity": "low", "isDirect": false, "via": ["@storybook/api", "@storybook/client-logger", "@storybook/router", "@storybook/theming", "global"], "effects": ["@storybook/addon-actions", "@storybook/html", "@storybook/ui"], "range": "4.0.0-alpha.0 - 7.0.0-rc.11", "nodes": ["node_modules/@storybook/addons"], "fixAvailable": {"name": "@storybook/addon-actions", "version": "9.0.8", "isSemVerMajor": true}}, "@storybook/api": {"name": "@storybook/api", "severity": "low", "isDirect": false, "via": ["@storybook/client-logger", "@storybook/router", "@storybook/theming", "global", "telejson"], "effects": ["@storybook/addon-actions", "@storybook/addons", "@storybook/ui"], "range": "<=7.0.0-rc.11", "nodes": ["node_modules/@storybook/api"], "fixAvailable": {"name": "@storybook/addon-actions", "version": "9.0.8", "isSemVerMajor": true}}, "@storybook/builder-webpack4": {"name": "@storybook/builder-webpack4", "severity": "high", "isDirect": false, "via": ["@storybook/addons", "@storybook/api", "@storybook/channel-postmessage", "@storybook/client-api", "@storybook/client-logger", "@storybook/components", "@storybook/core-common", "@storybook/router", "@storybook/theming", "@storybook/ui", "autoprefixer", "css-loader", "fork-ts-checker-webpack-plugin", "global", "postcss", "postcss-flexbugs-fixes", "react-dev-utils", "webpack", "webpack-dev-middleware"], "effects": [], "range": "*", "nodes": ["node_modules/@storybook/builder-webpack4"], "fixAvailable": true}, "@storybook/channel-postmessage": {"name": "@storybook/channel-postmessage", "severity": "low", "isDirect": false, "via": ["@storybook/client-logger", "global", "telejson"], "effects": ["@storybook/client-api"], "range": "3.1.2 - 7.0.0-rc.11", "nodes": ["node_modules/@storybook/channel-postmessage"], "fixAvailable": {"name": "@storybook/addon-actions", "version": "9.0.8", "isSemVerMajor": true}}, "@storybook/client-api": {"name": "@storybook/client-api", "severity": "low", "isDirect": false, "via": ["@storybook/addons", "@storybook/channel-postmessage", "@storybook/client-logger", "global"], "effects": ["@storybook/addon-actions", "@storybook/html"], "range": "<=7.0.0-rc.11", "nodes": ["node_modules/@storybook/client-api"], "fixAvailable": {"name": "@storybook/addon-actions", "version": "9.0.8", "isSemVerMajor": true}}, "@storybook/client-logger": {"name": "@storybook/client-logger", "severity": "low", "isDirect": false, "via": ["global"], "effects": ["@storybook/addons", "@storybook/api", "@storybook/channel-postmessage", "@storybook/client-api", "@storybook/components", "@storybook/router", "@storybook/theming", "@storybook/ui"], "range": "6.0.0-alpha.0 - 7.0.0-rc.11", "nodes": ["node_modules/@storybook/client-logger"], "fixAvailable": {"name": "@storybook/addon-actions", "version": "9.0.8", "isSemVerMajor": true}}, "@storybook/components": {"name": "@storybook/components", "severity": "moderate", "isDirect": false, "via": ["@storybook/client-logger", "@storybook/theming", "global", "react-syntax-highlighter"], "effects": ["@storybook/addon-actions", "@storybook/builder-webpack4", "@storybook/ui"], "range": "4.0.0-alpha.0 - 7.0.0-rc.11", "nodes": ["node_modules/@storybook/components"], "fixAvailable": {"name": "@storybook/addon-actions", "version": "9.0.8", "isSemVerMajor": true}}, "@storybook/core": {"name": "@storybook/core", "severity": "high", "isDirect": false, "via": ["@storybook/core-client", "@storybook/core-server"], "effects": [], "range": "6.2.0-alpha.0 - 6.5.17-alpha.0", "nodes": ["node_modules/@storybook/core"], "fixAvailable": true}, "@storybook/core-client": {"name": "@storybook/core-client", "severity": "moderate", "isDirect": false, "via": ["@storybook/addons", "@storybook/channel-postmessage", "@storybook/client-api", "@storybook/client-logger", "@storybook/ui", "global"], "effects": ["@storybook/core", "@storybook/core-server"], "range": "<=7.0.0-rc.11", "nodes": ["node_modules/@storybook/core-client"], "fixAvailable": true}, "@storybook/core-common": {"name": "@storybook/core-common", "severity": "moderate", "isDirect": false, "via": ["webpack"], "effects": ["@storybook/html"], "range": "<=6.5.17-alpha.0", "nodes": ["node_modules/@storybook/core-common"], "fixAvailable": {"name": "@storybook/html", "version": "9.1.10", "isSemVerMajor": true}}, "@storybook/core-server": {"name": "@storybook/core-server", "severity": "high", "isDirect": false, "via": ["@storybook/addons", "@storybook/builder-webpack4", "@storybook/core-client", "@storybook/core-common", "@storybook/theming", "@storybook/ui", "cpy", "css-loader", "global", "ip", "telejson", "webpack", "webpack-dev-middleware"], "effects": ["@storybook/core"], "range": "<=7.6.19 || 8.0.0-alpha.0 - 8.1.5 || 8.2.0-alpha.0 - 8.2.0-beta.3", "nodes": ["node_modules/@storybook/core-server"], "fixAvailable": true}, "@storybook/html": {"name": "@storybook/html", "severity": "high", "isDirect": true, "via": ["@storybook/addons", "@storybook/client-api", "@storybook/core", "@storybook/core-common", "global"], "effects": [], "range": "<=7.0.0-rc.11", "nodes": ["node_modules/@storybook/html"], "fixAvailable": {"name": "@storybook/html", "version": "9.1.10", "isSemVerMajor": true}}, "@storybook/router": {"name": "@storybook/router", "severity": "low", "isDirect": false, "via": ["@storybook/client-logger", "global"], "effects": ["@storybook/addons", "@storybook/api", "@storybook/ui"], "range": "<=7.0.0-rc.11", "nodes": ["node_modules/@storybook/router"], "fixAvailable": {"name": "@storybook/addon-actions", "version": "9.0.8", "isSemVerMajor": true}}, "@storybook/theming": {"name": "@storybook/theming", "severity": "low", "isDirect": false, "via": ["@storybook/client-logger", "global"], "effects": ["@storybook/addon-actions", "@storybook/components"], "range": "<=7.0.0-rc.11", "nodes": ["node_modules/@storybook/theming"], "fixAvailable": {"name": "@storybook/addon-actions", "version": "9.0.8", "isSemVerMajor": true}}, "@storybook/ui": {"name": "@storybook/ui", "severity": "moderate", "isDirect": false, "via": ["@storybook/addons", "@storybook/api", "@storybook/client-logger", "@storybook/components", "@storybook/router", "@storybook/theming", "global", "markdown-to-jsx"], "effects": ["@storybook/builder-webpack4", "@storybook/core-client"], "range": "3.1.0 - 7.0.0-alpha.10", "nodes": ["node_modules/@storybook/ui"], "fixAvailable": true}, "@wikimedia/mw-node-qunit": {"name": "@wikimedia/mw-node-qunit", "severity": "moderate", "isDirect": true, "via": ["eslint-config-wikimedia", "jsdom", "qunit"], "effects": [], "range": "<=6.2.1", "nodes": ["node_modules/@wikimedia/mw-node-qunit"], "fixAvailable": {"name": "@wikimedia/mw-node-qunit", "version": "6.4.2", "isSemVerMajor": false}}, "ansi-regex": {"name": "ansi-regex", "severity": "high", "isDirect": false, "via": [{"source": 1094091, "name": "ansi-regex", "dependency": "ansi-regex", "title": "Inefficient Regular Expression Complexity in chalk/ansi-regex", "url": "https://github.com/advisories/GHSA-93q8-gq69-wqmw", "severity": "high", "cwe": ["CWE-697", "CWE-1333"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": ">=4.0.0 <4.1.1"}], "effects": [], "range": "4.0.0 - 4.1.0", "nodes": ["", ""], "fixAvailable": true}, "anymatch": {"name": "anymatch", "severity": "moderate", "isDirect": false, "via": ["micromatch"], "effects": ["chokidar", "sane"], "range": "1.2.0 - 2.0.0", "nodes": ["node_modules/sane/node_modules/anymatch", "node_modules/watchpack-chokidar2/node_modules/anymatch"], "fixAvailable": {"name": "@wikimedia/mw-node-qunit", "version": "6.4.2", "isSemVerMajor": false}}, "autoprefixer": {"name": "autoprefixer", "severity": "moderate", "isDirect": false, "via": ["postcss"], "effects": ["stylelint"], "range": "1.0.20131222 - 9.8.8", "nodes": ["node_modules/autoprefixer"], "fixAvailable": {"name": "stylelint-config-wikimedia", "version": "0.18.0", "isSemVerMajor": true}}, "axios": {"name": "axios", "severity": "high", "isDirect": false, "via": [{"source": 1097679, "name": "axios", "dependency": "axios", "title": "Axios Cross-Site Request Forgery Vulnerability", "url": "https://github.com/advisories/GHSA-wf5p-g6vw-rhxx", "severity": "moderate", "cwe": ["CWE-352"], "cvss": {"score": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"}, "range": ">=0.8.1 <0.28.0"}, {"source": 1103617, "name": "axios", "dependency": "axios", "title": "axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL", "url": "https://github.com/advisories/GHSA-jr5f-v2jv-69x6", "severity": "high", "cwe": ["CWE-918"], "cvss": {"score": 0, "vectorString": null}, "range": "<0.30.0"}, {"source": 1108262, "name": "axios", "dependency": "axios", "title": "Axios is vulnerable to DoS attack through lack of data size check", "url": "https://github.com/advisories/GHSA-4hjh-wcwx-xvwj", "severity": "high", "cwe": ["CWE-770"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": "<0.30.2"}], "effects": ["bundlesize", "github-build"], "range": "<=0.30.1", "nodes": ["", "node_modules/axios"], "fixAvailable": {"name": "bundlesize", "version": "0.18.2", "isSemVerMajor": false}}, "body-parser": {"name": "body-parser", "severity": "high", "isDirect": false, "via": [{"source": 1099520, "name": "body-parser", "dependency": "body-parser", "title": "body-parser vulnerable to denial of service when url encoding is enabled", "url": "https://github.com/advisories/GHSA-qwcr-r2fm-qrc7", "severity": "high", "cwe": ["CWE-405"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": "<1.20.3"}, "qs"], "effects": ["express"], "range": "<=1.20.2", "nodes": [""], "fixAvailable": true}, "brace-expansion": {"name": "brace-expansion", "severity": "low", "isDirect": false, "via": [{"source": 1105443, "name": "brace-expansion", "dependency": "brace-expansion", "title": "brace-expansion Regular Expression Denial of Service vulnerability", "url": "https://github.com/advisories/GHSA-v6h2-p8h4-qcjw", "severity": "low", "cwe": ["CWE-400"], "cvss": {"score": 3.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L"}, "range": ">=1.0.0 <=1.1.11"}], "effects": [], "range": "1.0.0 - 1.1.11", "nodes": [""], "fixAvailable": true}, "braces": {"name": "braces", "severity": "high", "isDirect": false, "via": [{"source": 1098094, "name": "braces", "dependency": "braces", "title": "Uncontrolled resource consumption in braces", "url": "https://github.com/advisories/GHSA-grv7-fg5c-xmjg", "severity": "high", "cwe": ["CWE-400", "CWE-1050"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": "<3.0.3"}], "effects": ["chokidar", "micromatch"], "range": "<3.0.3", "nodes": ["", "node_modules/@storybook/builder-webpack4/node_modules/braces", "node_modules/fast-glob/node_modules/braces", "node_modules/findup-sync/node_modules/braces", "node_modules/react-dev-utils/node_modules/micromatch/node_modules/braces", "node_modules/sane/node_modules/braces", "node_modules/watchpack-chokidar2/node_modules/braces", "node_modules/webpack-cli/node_modules/braces", "node_modules/webpack/node_modules/braces"], "fixAvailable": {"name": "webpack", "version": "5.102.0", "isSemVerMajor": true}}, "browserify-sign": {"name": "browserify-sign", "severity": "high", "isDirect": false, "via": [{"source": 1102445, "name": "browserify-sign", "dependency": "browserify-sign", "title": "browserify-sign upper bound check issue in `dsaVerify` leads to a signature forgery attack", "url": "https://github.com/advisories/GHSA-x9w5-v3q2-3rhw", "severity": "high", "cwe": ["CWE-347"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}, "range": ">=2.6.0 <=4.2.1"}], "effects": [], "range": "2.6.0 - 4.2.1", "nodes": [""], "fixAvailable": true}, "browserslist": {"name": "browserslist", "severity": "moderate", "isDirect": false, "via": [{"source": 1093035, "name": "browserslist", "dependency": "browserslist", "title": "Regular Expression Denial of Service in browserslist", "url": "https://github.com/advisories/GHSA-w8qv-6jwh-64r5", "severity": "moderate", "cwe": ["CWE-400", "CWE-1333"], "cvss": {"score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}, "range": ">=4.0.0 <4.16.5"}], "effects": ["react-dev-utils"], "range": "4.0.0 - 4.16.4", "nodes": ["node_modules/react-dev-utils/node_modules/browserslist"], "fixAvailable": true}, "bundlesize": {"name": "bundlesize", "severity": "high", "isDirect": true, "via": ["axios"], "effects": [], "range": "0.3.0 - 0.18.1 || >=1.0.0-beta.1", "nodes": ["node_modules/bundlesize"], "fixAvailable": {"name": "bundlesize", "version": "0.18.2", "isSemVerMajor": false}}, "chokidar": {"name": "chokidar", "severity": "high", "isDirect": false, "via": ["anymatch", "braces", "readdirp"], "effects": ["watchpack-chokidar2"], "range": "1.3.0 - 2.1.8", "nodes": ["node_modules/watchpack-chokidar2/node_modules/chokidar"], "fixAvailable": true}, "cipher-base": {"name": "cipher-base", "severity": "critical", "isDirect": false, "via": [{"source": 1107538, "name": "cipher-base", "dependency": "cipher-base", "title": "cipher-base is missing type checks, leading to hash rewind and passing on crafted data", "url": "https://github.com/advisories/GHSA-cpq7-6gpm-g9rc", "severity": "critical", "cwe": ["CWE-20"], "cvss": {"score": 9.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"}, "range": "<=1.0.4"}], "effects": [], "range": "<=1.0.4", "nodes": [""], "fixAvailable": true}, "cookie": {"name": "cookie", "severity": "low", "isDirect": false, "via": [{"source": 1103907, "name": "cookie", "dependency": "cookie", "title": "cookie accepts cookie name, path, and domain with out of bounds characters", "url": "https://github.com/advisories/GHSA-pxg6-pf52-xh8x", "severity": "low", "cwe": ["CWE-74"], "cvss": {"score": 0, "vectorString": null}, "range": "<0.7.0"}], "effects": ["express"], "range": "<0.7.0", "nodes": [""], "fixAvailable": true}, "core-js-compat": {"name": "core-js-compat", "severity": "high", "isDirect": false, "via": ["semver"], "effects": [], "range": "3.6.0 - 3.25.0", "nodes": [""], "fixAvailable": true}, "cpy": {"name": "cpy", "severity": "moderate", "isDirect": false, "via": ["globby"], "effects": ["@storybook/core-server"], "range": "7.0.0 - 8.1.2", "nodes": ["node_modules/cpy"], "fixAvailable": true}, "cross-spawn": {"name": "cross-spawn", "severity": "high", "isDirect": false, "via": [{"source": 1104663, "name": "cross-spawn", "dependency": "cross-spawn", "title": "Regular Expression Denial of Service (ReDoS) in cross-spawn", "url": "https://github.com/advisories/GHSA-3xgq-45jj-v275", "severity": "high", "cwe": ["CWE-1333"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": "<6.0.6"}, {"source": 1104664, "name": "cross-spawn", "dependency": "cross-spawn", "title": "Regular Expression Denial of Service (ReDoS) in cross-spawn", "url": "https://github.com/advisories/GHSA-3xgq-45jj-v275", "severity": "high", "cwe": ["CWE-1333"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": ">=7.0.0 <7.0.5"}], "effects": ["pre-commit", "react-dev-utils", "webpack-cli"], "range": "<6.0.6 || >=7.0.0 <7.0.5", "nodes": ["", "", "", "", "node_modules/cross-spawn", "node_modules/react-dev-utils/node_modules/cross-spawn"], "fixAvailable": {"name": "pre-commit", "version": "1.0.10", "isSemVerMajor": true}}, "css-loader": {"name": "css-loader", "severity": "moderate", "isDirect": false, "via": ["icss-utils", "postcss", "postcss-modules-extract-imports", "postcss-modules-local-by-default", "postcss-modules-scope", "postcss-modules-values"], "effects": [], "range": "0.15.0 - 4.3.0", "nodes": ["node_modules/css-loader"], "fixAvailable": true}, "decode-uri-component": {"name": "decode-uri-component", "severity": "high", "isDirect": false, "via": [{"source": 1094087, "name": "decode-uri-component", "dependency": "decode-uri-component", "title": "decode-uri-component vulnerable to Denial of Service (DoS)", "url": "https://github.com/advisories/GHSA-w573-4hg7-7wgq", "severity": "high", "cwe": ["CWE-20"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": "<0.2.1"}], "effects": [], "range": "<0.2.1", "nodes": [""], "fixAvailable": true}, "elliptic": {"name": "elliptic", "severity": "critical", "isDirect": false, "via": [{"source": 1098593, "name": "elliptic", "dependency": "elliptic", "title": "Elliptic's EDDSA missing signature length check", "url": "https://github.com/advisories/GHSA-f7q4-pwc6-w24p", "severity": "low", "cwe": ["CWE-347"], "cvss": {"score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}, "range": ">=4.0.0 <=6.5.6"}, {"source": 1098594, "name": "elliptic", "dependency": "elliptic", "title": "Elliptic's ECDSA missing check for whether leading bit of r and s is zero", "url": "https://github.com/advisories/GHSA-977x-g7h5-7qgw", "severity": "low", "cwe": ["CWE-130"], "cvss": {"score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}, "range": ">=2.0.0 <=6.5.6"}, {"source": 1098595, "name": "elliptic", "dependency": "elliptic", "title": "Elliptic allows BER-encoded signatures", "url": "https://github.com/advisories/GHSA-49q7-c7j4-3p7m", "severity": "low", "cwe": ["CWE-347"], "cvss": {"score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}, "range": ">=5.2.1 <=6.5.6"}, {"source": 1101424, "name": "elliptic", "dependency": "elliptic", "title": "Elliptic's verify function omits uniqueness validation", "url": "https://github.com/advisories/GHSA-434g-2637-qmqr", "severity": "low", "cwe": ["CWE-347"], "cvss": {"score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}, "range": "<6.5.6"}, {"source": 1102901, "name": "elliptic", "dependency": "elliptic", "title": "Elliptic's private key extraction in ECDSA upon signing a malformed input (e.g. a string)", "url": "https://github.com/advisories/GHSA-vjh7-7g9h-fjfh", "severity": "critical", "cwe": ["CWE-200"], "cvss": {"score": 0, "vectorString": null}, "range": "<=6.6.0"}, {"source": 1105750, "name": "elliptic", "dependency": "elliptic", "title": "Valid ECDSA signatures erroneously rejected in Elliptic", "url": "https://github.com/advisories/GHSA-fc9h-whq2-v747", "severity": "low", "cwe": ["CWE-347"], "cvss": {"score": 4.8, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"}, "range": "<6.6.0"}], "effects": [], "range": "<=6.6.0", "nodes": [""], "fixAvailable": true}, "eslint": {"name": "eslint", "severity": "low", "isDirect": false, "via": ["inquirer"], "effects": ["eslint-config-wikimedia"], "range": "4.0.0-alpha.0 - 7.2.0", "nodes": ["node_modules/@wikimedia/mw-node-qunit/node_modules/eslint"], "fixAvailable": {"name": "eslint-config-wikimedia", "version": "0.31.0", "isSemVerMajor": true}}, "eslint-config-wikimedia": {"name": "eslint-config-wikimedia", "severity": "high", "isDirect": true, "via": ["eslint", "eslint-plugin-compat"], "effects": ["@wikimedia/mw-node-qunit"], "range": "0.18.0 - 0.21.0 || 0.9.0 - 0.15.3", "nodes": ["node_modules/@wikimedia/mw-node-qunit/node_modules/eslint-config-wikimedia", "node_modules/eslint-config-wikimedia"], "fixAvailable": {"name": "eslint-config-wikimedia", "version": "0.31.0", "isSemVerMajor": true}}, "eslint-plugin-compat": {"name": "eslint-plugin-compat", "severity": "high", "isDirect": false, "via": ["semver"], "effects": ["eslint-config-wikimedia"], "range": "3.6.0-0 - 4.1.4", "nodes": ["node_modules/eslint-plugin-compat"], "fixAvailable": {"name": "eslint-config-wikimedia", "version": "0.31.0", "isSemVerMajor": true}}, "express": {"name": "express", "severity": "high", "isDirect": false, "via": [{"source": 1096820, "name": "express", "dependency": "express", "title": "Express.js Open Redirect in malformed URLs", "url": "https://github.com/advisories/GHSA-rv95-896h-c2vc", "severity": "moderate", "cwe": ["CWE-601", "CWE-1286"], "cvss": {"score": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}, "range": "<4.19.2"}, {"source": 1100530, "name": "express", "dependency": "express", "title": "express vulnerable to XSS via response.redirect()", "url": "https://github.com/advisories/GHSA-qw6h-vgh9-j6wx", "severity": "low", "cwe": ["CWE-79"], "cvss": {"score": 5, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L"}, "range": "<4.20.0"}, "body-parser", "cookie", "path-to-regexp", "qs", "send", "serve-static"], "effects": [], "range": "<=4.21.0 || 5.0.0-alpha.1 - 5.0.0", "nodes": [""], "fixAvailable": true}, "external-editor": {"name": "external-editor", "severity": "low", "isDirect": false, "via": ["tmp"], "effects": ["inquirer"], "range": ">=1.1.1", "nodes": ["node_modules/external-editor"], "fixAvailable": {"name": "eslint-config-wikimedia", "version": "0.31.0", "isSemVerMajor": true}}, "fast-glob": {"name": "fast-glob", "severity": "moderate", "isDirect": false, "via": ["micromatch"], "effects": ["globby"], "range": "<=2.2.7", "nodes": ["node_modules/fast-glob"], "fixAvailable": true}, "findup-sync": {"name": "findup-sync", "severity": "moderate", "isDirect": false, "via": ["micromatch"], "effects": ["qunit", "webpack-cli"], "range": "0.4.0 - 3.0.0", "nodes": ["", "node_modules/webpack-cli/node_modules/findup-sync"], "fixAvailable": {"name": "@wikimedia/mw-node-qunit", "version": "6.4.2", "isSemVerMajor": false}}, "follow-redirects": {"name": "follow-redirects", "severity": "high", "isDirect": false, "via": [{"source": 1092623, "name": "follow-redirects", "dependency": "follow-redirects", "title": "Exposure of Sensitive Information to an Unauthorized Actor in follow-redirects", "url": "https://github.com/advisories/GHSA-pw2r-vq6v-hr8c", "severity": "moderate", "cwe": ["CWE-200", "CWE-212"], "cvss": {"score": 5.9, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"}, "range": "<1.14.8"}, {"source": 1096353, "name": "follow-redirects", "dependency": "follow-redirects", "title": "Follow Redirects improperly handles URLs in the url.parse() function", "url": "https://github.com/advisories/GHSA-jchw-25xp-jwwc", "severity": "moderate", "cwe": ["CWE-20", "CWE-601"], "cvss": {"score": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}, "range": "<1.15.4"}, {"source": 1096856, "name": "follow-redirects", "dependency": "follow-redirects", "title": "follow-redirects' Proxy-Authorization header kept across hosts", "url": "https://github.com/advisories/GHSA-cxjh-pqwp-8mfp", "severity": "moderate", "cwe": ["CWE-200"], "cvss": {"score": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}, "range": "<=1.15.5"}, {"source": 1102323, "name": "follow-redirects", "dependency": "follow-redirects", "title": "Exposure of sensitive information in follow-redirects", "url": "https://github.com/advisories/GHSA-74fj-2j2h-c42q", "severity": "high", "cwe": ["CWE-359"], "cvss": {"score": 8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"}, "range": "<1.14.7"}], "effects": [], "range": "<=1.15.5", "nodes": [""], "fixAvailable": true}, "fork-ts-checker-webpack-plugin": {"name": "fork-ts-checker-webpack-plugin", "severity": "moderate", "isDirect": false, "via": ["micromatch"], "effects": ["react-dev-utils"], "range": "0.4.14 - 4.1.6", "nodes": ["node_modules/@storybook/builder-webpack4/node_modules/fork-ts-checker-webpack-plugin", "node_modules/react-dev-utils/node_modules/fork-ts-checker-webpack-plugin"], "fixAvailable": true}, "form-data": {"name": "form-data", "severity": "critical", "isDirect": false, "via": [{"source": 1106508, "name": "form-data", "dependency": "form-data", "title": "form-data uses unsafe random function in form-data for choosing boundary", "url": "https://github.com/advisories/GHSA-fjxv-7rqg-78g4", "severity": "critical", "cwe": ["CWE-330"], "cvss": {"score": 0, "vectorString": null}, "range": ">=3.0.0 <3.0.4"}, {"source": 1106509, "name": "form-data", "dependency": "form-data", "title": "form-data uses unsafe random function in form-data for choosing boundary", "url": "https://github.com/advisories/GHSA-fjxv-7rqg-78g4", "severity": "critical", "cwe": ["CWE-330"], "cvss": {"score": 0, "vectorString": null}, "range": "<2.5.4"}], "effects": ["request"], "range": ">=3.0.0 <3.0.4 || <2.5.4", "nodes": ["", "node_modules/request/node_modules/form-data"], "fixAvailable": {"name": "jsdom", "version": "27.0.0", "isSemVerMajor": true}}, "github-build": {"name": "github-build", "severity": "high", "isDirect": false, "via": ["axios"], "effects": [], "range": "<=1.2.3", "nodes": [""], "fixAvailable": true}, "global": {"name": "global", "severity": "low", "isDirect": false, "via": ["min-document"], "effects": ["@storybook/addon-actions", "@storybook/addons", "@storybook/api", "@storybook/channel-postmessage", "@storybook/client-api", "@storybook/client-logger", "@storybook/components", "@storybook/core-client", "@storybook/core-server", "@storybook/html", "@storybook/router", "@storybook/theming", "@storybook/ui", "telejson"], "range": ">=2.0.3", "nodes": ["node_modules/global"], "fixAvailable": {"name": "@storybook/html", "version": "9.1.10", "isSemVerMajor": true}}, "globby": {"name": "globby", "severity": "moderate", "isDirect": false, "via": ["fast-glob"], "effects": ["cpy"], "range": "8.0.0 - 9.2.0", "nodes": ["node_modules/globby"], "fixAvailable": true}, "icss-utils": {"name": "icss-utils", "severity": "moderate", "isDirect": false, "via": ["postcss"], "effects": ["css-loader", "postcss-modules-local-by-default", "postcss-modules-values"], "range": "<=4.1.1", "nodes": ["node_modules/icss-utils"], "fixAvailable": true}, "immer": {"name": "immer", "severity": "critical", "isDirect": false, "via": [{"source": 1097196, "name": "immer", "dependency": "immer", "title": "Prototype Pollution in immer", "url": "https://github.com/advisories/GHSA-c36v-fmgq-m8hx", "severity": "high", "cwe": ["CWE-915", "CWE-1321"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": ">=7.0.0 <9.0.6"}, {"source": 1097209, "name": "immer", "dependency": "immer", "title": "Prototype Pollution in immer", "url": "https://github.com/advisories/GHSA-33f9-j839-rf8h", "severity": "critical", "cwe": ["CWE-843", "CWE-1321"], "cvss": {"score": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "range": ">=7.0.0 <9.0.6"}], "effects": [], "range": "7.0.0 - 9.0.5", "nodes": ["node_modules/immer"], "fixAvailable": true}, "inquirer": {"name": "inquirer", "severity": "low", "isDirect": false, "via": ["external-editor"], "effects": ["eslint"], "range": "3.0.0 - 8.2.6 || 9.0.0 - 9.3.7", "nodes": [""], "fixAvailable": {"name": "eslint-config-wikimedia", "version": "0.31.0", "isSemVerMajor": true}}, "ip": {"name": "ip", "severity": "high", "isDirect": false, "via": [{"source": 1097720, "name": "ip", "dependency": "ip", "title": "NPM IP package incorrectly identifies some private IP addresses as public", "url": "https://github.com/advisories/GHSA-78xj-cgh5-2h22", "severity": "low", "cwe": ["CWE-918"], "cvss": {"score": 0, "vectorString": null}, "range": "<1.1.9"}, {"source": 1101851, "name": "ip", "dependency": "ip", "title": "ip SSRF improper categorization in isPublic", "url": "https://github.com/advisories/GHSA-2p57-rm9w-gvfp", "severity": "high", "cwe": ["CWE-918"], "cvss": {"score": 8.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "range": "<=2.0.1"}], "effects": ["@storybook/core-server"], "range": "*", "nodes": [""], "fixAvailable": true}, "jsdoc": {"name": "jsdoc", "severity": "high", "isDirect": true, "via": ["markdown-it", "marked", "taffydb"], "effects": [], "range": "3.2.0-dev - 3.6.11", "nodes": ["node_modules/jsdoc"], "fixAvailable": {"name": "jsdoc", "version": "3.6.11", "isSemVerMajor": false}}, "jsdom": {"name": "jsdom", "severity": "moderate", "isDirect": true, "via": ["request", "request-promise-native", "tough-cookie"], "effects": ["@wikimedia/mw-node-qunit"], "range": "0.1.20 || 0.2.0 - 16.5.3", "nodes": ["node_modules/jsdom"], "fixAvailable": {"name": "jsdom", "version": "27.0.0", "isSemVerMajor": true}}, "json-schema": {"name": "json-schema", "severity": "critical", "isDirect": false, "via": [{"source": 1101855, "name": "json-schema", "dependency": "json-schema", "title": "json-schema is vulnerable to Prototype Pollution", "url": "https://github.com/advisories/GHSA-896r-f27r-55mw", "severity": "critical", "cwe": ["CWE-915", "CWE-1321"], "cvss": {"score": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "range": "<0.4.0"}], "effects": ["jsprim"], "range": "<0.4.0", "nodes": [""], "fixAvailable": true}, "json5": {"name": "json5", "severity": "high", "isDirect": false, "via": [{"source": 1096543, "name": "json5", "dependency": "json5", "title": "Prototype Pollution in JSON5 via Parse Method", "url": "https://github.com/advisories/GHSA-9c47-m6qq-7p4h", "severity": "high", "cwe": ["CWE-1321"], "cvss": {"score": 7.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H"}, "range": "<1.0.2"}, {"source": 1096544, "name": "json5", "dependency": "json5", "title": "Prototype Pollution in JSON5 via Parse Method", "url": "https://github.com/advisories/GHSA-9c47-m6qq-7p4h", "severity": "high", "cwe": ["CWE-1321"], "cvss": {"score": 7.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H"}, "range": ">=2.0.0 <2.2.2"}], "effects": [], "range": "<1.0.2 || >=2.0.0 <2.2.2", "nodes": ["", "", ""], "fixAvailable": true}, "jsprim": {"name": "jsprim", "severity": "critical", "isDirect": false, "via": ["json-schema"], "effects": [], "range": "0.3.0 - 1.4.1 || 2.0.0 - 2.0.1", "nodes": [""], "fixAvailable": true}, "less": {"name": "less", "severity": "moderate", "isDirect": true, "via": ["request"], "effects": [], "range": "1.4.0-b1 - 2.6.1 || 2.7.2 - 3.11.3", "nodes": ["node_modules/less"], "fixAvailable": {"name": "less", "version": "3.13.1", "isSemVerMajor": false}}, "loader-utils": {"name": "loader-utils", "severity": "critical", "isDirect": false, "via": [{"source": 1094088, "name": "loader-utils", "dependency": "loader-utils", "title": "Prototype pollution in webpack loader-utils", "url": "https://github.com/advisories/GHSA-76p3-8jx3-jpfq", "severity": "critical", "cwe": ["CWE-1321"], "cvss": {"score": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "range": "<1.4.1"}, {"source": 1094089, "name": "loader-utils", "dependency": "loader-utils", "title": "Prototype pollution in webpack loader-utils", "url": "https://github.com/advisories/GHSA-76p3-8jx3-jpfq", "severity": "critical", "cwe": ["CWE-1321"], "cvss": {"score": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "range": ">=2.0.0 <2.0.3"}, {"source": 1095054, "name": "loader-utils", "dependency": "loader-utils", "title": "loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS) via url variable", "url": "https://github.com/advisories/GHSA-3rfm-jhwj-7488", "severity": "high", "cwe": ["CWE-1333"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": ">=2.0.0 <2.0.4"}, {"source": 1095055, "name": "loader-utils", "dependency": "loader-utils", "title": "loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS) via url variable", "url": "https://github.com/advisories/GHSA-3rfm-jhwj-7488", "severity": "high", "cwe": ["CWE-1333"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": ">=1.0.0 <1.4.2"}, {"source": 1097142, "name": "loader-utils", "dependency": "loader-utils", "title": "loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS)", "url": "https://github.com/advisories/GHSA-hhq3-ff78-jv3g", "severity": "high", "cwe": ["CWE-400", "CWE-1333"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": ">=2.0.0 <2.0.4"}, {"source": 1097143, "name": "loader-utils", "dependency": "loader-utils", "title": "loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS)", "url": "https://github.com/advisories/GHSA-hhq3-ff78-jv3g", "severity": "high", "cwe": ["CWE-400", "CWE-1333"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": ">=1.0.0 <1.4.2"}], "effects": ["react-dev-utils", "webpack-cli"], "range": "<=1.4.1 || 2.0.0 - 2.0.3", "nodes": ["", "", "", "", "", "", "", "node_modules/react-dev-utils/node_modules/loader-utils", "node_modules/webpack-cli/node_modules/loader-utils"], "fixAvailable": {"name": "webpack-cli", "version": "3.3.12", "isSemVerMajor": false}}, "markdown-it": {"name": "markdown-it", "severity": "moderate", "isDirect": false, "via": [{"source": 1092663, "name": "markdown-it", "dependency": "markdown-it", "title": "Uncontrolled Resource Consumption in markdown-it", "url": "https://github.com/advisories/GHSA-6vfc-qv3f-vr6c", "severity": "moderate", "cwe": ["CWE-400", "CWE-1333"], "cvss": {"score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}, "range": "<12.3.2"}], "effects": ["jsdoc"], "range": "<12.3.2", "nodes": ["node_modules/markdown-it"], "fixAvailable": {"name": "jsdoc", "version": "3.6.11", "isSemVerMajor": false}}, "markdown-to-jsx": {"name": "markdown-to-jsx", "severity": "moderate", "isDirect": false, "via": [{"source": 1100074, "name": "markdown-to-jsx", "dependency": "markdown-to-jsx", "title": "Cross site scripting in markdown-to-jsx", "url": "https://github.com/advisories/GHSA-4wx3-54gh-9fr9", "severity": "moderate", "cwe": ["CWE-79"], "cvss": {"score": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}, "range": "<7.4.0"}], "effects": ["@storybook/ui"], "range": "<7.4.0", "nodes": ["", "node_modules/@storybook/ui/node_modules/markdown-to-jsx"], "fixAvailable": true}, "marked": {"name": "marked", "severity": "high", "isDirect": false, "via": [{"source": 1095051, "name": "marked", "dependency": "marked", "title": "Inefficient Regular Expression Complexity in marked", "url": "https://github.com/advisories/GHSA-rrrm-qjm4-v8hf", "severity": "high", "cwe": ["CWE-400", "CWE-1333"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": "<4.0.10"}, {"source": 1095052, "name": "marked", "dependency": "marked", "title": "Inefficient Regular Expression Complexity in marked", "url": "https://github.com/advisories/GHSA-5v2h-r2cx-5xgj", "severity": "high", "cwe": ["CWE-1333"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": "<4.0.10"}], "effects": ["jsdoc"], "range": "<=4.0.9", "nodes": ["node_modules/marked"], "fixAvailable": {"name": "jsdoc", "version": "3.6.11", "isSemVerMajor": false}}, "micromatch": {"name": "micromatch", "severity": "high", "isDirect": false, "via": [{"source": 1098681, "name": "micromatch", "dependency": "micromatch", "title": "Regular Expression Denial of Service (ReDoS) in micromatch", "url": "https://github.com/advisories/GHSA-952p-6rrq-rcjv", "severity": "moderate", "cwe": ["CWE-1333"], "cvss": {"score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}, "range": "<4.0.8"}, "braces"], "effects": ["anymatch", "fast-glob", "findup-sync", "fork-ts-checker-webpack-plugin", "readdirp", "sane", "webpack"], "range": "<=4.0.7", "nodes": ["", "", "node_modules/@storybook/builder-webpack4/node_modules/micromatch", "node_modules/fast-glob/node_modules/micromatch", "node_modules/findup-sync/node_modules/micromatch", "node_modules/react-dev-utils/node_modules/micromatch", "node_modules/sane/node_modules/micromatch", "node_modules/watchpack-chokidar2/node_modules/micromatch", "node_modules/webpack-cli/node_modules/micromatch", "node_modules/webpack/node_modules/micromatch"], "fixAvailable": {"name": "webpack", "version": "5.102.0", "isSemVerMajor": true}}, "min-document": {"name": "min-document", "severity": "low", "isDirect": false, "via": [{"source": 1108264, "name": "min-document", "dependency": "min-document", "title": "min-document vulnerable to prototype pollution", "url": "https://github.com/advisories/GHSA-rx8g-88g5-qh64", "severity": "low", "cwe": ["CWE-1321"], "cvss": {"score": 0, "vectorString": null}, "range": "<=2.19.0"}], "effects": ["global"], "range": "*", "nodes": [""], "fixAvailable": {"name": "@storybook/html", "version": "9.1.10", "isSemVerMajor": true}}, "minimatch": {"name": "minimatch", "severity": "high", "isDirect": false, "via": [{"source": 1096485, "name": "minimatch", "dependency": "minimatch", "title": "minimatch ReDoS vulnerability", "url": "https://github.com/advisories/GHSA-f8q6-p94x-37v3", "severity": "high", "cwe": ["CWE-400", "CWE-1333"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": "<3.0.5"}], "effects": ["recursive-readdir"], "range": "<3.0.5", "nodes": ["node_modules/minimatch"], "fixAvailable": true}, "minimist": {"name": "minimist", "severity": "critical", "isDirect": false, "via": [{"source": 1097678, "name": "minimist", "dependency": "minimist", "title": "Prototype Pollution in minimist", "url": "https://github.com/advisories/GHSA-xvch-5gv4-984h", "severity": "critical", "cwe": ["CWE-1321"], "cvss": {"score": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "range": ">=1.0.0 <1.2.6"}], "effects": [], "range": "1.0.0 - 1.2.5", "nodes": [""], "fixAvailable": true}, "nanoid": {"name": "nanoid", "severity": "moderate", "isDirect": false, "via": [{"source": 1089011, "name": "nanoid", "dependency": "nanoid", "title": "Exposure of Sensitive Information to an Unauthorized Actor in nanoid", "url": "https://github.com/advisories/GHSA-qrpm-p2h7-hrv2", "severity": "moderate", "cwe": ["CWE-200"], "cvss": {"score": 5.5, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}, "range": ">=3.0.0 <3.1.31"}, {"source": 1101163, "name": "nanoid", "dependency": "nanoid", "title": "Predictable results in nanoid generation when given non-integer values", "url": "https://github.com/advisories/GHSA-mwcw-c2x4-8c55", "severity": "moderate", "cwe": ["CWE-835"], "cvss": {"score": 4.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"}, "range": "<3.3.8"}], "effects": [], "range": "<=3.3.7", "nodes": ["", ""], "fixAvailable": true}, "node-fetch": {"name": "node-fetch", "severity": "high", "isDirect": false, "via": [{"source": 1095073, "name": "node-fetch", "dependency": "node-fetch", "title": "node-fetch forwards secure headers to untrusted sites", "url": "https://github.com/advisories/GHSA-r683-j2x4-v87g", "severity": "high", "cwe": ["CWE-173", "CWE-200", "CWE-601"], "cvss": {"score": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "range": "<2.6.7"}], "effects": [], "range": "<2.6.7", "nodes": [""], "fixAvailable": true}, "path-to-regexp": {"name": "path-to-regexp", "severity": "high", "isDirect": false, "via": [{"source": 1101849, "name": "path-to-regexp", "dependency": "path-to-regexp", "title": "path-to-regexp outputs backtracking regular expressions", "url": "https://github.com/advisories/GHSA-9wv6-86v2-598j", "severity": "high", "cwe": ["CWE-1333"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": ">=0.2.0 <1.9.0"}, {"source": 1101850, "name": "path-to-regexp", "dependency": "path-to-regexp", "title": "path-to-regexp outputs backtracking regular expressions", "url": "https://github.com/advisories/GHSA-9wv6-86v2-598j", "severity": "high", "cwe": ["CWE-1333"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": "<0.1.10"}, {"source": 1105199, "name": "path-to-regexp", "dependency": "path-to-regexp", "title": "path-to-regexp contains a ReDoS", "url": "https://github.com/advisories/GHSA-rhx6-c78j-4q9w", "severity": "high", "cwe": ["CWE-1333"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": "<0.1.12"}], "effects": ["express"], "range": "<=0.1.11 || 0.2.0 - 1.8.0", "nodes": ["", ""], "fixAvailable": true}, "pbkdf2": {"name": "pbkdf2", "severity": "critical", "isDirect": false, "via": [{"source": 1105691, "name": "pbkdf2", "dependency": "pbkdf2", "title": "pbkdf2 silently disregards Uint8Array input, returning static keys", "url": "https://github.com/advisories/GHSA-v62p-rq8g-8h59", "severity": "critical", "cwe": ["CWE-20"], "cvss": {"score": 0, "vectorString": null}, "range": "<=3.1.2"}, {"source": 1105692, "name": "pbkdf2", "dependency": "pbkdf2", "title": "pbkdf2 returns predictable uninitialized/zero-filled memory for non-normalized or unimplemented algos", "url": "https://github.com/advisories/GHSA-h7cp-r72f-jxh6", "severity": "critical", "cwe": ["CWE-20"], "cvss": {"score": 0, "vectorString": null}, "range": ">=3.0.10 <=3.1.2"}], "effects": [], "range": "<=3.1.2", "nodes": [""], "fixAvailable": true}, "postcss": {"name": "postcss", "severity": "moderate", "isDirect": false, "via": [{"source": 1094544, "name": "postcss", "dependency": "postcss", "title": "PostCSS line return parsing error", "url": "https://github.com/advisories/GHSA-7fh5-64p2-3v2j", "severity": "moderate", "cwe": ["CWE-74", "CWE-144"], "cvss": {"score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}, "range": "<8.4.31"}], "effects": ["@storybook/builder-webpack4", "autoprefixer", "css-loader", "icss-utils", "postcss-flexbugs-fixes", "postcss-less", "postcss-modules-extract-imports", "postcss-modules-local-by-default", "postcss-modules-scope", "postcss-modules-values", "postcss-safe-parser", "postcss-sass", "postcss-scss", "stylelint", "sugarss"], "range": "<8.4.31", "nodes": ["", "", "node_modules/postcss"], "fixAvailable": {"name": "stylelint-config-wikimedia", "version": "0.18.0", "isSemVerMajor": true}}, "postcss-flexbugs-fixes": {"name": "postcss-flexbugs-fixes", "severity": "moderate", "isDirect": false, "via": ["postcss"], "effects": [], "range": "<=4.2.1", "nodes": ["node_modules/postcss-flexbugs-fixes"], "fixAvailable": true}, "postcss-less": {"name": "postcss-less", "severity": "moderate", "isDirect": false, "via": ["postcss"], "effects": ["stylelint"], "range": "<=3.1.4", "nodes": ["node_modules/postcss-less"], "fixAvailable": {"name": "stylelint-config-wikimedia", "version": "0.18.0", "isSemVerMajor": true}}, "postcss-modules-extract-imports": {"name": "postcss-modules-extract-imports", "severity": "moderate", "isDirect": false, "via": ["postcss"], "effects": [], "range": "<=2.0.0", "nodes": ["node_modules/postcss-modules-extract-imports"], "fixAvailable": true}, "postcss-modules-local-by-default": {"name": "postcss-modules-local-by-default", "severity": "moderate", "isDirect": false, "via": ["icss-utils", "postcss"], "effects": [], "range": "<=4.0.0-rc.4", "nodes": ["node_modules/postcss-modules-local-by-default"], "fixAvailable": true}, "postcss-modules-scope": {"name": "postcss-modules-scope", "severity": "moderate", "isDirect": false, "via": ["postcss"], "effects": [], "range": "<=2.2.0", "nodes": ["node_modules/postcss-modules-scope"], "fixAvailable": true}, "postcss-modules-values": {"name": "postcss-modules-values", "severity": "moderate", "isDirect": false, "via": ["icss-utils", "postcss"], "effects": ["css-loader"], "range": "<=4.0.0-rc.5", "nodes": ["node_modules/postcss-modules-values"], "fixAvailable": true}, "postcss-safe-parser": {"name": "postcss-safe-parser", "severity": "moderate", "isDirect": false, "via": ["postcss"], "effects": ["stylelint"], "range": "<=4.0.2", "nodes": ["node_modules/postcss-safe-parser"], "fixAvailable": {"name": "stylelint-config-wikimedia", "version": "0.18.0", "isSemVerMajor": true}}, "postcss-sass": {"name": "postcss-sass", "severity": "moderate", "isDirect": false, "via": ["postcss"], "effects": ["stylelint"], "range": "<=0.4.4", "nodes": ["node_modules/postcss-sass"], "fixAvailable": {"name": "stylelint-config-wikimedia", "version": "0.18.0", "isSemVerMajor": true}}, "postcss-scss": {"name": "postcss-scss", "severity": "moderate", "isDirect": false, "via": ["postcss"], "effects": ["stylelint"], "range": "<=2.1.1", "nodes": ["node_modules/postcss-scss"], "fixAvailable": {"name": "stylelint-config-wikimedia", "version": "0.18.0", "isSemVerMajor": true}}, "pre-commit": {"name": "pre-commit", "severity": "high", "isDirect": false, "via": ["cross-spawn"], "effects": [], "range": ">=1.1.0", "nodes": [""], "fixAvailable": {"name": "pre-commit", "version": "1.0.10", "isSemVerMajor": true}}, "prismjs": {"name": "prismjs", "severity": "high", "isDirect": false, "via": [{"source": 1090424, "name": "prismjs", "dependency": "prismjs", "title": "Cross-site Scripting in Prism", "url": "https://github.com/advisories/GHSA-3949-f494-cm99", "severity": "high", "cwe": ["CWE-79"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:L"}, "range": ">=1.14.0 <1.27.0"}, {"source": 1105770, "name": "prismjs", "dependency": "prismjs", "title": "PrismJS DOM Clobbering vulnerability", "url": "https://github.com/advisories/GHSA-x7hr-w5r2-h6wg", "severity": "moderate", "cwe": ["CWE-79", "CWE-94"], "cvss": {"score": 4.9, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N"}, "range": "<1.30.0"}], "effects": ["refractor"], "range": "<=1.29.0", "nodes": [""], "fixAvailable": {"name": "@storybook/addon-actions", "version": "9.0.8", "isSemVerMajor": true}}, "qs": {"name": "qs", "severity": "high", "isDirect": false, "via": [{"source": 1104118, "name": "qs", "dependency": "qs", "title": "qs vulnerable to Prototype Pollution", "url": "https://github.com/advisories/GHSA-hrpp-h998-j3pp", "severity": "high", "cwe": ["CWE-1321"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": ">=6.5.0 <6.5.3"}, {"source": 1104120, "name": "qs", "dependency": "qs", "title": "qs vulnerable to Prototype Pollution", "url": "https://github.com/advisories/GHSA-hrpp-h998-j3pp", "severity": "high", "cwe": ["CWE-1321"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": ">=6.7.0 <6.7.3"}, {"source": 1104123, "name": "qs", "dependency": "qs", "title": "qs vulnerable to Prototype Pollution", "url": "https://github.com/advisories/GHSA-hrpp-h998-j3pp", "severity": "high", "cwe": ["CWE-1321"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": ">=6.10.0 <6.10.3"}], "effects": ["body-parser", "express"], "range": "6.5.0 - 6.5.2 || 6.7.0 - 6.7.2 || 6.10.0 - 6.10.2", "nodes": ["", "", "", ""], "fixAvailable": true}, "qunit": {"name": "qunit", "severity": "moderate", "isDirect": false, "via": ["findup-sync", "sane"], "effects": ["@wikimedia/mw-node-qunit"], "range": "2.4.1 - 2.8.0", "nodes": ["node_modules/@wikimedia/mw-node-qunit/node_modules/qunit"], "fixAvailable": {"name": "@wikimedia/mw-node-qunit", "version": "6.4.2", "isSemVerMajor": false}}, "react-dev-utils": {"name": "react-dev-utils", "severity": "critical", "isDirect": false, "via": ["browserslist", "cross-spawn", "fork-ts-checker-webpack-plugin", "immer", "loader-utils", "recursive-readdir", "shell-quote"], "effects": ["@storybook/builder-webpack4"], "range": "0.5.2 - 12.0.0-next.60", "nodes": ["node_modules/react-dev-utils"], "fixAvailable": true}, "react-syntax-highlighter": {"name": "react-syntax-highlighter", "severity": "moderate", "isDirect": false, "via": ["refractor"], "effects": ["@storybook/components"], "range": ">=6.0.0", "nodes": ["node_modules/react-syntax-highlighter"], "fixAvailable": {"name": "@storybook/addon-actions", "version": "9.0.8", "isSemVerMajor": true}}, "readdirp": {"name": "readdirp", "severity": "moderate", "isDirect": false, "via": ["micromatch"], "effects": ["chokidar"], "range": "2.2.0 - 2.2.1", "nodes": ["node_modules/watchpack-chokidar2/node_modules/readdirp"], "fixAvailable": true}, "recursive-readdir": {"name": "recursive-readdir", "severity": "high", "isDirect": false, "via": ["minimatch"], "effects": ["react-dev-utils"], "range": "1.2.0 - 2.2.2", "nodes": ["node_modules/recursive-readdir"], "fixAvailable": true}, "refractor": {"name": "refractor", "severity": "moderate", "isDirect": false, "via": ["prismjs"], "effects": ["react-syntax-highlighter"], "range": "<=4.6.0", "nodes": [""], "fixAvailable": {"name": "@storybook/addon-actions", "version": "9.0.8", "isSemVerMajor": true}}, "request": {"name": "request", "severity": "critical", "isDirect": false, "via": [{"source": 1096727, "name": "request", "dependency": "request", "title": "Server-Side Request Forgery in Request", "url": "https://github.com/advisories/GHSA-p8p7-x288-28g6", "severity": "moderate", "cwe": ["CWE-918"], "cvss": {"score": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}, "range": "<=2.88.2"}, "form-data", "tough-cookie"], "effects": ["jsdom", "less", "request-promise-core", "request-promise-native"], "range": "*", "nodes": ["node_modules/request"], "fixAvailable": {"name": "jsdom", "version": "27.0.0", "isSemVerMajor": true}}, "request-promise-core": {"name": "request-promise-core", "severity": "moderate", "isDirect": false, "via": ["request"], "effects": ["request-promise-native"], "range": "*", "nodes": ["node_modules/request-promise-core"], "fixAvailable": {"name": "jsdom", "version": "27.0.0", "isSemVerMajor": true}}, "request-promise-native": {"name": "request-promise-native", "severity": "moderate", "isDirect": false, "via": ["request", "request-promise-core", "tough-cookie"], "effects": ["jsdom"], "range": ">=1.0.0", "nodes": ["node_modules/request-promise-native"], "fixAvailable": {"name": "jsdom", "version": "27.0.0", "isSemVerMajor": true}}, "sane": {"name": "sane", "severity": "moderate", "isDirect": false, "via": ["anymatch", "micromatch"], "effects": ["qunit"], "range": "1.5.0 - 4.1.0", "nodes": ["node_modules/sane"], "fixAvailable": {"name": "@wikimedia/mw-node-qunit", "version": "6.4.2", "isSemVerMajor": false}}, "semver": {"name": "semver", "severity": "high", "isDirect": false, "via": [{"source": 1101088, "name": "semver", "dependency": "semver", "title": "semver vulnerable to Regular Expression Denial of Service", "url": "https://github.com/advisories/GHSA-c2qf-rxjj-qqgw", "severity": "high", "cwe": ["CWE-1333"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": ">=7.0.0 <7.5.2"}, {"source": 1101089, "name": "semver", "dependency": "semver", "title": "semver vulnerable to Regular Expression Denial of Service", "url": "https://github.com/advisories/GHSA-c2qf-rxjj-qqgw", "severity": "high", "cwe": ["CWE-1333"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": "<5.7.2"}, {"source": 1101090, "name": "semver", "dependency": "semver", "title": "semver vulnerable to Regular Expression Denial of Service", "url": "https://github.com/advisories/GHSA-c2qf-rxjj-qqgw", "severity": "high", "cwe": ["CWE-1333"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": ">=6.0.0 <6.3.1"}], "effects": ["core-js-compat", "eslint-plugin-compat"], "range": "<=5.7.1 || 6.0.0 - 6.3.0 || 7.0.0 - 7.5.1", "nodes": ["", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "node_modules/eslint-plugin-compat/node_modules/semver"], "fixAvailable": {"name": "eslint-config-wikimedia", "version": "0.31.0", "isSemVerMajor": true}}, "send": {"name": "send", "severity": "low", "isDirect": false, "via": [{"source": 1100526, "name": "send", "dependency": "send", "title": "send vulnerable to template injection that can lead to XSS", "url": "https://github.com/advisories/GHSA-m6fv-jmcg-4jfg", "severity": "low", "cwe": ["CWE-79"], "cvss": {"score": 5, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L"}, "range": "<0.19.0"}], "effects": ["express", "serve-static"], "range": "<0.19.0", "nodes": [""], "fixAvailable": true}, "serve-static": {"name": "serve-static", "severity": "low", "isDirect": false, "via": [{"source": 1100528, "name": "serve-static", "dependency": "serve-static", "title": "serve-static vulnerable to template injection that can lead to XSS", "url": "https://github.com/advisories/GHSA-cm22-4g7w-348p", "severity": "low", "cwe": ["CWE-79"], "cvss": {"score": 5, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L"}, "range": "<1.16.0"}, "send"], "effects": [], "range": "<=1.16.0", "nodes": [""], "fixAvailable": true}, "sha.js": {"name": "sha.js", "severity": "critical", "isDirect": false, "via": [{"source": 1107537, "name": "sha.js", "dependency": "sha.js", "title": "sha.js is missing type checks leading to hash rewind and passing on crafted data", "url": "https://github.com/advisories/GHSA-95m3-7q98-8xr5", "severity": "critical", "cwe": ["CWE-20"], "cvss": {"score": 9.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"}, "range": "<=2.4.11"}], "effects": [], "range": "<=2.4.11", "nodes": [""], "fixAvailable": true}, "shell-quote": {"name": "shell-quote", "severity": "critical", "isDirect": false, "via": [{"source": 1107366, "name": "shell-quote", "dependency": "shell-quote", "title": "Improper Neutralization of Special Elements used in a Command in Shell-quote", "url": "https://github.com/advisories/GHSA-g4rg-993r-mgx7", "severity": "critical", "cwe": ["CWE-77"], "cvss": {"score": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "range": ">=1.6.3 <=1.7.2"}], "effects": ["react-dev-utils"], "range": "1.6.3 - 1.7.2", "nodes": ["node_modules/shell-quote"], "fixAvailable": true}, "simple-get": {"name": "simple-get", "severity": "high", "isDirect": false, "via": [{"source": 1090445, "name": "simple-get", "dependency": "simple-get", "title": "Exposure of Sensitive Information in simple-get", "url": "https://github.com/advisories/GHSA-wpg7-2c88-r8xv", "severity": "high", "cwe": ["CWE-200"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}, "range": ">=3.0.0 <3.1.1"}], "effects": [], "range": "3.0.0 - 3.1.0", "nodes": [""], "fixAvailable": true}, "store2": {"name": "store2", "severity": "moderate", "isDirect": false, "via": [{"source": 1101527, "name": "store2", "dependency": "store2", "title": "Cross Site Scripting vulnerability in store2", "url": "https://github.com/advisories/GHSA-w5hq-hm5m-4548", "severity": "moderate", "cwe": ["CWE-79"], "cvss": {"score": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}, "range": "<2.14.4"}], "effects": [], "range": "<2.14.4", "nodes": [""], "fixAvailable": true}, "stylelint": {"name": "stylelint", "severity": "moderate", "isDirect": false, "via": ["autoprefixer", "postcss", "postcss-less", "postcss-safe-parser", "postcss-sass", "postcss-scss", "sugarss"], "effects": ["stylelint-config-wikimedia"], "range": "0.1.0 - 13.13.1", "nodes": ["node_modules/stylelint"], "fixAvailable": {"name": "stylelint-config-wikimedia", "version": "0.18.0", "isSemVerMajor": true}}, "stylelint-config-wikimedia": {"name": "stylelint-config-wikimedia", "severity": "moderate", "isDirect": true, "via": ["stylelint"], "effects": [], "range": "<=0.11.1", "nodes": ["node_modules/stylelint-config-wikimedia"], "fixAvailable": {"name": "stylelint-config-wikimedia", "version": "0.18.0", "isSemVerMajor": true}}, "sugarss": {"name": "sugarss", "severity": "moderate", "isDirect": false, "via": ["postcss"], "effects": [], "range": "<=2.0.0", "nodes": ["node_modules/sugarss"], "fixAvailable": true}, "taffydb": {"name": "taffydb", "severity": "high", "isDirect": false, "via": [{"source": 1089386, "name": "taffydb", "dependency": "taffydb", "title": "TaffyDB can allow access to any data items in the DB", "url": "https://github.com/advisories/GHSA-mxhp-79qh-mcx6", "severity": "high", "cwe": ["CWE-20", "CWE-668"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}, "range": "<=2.7.3"}], "effects": ["jsdoc"], "range": "*", "nodes": [""], "fixAvailable": {"name": "jsdoc", "version": "3.6.11", "isSemVerMajor": false}}, "tar": {"name": "tar", "severity": "moderate", "isDirect": false, "via": [{"source": 1097493, "name": "tar", "dependency": "tar", "title": "Denial of service while parsing a tar file due to lack of folders count validation", "url": "https://github.com/advisories/GHSA-f5x3-32g6-xq36", "severity": "moderate", "cwe": ["CWE-400"], "cvss": {"score": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}, "range": "<6.2.1"}], "effects": [], "range": "<6.2.1", "nodes": [""], "fixAvailable": true}, "tar-fs": {"name": "tar-fs", "severity": "high", "isDirect": false, "via": [{"source": 1106930, "name": "tar-fs", "dependency": "tar-fs", "title": "tar-fs can extract outside the specified dir with a specific tarball", "url": "https://github.com/advisories/GHSA-8cj5-5rvv-wf4v", "severity": "high", "cwe": ["CWE-22"], "cvss": {"score": 0, "vectorString": null}, "range": ">=2.0.0 <2.1.3"}, {"source": 1108293, "name": "tar-fs", "dependency": "tar-fs", "title": "tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball", "url": "https://github.com/advisories/GHSA-vj76-c3g6-qr5v", "severity": "high", "cwe": ["CWE-22", "CWE-61"], "cvss": {"score": 0, "vectorString": null}, "range": ">=2.0.0 <2.1.4"}, {"source": 1108411, "name": "tar-fs", "dependency": "tar-fs", "title": "tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File", "url": "https://github.com/advisories/GHSA-pq67-2wwv-3xjx", "severity": "high", "cwe": ["CWE-22"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}, "range": ">=2.0.0 <2.1.2"}], "effects": [], "range": "2.0.0 - 2.1.3", "nodes": [""], "fixAvailable": true}, "telejson": {"name": "telejson", "severity": "low", "isDirect": false, "via": ["global"], "effects": ["@storybook/channel-postmessage", "@storybook/core-server"], "range": "<=6.0.8", "nodes": ["node_modules/telejson"], "fixAvailable": {"name": "@storybook/addon-actions", "version": "9.0.8", "isSemVerMajor": true}}, "terser": {"name": "terser", "severity": "high", "isDirect": false, "via": [{"source": 1091691, "name": "terser", "dependency": "terser", "title": "Terser insecure use of regular expressions leads to ReDoS", "url": "https://github.com/advisories/GHSA-4wf5-vphf-c2xc", "severity": "high", "cwe": ["CWE-1333"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": "<4.8.1"}], "effects": [], "range": "<4.8.1", "nodes": [""], "fixAvailable": true}, "terser-webpack-plugin": {"name": "terser-webpack-plugin", "severity": "moderate", "isDirect": false, "via": ["webpack"], "effects": ["webpack"], "range": "<=2.2.1", "nodes": [""], "fixAvailable": {"name": "webpack", "version": "5.102.0", "isSemVerMajor": true}}, "tmp": {"name": "tmp", "severity": "low", "isDirect": false, "via": [{"source": 1106849, "name": "tmp", "dependency": "tmp", "title": "tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter", "url": "https://github.com/advisories/GHSA-52f5-9888-hmc6", "severity": "low", "cwe": ["CWE-59"], "cvss": {"score": 2.5, "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"}, "range": "<=0.2.3"}], "effects": ["external-editor"], "range": "<=0.2.3", "nodes": [""], "fixAvailable": {"name": "eslint-config-wikimedia", "version": "0.31.0", "isSemVerMajor": true}}, "tough-cookie": {"name": "tough-cookie", "severity": "moderate", "isDirect": false, "via": [{"source": 1097682, "name": "tough-cookie", "dependency": "tough-cookie", "title": "tough-cookie Prototype Pollution vulnerability", "url": "https://github.com/advisories/GHSA-72xf-g2v4-qvf3", "severity": "moderate", "cwe": ["CWE-1321"], "cvss": {"score": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"}, "range": "<4.1.3"}], "effects": ["jsdom", "request", "request-promise-native"], "range": "<4.1.3", "nodes": ["node_modules/tough-cookie"], "fixAvailable": {"name": "jsdom", "version": "27.0.0", "isSemVerMajor": true}}, "watchpack": {"name": "watchpack", "severity": "high", "isDirect": false, "via": ["watchpack-chokidar2"], "effects": [], "range": "1.7.2 - 1.7.5", "nodes": ["node_modules/watchpack"], "fixAvailable": true}, "watchpack-chokidar2": {"name": "watchpack-chokidar2", "severity": "high", "isDirect": false, "via": ["chokidar"], "effects": ["watchpack"], "range": "*", "nodes": ["node_modules/watchpack-chokidar2"], "fixAvailable": true}, "webpack": {"name": "webpack", "severity": "moderate", "isDirect": true, "via": ["micromatch", "terser-webpack-plugin"], "effects": ["@storybook/core-common", "@storybook/core-server", "terser-webpack-plugin", "webpack-cli"], "range": "4.0.0-alpha.0 - 5.0.0-rc.6", "nodes": ["node_modules/webpack"], "fixAvailable": {"name": "webpack", "version": "5.102.0", "isSemVerMajor": true}}, "webpack-cli": {"name": "webpack-cli", "severity": "high", "isDirect": true, "via": ["cross-spawn", "findup-sync", "loader-utils", "webpack"], "effects": [], "range": "<=0.0.8-development || 1.3.0 - 2.0.9 || 2.0.11 - 4.0.0-rc.1", "nodes": ["node_modules/webpack-cli"], "fixAvailable": {"name": "webpack-cli", "version": "3.3.12", "isSemVerMajor": false}}, "webpack-dev-middleware": {"name": "webpack-dev-middleware", "severity": "high", "isDirect": false, "via": [{"source": 1096729, "name": "webpack-dev-middleware", "dependency": "webpack-dev-middleware", "title": "Path traversal in webpack-dev-middleware", "url": "https://github.com/advisories/GHSA-wr3j-pwj9-hqq6", "severity": "high", "cwe": ["CWE-22"], "cvss": {"score": 7.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N"}, "range": "<=5.3.3"}], "effects": ["@storybook/core-server"], "range": "<=5.3.3", "nodes": ["node_modules/webpack-dev-middleware"], "fixAvailable": true}, "word-wrap": {"name": "word-wrap", "severity": "moderate", "isDirect": false, "via": [{"source": 1102444, "name": "word-wrap", "dependency": "word-wrap", "title": "word-wrap vulnerable to Regular Expression Denial of Service", "url": "https://github.com/advisories/GHSA-j8xg-fqg3-53r7", "severity": "moderate", "cwe": ["CWE-1333"], "cvss": {"score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}, "range": "<1.2.4"}], "effects": [], "range": "<1.2.4", "nodes": [""], "fixAvailable": true}, "ws": {"name": "ws", "severity": "high", "isDirect": false, "via": [{"source": 1098394, "name": "ws", "dependency": "ws", "title": "ws affected by a DoS when handling a request with many HTTP headers", "url": "https://github.com/advisories/GHSA-3h5v-q93c-6h6q", "severity": "high", "cwe": ["CWE-476"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": ">=6.0.0 <6.2.3"}], "effects": [], "range": "6.0.0 - 6.2.2", "nodes": [""], "fixAvailable": true}}, "metadata": {"vulnerabilities": {"info": 0, "low": 19, "moderate": 48, "high": 41, "critical": 14, "total": 122}, "dependencies": {"prod": 2, "dev": 2087, "optional": 31, "peer": 1, "peerOptional": 0, "total": 2088}}}}
{}
Upgrading n:@wikimedia/mw-node-qunit from 6.2.1 -> 6.4.2
{}
Upgrading n:bundlesize from 0.18.1 -> 0.18.2
{}
Upgrading n:jsdoc from 3.6.7 -> 3.6.11
{}
Upgrading n:less from 3.8.1 -> 3.13.1
{}
Upgrading n:webpack-cli from 3.3.11 -> 3.3.12
$ /usr/bin/npm audit fix --only=dev
--- stderr ---
npm WARN invalid config only="dev" set in command line options
npm WARN invalid config Must be one of: null, prod, production
npm WARN ERESOLVE overriding peer dependency
npm WARN While resolving: babel-loader@8.2.3
npm WARN Found: webpack@4.43.0
npm WARN node_modules/webpack
npm WARN dev webpack@"4.43.0" from the root project
npm WARN 24 more (@storybook/builder-webpack4, babel-loader, ...)
npm WARN
npm WARN Could not resolve dependency:
npm WARN peer webpack@">=2" from babel-loader@8.2.3
npm WARN node_modules/@storybook/builder-webpack4/node_modules/babel-loader
npm WARN babel-loader@"^8.2.2" from @storybook/builder-webpack4@6.2.3
npm WARN node_modules/@storybook/builder-webpack4
npm WARN
npm WARN Conflicting peer dependency: webpack@5.102.0
npm WARN node_modules/webpack
npm WARN peer webpack@">=2" from babel-loader@8.2.3
npm WARN node_modules/@storybook/builder-webpack4/node_modules/babel-loader
npm WARN babel-loader@"^8.2.2" from @storybook/builder-webpack4@6.2.3
npm WARN node_modules/@storybook/builder-webpack4
npm WARN ERESOLVE overriding peer dependency
npm WARN While resolving: babel-loader@8.2.3
npm WARN Found: webpack@4.43.0
npm WARN node_modules/webpack
npm WARN dev webpack@"4.43.0" from the root project
npm WARN 24 more (@storybook/builder-webpack4, babel-loader, ...)
npm WARN
npm WARN Could not resolve dependency:
npm WARN peer webpack@">=2" from babel-loader@8.2.3
npm WARN node_modules/@storybook/core-common/node_modules/babel-loader
npm WARN babel-loader@"^8.2.2" from @storybook/core-common@6.2.3
npm WARN node_modules/@storybook/core-common
npm WARN
npm WARN Conflicting peer dependency: webpack@5.102.0
npm WARN node_modules/webpack
npm WARN peer webpack@">=2" from babel-loader@8.2.3
npm WARN node_modules/@storybook/core-common/node_modules/babel-loader
npm WARN babel-loader@"^8.2.2" from @storybook/core-common@6.2.3
npm WARN node_modules/@storybook/core-common
npm WARN ERESOLVE overriding peer dependency
npm WARN While resolving: babel-loader@8.2.3
npm WARN Found: webpack@4.43.0
npm WARN node_modules/webpack
npm WARN dev webpack@"4.43.0" from the root project
npm WARN 24 more (@storybook/builder-webpack4, babel-loader, ...)
npm WARN
npm WARN Could not resolve dependency:
npm WARN peer webpack@">=2" from babel-loader@8.2.3
npm WARN node_modules/@storybook/core-server/node_modules/babel-loader
npm WARN babel-loader@"^8.2.2" from @storybook/core-server@6.2.3
npm WARN node_modules/@storybook/core-server
npm WARN
npm WARN Conflicting peer dependency: webpack@5.102.0
npm WARN node_modules/webpack
npm WARN peer webpack@">=2" from babel-loader@8.2.3
npm WARN node_modules/@storybook/core-server/node_modules/babel-loader
npm WARN babel-loader@"^8.2.2" from @storybook/core-server@6.2.3
npm WARN node_modules/@storybook/core-server
npm WARN ERESOLVE overriding peer dependency
npm WARN While resolving: @babel/helper-define-polyfill-provider@0.2.4
npm WARN Found: @babel/core@7.2.2
npm WARN node_modules/@babel/core
npm WARN dev @babel/core@"7.2.2" from the root project
npm WARN 85 more (@babel/helper-compilation-targets, ...)
npm WARN
npm WARN Could not resolve dependency:
npm WARN peer @babel/core@"^7.4.0-0" from @babel/helper-define-polyfill-provider@0.2.4
npm WARN node_modules/babel-plugin-polyfill-corejs2/node_modules/@babel/helper-define-polyfill-provider
npm WARN @babel/helper-define-polyfill-provider@"^0.2.4" from babel-plugin-polyfill-corejs2@0.2.3
npm WARN node_modules/babel-plugin-polyfill-corejs2
npm WARN
npm WARN Conflicting peer dependency: @babel/core@7.28.4
npm WARN node_modules/@babel/core
npm WARN peer @babel/core@"^7.4.0-0" from @babel/helper-define-polyfill-provider@0.2.4
npm WARN node_modules/babel-plugin-polyfill-corejs2/node_modules/@babel/helper-define-polyfill-provider
npm WARN @babel/helper-define-polyfill-provider@"^0.2.4" from babel-plugin-polyfill-corejs2@0.2.3
npm WARN node_modules/babel-plugin-polyfill-corejs2
npm WARN ERESOLVE overriding peer dependency
npm WARN While resolving: @babel/helper-define-polyfill-provider@0.1.5
npm WARN Found: @babel/core@7.2.2
npm WARN node_modules/@babel/core
npm WARN dev @babel/core@"7.2.2" from the root project
npm WARN 85 more (@babel/helper-compilation-targets, ...)
npm WARN
npm WARN Could not resolve dependency:
npm WARN peer @babel/core@"^7.4.0-0" from @babel/helper-define-polyfill-provider@0.1.5
npm WARN node_modules/babel-plugin-polyfill-corejs3/node_modules/@babel/helper-define-polyfill-provider
npm WARN @babel/helper-define-polyfill-provider@"^0.1.5" from babel-plugin-polyfill-corejs3@0.1.7
npm WARN node_modules/babel-plugin-polyfill-corejs3
npm WARN
npm WARN Conflicting peer dependency: @babel/core@7.28.4
npm WARN node_modules/@babel/core
npm WARN peer @babel/core@"^7.4.0-0" from @babel/helper-define-polyfill-provider@0.1.5
npm WARN node_modules/babel-plugin-polyfill-corejs3/node_modules/@babel/helper-define-polyfill-provider
npm WARN @babel/helper-define-polyfill-provider@"^0.1.5" from babel-plugin-polyfill-corejs3@0.1.7
npm WARN node_modules/babel-plugin-polyfill-corejs3
npm WARN ERESOLVE overriding peer dependency
npm WARN While resolving: @babel/helper-define-polyfill-provider@0.2.4
npm WARN Found: @babel/core@7.2.2
npm WARN node_modules/@babel/core
npm WARN dev @babel/core@"7.2.2" from the root project
npm WARN 85 more (@babel/helper-compilation-targets, ...)
npm WARN
npm WARN Could not resolve dependency:
npm WARN peer @babel/core@"^7.4.0-0" from @babel/helper-define-polyfill-provider@0.2.4
npm WARN node_modules/babel-plugin-polyfill-regenerator/node_modules/@babel/helper-define-polyfill-provider
npm WARN @babel/helper-define-polyfill-provider@"^0.2.4" from babel-plugin-polyfill-regenerator@0.2.3
npm WARN node_modules/babel-plugin-polyfill-regenerator
npm WARN
npm WARN Conflicting peer dependency: @babel/core@7.28.4
npm WARN node_modules/@babel/core
npm WARN peer @babel/core@"^7.4.0-0" from @babel/helper-define-polyfill-provider@0.2.4
npm WARN node_modules/babel-plugin-polyfill-regenerator/node_modules/@babel/helper-define-polyfill-provider
npm WARN @babel/helper-define-polyfill-provider@"^0.2.4" from babel-plugin-polyfill-regenerator@0.2.3
npm WARN node_modules/babel-plugin-polyfill-regenerator
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: undefined,
npm WARN EBADENGINE required: { node: '12.22.5' },
npm WARN EBADENGINE current: { node: 'v20.19.2', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: '@es-joy/jsdoccomment@0.12.0',
npm WARN EBADENGINE required: { node: '^12 || ^14 || ^16 || ^17' },
npm WARN EBADENGINE current: { node: 'v20.19.2', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: 'eslint-plugin-jsdoc@37.0.3',
npm WARN EBADENGINE required: { node: '^12 || ^14 || ^16 || ^17' },
npm WARN EBADENGINE current: { node: 'v20.19.2', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN deprecated is-data-descriptor@1.0.0: Please upgrade to v1.0.1
npm WARN deprecated is-accessor-descriptor@1.0.0: Please upgrade to v1.0.1
npm WARN deprecated inflight@1.0.6: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.
npm WARN deprecated @npmcli/move-file@1.1.2: This functionality has been moved to @npmcli/fs
npm WARN deprecated is-accessor-descriptor@0.1.6: Please upgrade to v0.1.7
npm WARN deprecated is-accessor-descriptor@0.1.6: Please upgrade to v0.1.7
npm WARN deprecated is-data-descriptor@0.1.4: Please upgrade to v0.1.5
npm WARN deprecated is-data-descriptor@0.1.4: Please upgrade to v0.1.5
npm WARN deprecated is-data-descriptor@0.1.4: Please upgrade to v0.1.5
npm WARN deprecated is-accessor-descriptor@0.1.6: Please upgrade to v0.1.7
npm WARN deprecated is-data-descriptor@0.1.4: Please upgrade to v0.1.5
npm WARN deprecated is-accessor-descriptor@0.1.6: Please upgrade to v0.1.7
npm WARN deprecated is-data-descriptor@0.1.4: Please upgrade to v0.1.5
npm WARN deprecated is-accessor-descriptor@0.1.6: Please upgrade to v0.1.7
npm WARN deprecated source-map-url@0.4.1: See https://github.com/lydell/source-map-url#deprecated
npm WARN deprecated stable@0.1.8: Modern JS already guarantees Array#sort() is a stable sort, so this library is deprecated. See the compatibility table on MDN: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/sort#browser_compatibility
npm WARN deprecated move-concurrently@1.0.1: This package is no longer supported.
npm WARN deprecated lodash.get@4.4.2: This package is deprecated. Use the optional chaining (?.) operator instead.
npm WARN deprecated @babel/plugin-proposal-private-methods@7.16.0: This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-private-methods instead.
npm WARN deprecated @babel/plugin-proposal-unicode-property-regex@7.16.0: This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-unicode-property-regex instead.
npm WARN deprecated @babel/plugin-proposal-optional-catch-binding@7.16.0: This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-optional-catch-binding instead.
npm WARN deprecated @babel/plugin-proposal-private-property-in-object@7.16.0: This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-private-property-in-object instead.
npm WARN deprecated @babel/plugin-proposal-numeric-separator@7.16.0: This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-numeric-separator instead.
npm WARN deprecated @babel/plugin-proposal-nullish-coalescing-operator@7.16.0: This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-nullish-coalescing-operator instead.
npm WARN deprecated @babel/plugin-proposal-logical-assignment-operators@7.16.0: This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-logical-assignment-operators instead.
npm WARN deprecated @babel/plugin-proposal-json-strings@7.16.0: This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-json-strings instead.
npm WARN deprecated @babel/plugin-proposal-class-properties@7.16.0: This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-class-properties instead.
npm WARN deprecated @babel/plugin-proposal-dynamic-import@7.16.0: This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-dynamic-import instead.
npm WARN deprecated @babel/plugin-proposal-export-namespace-from@7.16.0: This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-export-namespace-from instead.
npm WARN deprecated @babel/plugin-proposal-class-static-block@7.16.0: This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-class-static-block instead.
npm WARN deprecated @babel/plugin-proposal-class-static-block@7.16.0: This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-class-static-block instead.
npm WARN deprecated rimraf@2.7.1: Rimraf versions prior to v4 are no longer supported
npm WARN deprecated request-promise-native@1.0.9: request-promise-native has been deprecated because it extends the now deprecated request package, see https://github.com/request/request/issues/3142
npm WARN deprecated figgy-pudding@3.5.2: This module is no longer supported.
npm WARN deprecated @stylelint/postcss-markdown@0.36.2: Use the original unforked package instead: postcss-markdown
npm WARN deprecated urix@0.1.0: Please see https://github.com/lydell/urix#deprecated
npm WARN deprecated npmlog@4.1.2: This package is no longer supported.
npm WARN deprecated har-validator@5.1.5: this library is no longer supported
npm WARN deprecated @humanwhocodes/config-array@0.5.0: Use @eslint/config-array instead
npm WARN deprecated abab@2.0.6: Use your platform's native atob() and btoa() methods instead
npm WARN deprecated copy-concurrently@1.0.5: This package is no longer supported.
npm WARN deprecated @babel/plugin-proposal-object-rest-spread@7.16.0: This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-object-rest-spread instead.
npm WARN deprecated @babel/plugin-proposal-optional-chaining@7.16.0: This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-optional-chaining instead.
npm WARN deprecated rimraf@3.0.2: Rimraf versions prior to v4 are no longer supported
npm WARN deprecated rimraf@3.0.2: Rimraf versions prior to v4 are no longer supported
npm WARN deprecated rimraf@3.0.2: Rimraf versions prior to v4 are no longer supported
npm WARN deprecated rimraf@3.0.2: Rimraf versions prior to v4 are no longer supported
npm WARN deprecated rimraf@3.0.2: Rimraf versions prior to v4 are no longer supported
npm WARN deprecated rimraf@3.0.2: Rimraf versions prior to v4 are no longer supported
npm WARN deprecated domexception@1.0.1: Use your platform's native DOMException instead
npm WARN deprecated resolve-url@0.2.1: https://github.com/lydell/resolve-url#deprecated
npm WARN deprecated are-we-there-yet@1.1.7: This package is no longer supported.
npm WARN deprecated wikimedia-ui-base@0.15.0: Package no longer supported. Please use @wikimedia/codex-design-tokens instead.
npm WARN deprecated uuid-browser@3.1.0: Package no longer supported and required. Use the uuid package or crypto.randomUUID instead
npm WARN deprecated glob@7.2.0: Glob versions prior to v9 are no longer supported
npm WARN deprecated source-map-resolve@0.5.3: See https://github.com/lydell/source-map-resolve#deprecated
npm WARN deprecated w3c-hr-time@1.0.2: Use your platform's native performance.now() and performance.timeOrigin.
npm WARN deprecated domexception@4.0.0: Use your platform's native DOMException instead
npm WARN deprecated fs-write-stream-atomic@1.0.10: This package is no longer supported.
npm WARN deprecated querystring@0.2.0: The querystring API is considered Legacy. new code should use the URLSearchParams API instead.
npm WARN deprecated samsam@1.3.0: This package has been deprecated in favour of @sinonjs/samsam
npm WARN tarball tarball data for ts-essentials@https://registry.npmjs.org/ts-essentials/-/ts-essentials-2.0.12.tgz (sha512-3IVX4nI6B5cc31/GFFE+i8ey/N2eA0CZDbo6n0yrz0zDX8ZJ8djmU1p+XRz7G3is0F3bB3pu2pAroFdAWQKU3w==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for shell-quote@https://registry.npmjs.org/shell-quote/-/shell-quote-1.7.2.tgz (sha512-mRz/m/JVscCrkMyPqHc/bczi3OQHkLTqXHEFu0zDhK/qfv3UcOA4SVmRCLmos4bhjr9ekVQubj/R7waKapmiQg==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for table@https://registry.npmjs.org/table/-/table-6.7.3.tgz (sha512-5DkIxeA7XERBqMwJq0aHZOdMadBx4e6eDoFRuyT5VR82J0Ycg2DwM6GfA/EQAhJ+toRTaS1lIdSQCqgrmhPnlw==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for terser-webpack-plugin@https://registry.npmjs.org/terser-webpack-plugin/-/terser-webpack-plugin-3.1.0.tgz (sha512-cjdZte66fYkZ65rQ2oJfrdCAkkhJA7YLYk5eGOcGCSGlq0ieZupRdjedSQXYknMPo2IveQL+tPdrxUkERENCFA==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for webpack@https://registry.npmjs.org/webpack/-/webpack-4.43.0.tgz (sha512-GW1LjnPipFW2Y78OOab8NJlCflB7EFskMih2AHdvjbpKMeDJqEgSx24cXXXiPS65+WSwVyxtDsJH6jGX2czy+g==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for webpack-cli@https://registry.npmjs.org/webpack-cli/-/webpack-cli-3.3.12.tgz (sha512-NVWBaz9k839ZH/sinurM+HcDvJOTXwSjYp1ku+5XKeOC03z8v5QitnK/x+lAxGXFyhdayoIf/GOpv85z3/xPag==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for react-colorful@https://registry.npmjs.org/react-colorful/-/react-colorful-5.5.0.tgz (sha512-BuzrlrM0ylg7coPkXOrRqlf2BgHLw5L44sybbr9Lg4xy7w9e5N7fGYbojOO0s8J0nvrM3PERN2rVFkvSa24lnQ==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for react-helmet-async@https://registry.npmjs.org/react-helmet-async/-/react-helmet-async-1.1.2.tgz (sha512-LTTzDDkyIleT/JJ6T/uqx7Y8qi1EuPPSiJawQY/nHHz0h7SPDT6HxP1YDDQx/fzcVxCqpWEEMS3QdrSrNkJYhg==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for react-error-overlay@https://registry.npmjs.org/react-error-overlay/-/react-error-overlay-6.0.9.tgz (sha512-nQTTcUu+ATDbrSD1BZHr5kgSD4oF8OFjxun8uAaL8RwPBacGBNPf/yAuVVdx17N8XNzRDMrZ9XcKZHCjPW+9ew==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for html-loader@https://registry.npmjs.org/html-loader/-/html-loader-1.3.2.tgz (sha512-DEkUwSd0sijK5PF3kRWspYi56XP7bTNkyg5YWSzBdjaSDmvCufep5c4Vpb3PBf6lUL0YPtLwBfy9fL0t5hBAGA==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for is-root@https://registry.npmjs.org/is-root/-/is-root-2.1.0.tgz (sha512-AGOriNp96vNBd3HtU+RzFEc75FfR5ymiYv8E553I71SCeXBiMsVDUtdio1OEFvrPyLIQ9tVR5RxXIFe5PUFjMg==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for eslint-plugin-jsdoc@https://registry.npmjs.org/eslint-plugin-jsdoc/-/eslint-plugin-jsdoc-37.0.3.tgz (sha512-Qg/gIZAfcrM4Qu/JzcnxPGD45Je6wPLFzMZQboeqit/CL4aY6wuzBTkgUMiWXfw/PaPl+sb0GF1XdBlV23ReDA==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for immer@https://registry.npmjs.org/immer/-/immer-8.0.1.tgz (sha512-aqXhGP7//Gui2+UrEtvxZxSquQVXTpZ7KDxfCcKAF3Vysvw0CViVaW9RZ1j1xlIYqaaaipBoqdqeibkc18PNvA==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for eslint-plugin-qunit@https://registry.npmjs.org/eslint-plugin-qunit/-/eslint-plugin-qunit-7.0.0.tgz (sha512-yPh02tbQoZK43voIfJFO9CUN5Q6j8ebfrnxEqPr7I4UiYln4RWKDQ4ajaHgV3gJKSAUZwymJ0DsB/YH6btRxIQ==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for eslint-plugin-vue@https://registry.npmjs.org/eslint-plugin-vue/-/eslint-plugin-vue-8.0.3.tgz (sha512-Rlhhy5ltzde0sRwSkqHuNePTXLMMaJ5+qsQubM4RYloYsQ8cXlnJT5MDaCzSirkGADipOHtmQXIbbPFAzUrADg==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for dotenv-defaults@https://registry.npmjs.org/dotenv-defaults/-/dotenv-defaults-1.1.1.tgz (sha512-6fPRo9o/3MxKvmRZBD3oNFdxODdhJtIy1zcJeUSCs6HCy4tarUpd+G67UTU9tF6OWXeSPqsm4fPAB+2eY9Rt9Q==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for less-loader@https://registry.npmjs.org/less-loader/-/less-loader-5.0.0.tgz (sha512-bquCU89mO/yWLaUq0Clk7qCsKhsF/TZpJUzETRvJa9KSVEL9SO3ovCvdEHISBhrC81OwC8QSVX7E0bzElZj9cg==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for filesize@https://registry.npmjs.org/filesize/-/filesize-6.1.0.tgz (sha512-LpCHtPQ3sFx67z+uh2HnSyWSLLu5Jxo21795uRDuar/EOuYWXib5EmPaGIBuSnRqH2IODiKA2k5re/K9OnN/Yg==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for fork-ts-checker-webpack-plugin@https://registry.npmjs.org/fork-ts-checker-webpack-plugin/-/fork-ts-checker-webpack-plugin-6.4.0.tgz (sha512-3I3wFkc4DbzaUDPWEi96wdYGu4EKtxBafhZYm0o4mX51d9bphAY4P3mBl8K5mFXFJqVzHfmdbm9kLGnm7vwwBg==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for es5-shim@https://registry.npmjs.org/es5-shim/-/es5-shim-4.6.2.tgz (sha512-n0XTVMGps+Deyr38jtqKPR5F5hb9owYeRQcKJW39eFvzUk/u/9Ww315werRzbiNMnHCUw/YHDPBphTlEnzdi+A==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for prop-types@https://registry.npmjs.org/prop-types/-/prop-types-15.7.2.tgz (sha512-8QQikdH7//R2vurIJSutZ1smHYTcLpRWEOlHnzcWHmBYrOGUysKwSsrC89BCiFj3CbrfJ/nXFdJepOVrY1GCHQ==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for dotenv-webpack@https://registry.npmjs.org/dotenv-webpack/-/dotenv-webpack-1.8.0.tgz (sha512-o8pq6NLBehtrqA8Jv8jFQNtG9nhRtVqmoD4yWbgUyoU3+9WBlPe+c2EAiaJok9RB28QvrWvdWLZGeTT5aATDMg==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for memfs@https://registry.npmjs.org/memfs/-/memfs-3.3.0.tgz (sha512-BEE62uMfKOavX3iG7GYX43QJ+hAeeWnwIAuJ/R6q96jaMtiLzhsxHJC8B1L7fK7Pt/vXDRwb3SG/yBpNGDPqzg==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for element-resize-detector@https://registry.npmjs.org/element-resize-detector/-/element-resize-detector-1.2.3.tgz (sha512-+dhNzUgLpq9ol5tyhoG7YLoXL3ssjfFW+0gpszXPwRU6NjGr1fVHMEAF8fVzIiRJq57Nre0RFeIjJwI8Nh2NmQ==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for detect-port-alt@https://registry.npmjs.org/detect-port-alt/-/detect-port-alt-1.1.6.tgz (sha512-5tQykt+LqfJFBEYaDITx7S7cR7mJ/zQmLXZ2qt5w04ainYZw6tBf9dBunMjVeVOdYVRUzUOE4HkY5J7+uttb5Q==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for jsdoc-type-pratt-parser@https://registry.npmjs.org/jsdoc-type-pratt-parser/-/jsdoc-type-pratt-parser-2.0.0.tgz (sha512-sUuj2j48wxrEpbFjDp1sAesAxPiLT+z0SWVmMafyIINs6Lj5gIPKh3VrkBZu4E/Dv+wHpOot0m6H8zlHQjwqeQ==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for react-dev-utils@https://registry.npmjs.org/react-dev-utils/-/react-dev-utils-11.0.4.tgz (sha512-dx0LvIGHcOPtKbeiSUM4jqpBl3TcY7CDjZdfOIcKeznE7BWr9dg0iPG90G5yfVQ+p/rGNMXdbfStvzQZEVEi4A==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for csstype@https://registry.npmjs.org/csstype/-/csstype-2.6.18.tgz (sha512-RSU6Hyeg14am3Ah4VZEmeX8H7kLwEEirXe6aU2IPfKNvhXwTflK5HQRDNI0ypQXoqmm+QPyG2IaPuQE5zMwSIQ==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for emotion-theming@https://registry.npmjs.org/emotion-theming/-/emotion-theming-10.0.27.tgz (sha512-MlF1yu/gYh8u+sLUqA0YuA9JX0P4Hb69WlKc/9OLo+WCXuX6sy/KoIa+qJimgmr2dWqnypYKYPX37esjDBbhdw==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for dotenv@https://registry.npmjs.org/dotenv/-/dotenv-6.2.0.tgz (sha512-HygQCKUBSFl8wKQZBSemMywRWcEDNidvNbjGVyZu3nbZ8qq9ubiPoGLMdRDpfSrpkkm9BXYFkpKxxFX38o/76w==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for comment-parser@https://registry.npmjs.org/comment-parser/-/comment-parser-1.2.4.tgz (sha512-pm0b+qv+CkWNriSTMsfnjChF9kH0kxz55y44Wo5le9qLxMj5xDQAaEd9ZN1ovSuk9CsrncWaFwgpOMg7ClJwkw==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for cli-table3@https://registry.npmjs.org/cli-table3/-/cli-table3-0.6.0.tgz (sha512-gnB85c3MGC7Nm9I/FkiasNBOKjOiO1RNuXXarQms37q4QMpWdlbBgD/VnOStA2faG1dpXMv31RFApjX1/QdgWQ==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for core-js-pure@https://registry.npmjs.org/core-js-pure/-/core-js-pure-3.19.1.tgz (sha512-Q0Knr8Es84vtv62ei6/6jXH/7izKmOrtrxH9WJTHLCMAVeU+8TF8z8Nr08CsH4Ot0oJKzBzJJL9SJBYIv7WlfQ==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for babel-loader@https://registry.npmjs.org/babel-loader/-/babel-loader-8.0.5.tgz (sha512-NTnHnVRd2JnRqPC0vW+iOQWU5pchDbYXsG2E6DMXEpMfUcQKclF9gmf3G3ZMhzG7IG9ji4coL0cm+FxeWxDpnw==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for @types/micromatch@https://registry.npmjs.org/@types/micromatch/-/micromatch-4.0.2.tgz (sha512-oqXqVb0ci19GtH0vOA/U2TmHTcRY9kuZl4mqUxe0QmJAlIW13kzhuK5pi1i9+ngav8FjpSb9FVS/GE00GLX1VA==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for @types/reach__router@https://registry.npmjs.org/@types/reach__router/-/reach__router-1.3.9.tgz (sha512-N6rqQqTTAV/zKLfK3iq9Ww3wqCEhTZvsilhl0zI09zETdVq1QGmJH6+/xnj8AFUWIrle2Cqo+PGM/Ltr1vBb9w==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for @types/npmlog@https://registry.npmjs.org/@types/npmlog/-/npmlog-4.1.3.tgz (sha512-1TcL7YDYCtnHmLhTWbum+IIwLlvpaHoEKS2KNIngEwLzwgDeHaebaEHHbQp8IqzNQ9IYiboLKUjAf7MZqG63+w==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for @types/webpack@https://registry.npmjs.org/@types/webpack/-/webpack-4.41.31.tgz (sha512-/i0J7sepXFIp1ZT7FjUGi1eXMCg8HCCzLJEQkKsOtbJFontsJLolBcDC+3qxn5pPwiCt1G0ZdRmYRzNBtvpuGQ==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for @types/braces@https://registry.npmjs.org/@types/braces/-/braces-3.0.1.tgz (sha512-+euflG6ygo4bn0JHtn4pYqcXwRtLvElQ7/nnjDu7iYG56H0+OhCd7d6Ug0IE3WcFpZozBKW2+80FUbv5QGk5AQ==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for @storybook/router@https://registry.npmjs.org/@storybook/router/-/router-6.2.3.tgz (sha512-npc8jODlVLLghPuU/2eFupuTb9mxW1PlaXa45J0HDZRoNRLBHpn/QzQhLdW/1iyfPRw6BRwtuL/vXQQ2OPvjeQ==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for @storybook/core@https://registry.npmjs.org/@storybook/core/-/core-6.2.3.tgz (sha512-BUj8KQoRITrGUv8nyYwO2jv5nDo4wuezRJ9HSx+PM2rnziw2wvB6rvPXoOGAilOD4poNtLCUgUEll6lj1p/bqA==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for @types/markdown-to-jsx@https://registry.npmjs.org/@types/markdown-to-jsx/-/markdown-to-jsx-6.11.3.tgz (sha512-30nFYpceM/ZEvhGiqWjm5quLUxNeld0HCzJEXMZZDpq53FPkS85mTwkWtCXzCqq8s5JYLgM5W392a02xn8Bdaw==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for @storybook/node-logger@https://registry.npmjs.org/@storybook/node-logger/-/node-logger-6.2.3.tgz (sha512-NwKVqfRyscoElY3vKF2KRVXng4NMmPIJF11ddpWJfZ2+ojGHHaFKUKZy0iZrUkTZpv/0o5VtR3K/vU+2ZVWTKw==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for @types/react@https://registry.npmjs.org/@types/react/-/react-17.0.34.tgz (sha512-46FEGrMjc2+8XhHXILr+3+/sTe3OfzSPU9YGKILLrUYbQ1CLQC9Daqo1KzENGXAWwrFwiY0l4ZbF20gRvgpWTg==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for @storybook/core-events@https://registry.npmjs.org/@storybook/core-events/-/core-events-6.2.3.tgz (sha512-mu8lmkCEghO4wKgm6OgmRGCf7KQ6PecOeMYFyM28RC/DNYIj+vs4dOfTz+7J1VWg/ATs8iTwo363V1Vrnnk85g==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for @storybook/client-api@https://registry.npmjs.org/@storybook/client-api/-/client-api-6.2.3.tgz (sha512-Gcd1ydpXH7+S8B0GAkiwIfo1bgr00hs2pGzpwDO/5LGIXHwUojpX20nLBVOZ6uBZs/IwCT/FVWK2jakdPl9ISg==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for @storybook/ui@https://registry.npmjs.org/@storybook/ui/-/ui-6.2.3.tgz (sha512-LJetRJBpDrsHdqcO3UmrCMXNNLurbZFWPa5X0pMrkYrXrfNGrrPUQCTr5aYpeh94UKUpr6ywYt1loldWDe2/qA==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for @storybook/theming@https://registry.npmjs.org/@storybook/theming/-/theming-6.2.3.tgz (sha512-vXzdZtpVqIB1HdeqPjdkYcLigAEtbojEZ5/P0qjvUpI6nNygy7xvtohxn9NWBTeamdXop9xXs0fi/VTiUAlr9Q==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for @storybook/core-server@https://registry.npmjs.org/@storybook/core-server/-/core-server-6.2.3.tgz (sha512-R58/KkF+U43ObcAQzdPTErCxyG5lMrxgIASx47mwngEAKwolbp7pDTgzVXZ49qXLNZ5+pFBCIKD/d+HEUQ6Dkw==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for oojs-ui@https://registry.npmjs.org/oojs-ui/-/oojs-ui-0.39.0.tgz (sha512-bPqva6DXsSonq0lCNzzRzMvvkP0xgVOBMSxL2RkSrvm+tq7KU8w+ElSYqmK3aTTleQqH7jqqpXk88pgfWSltvA==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for @npmcli/fs@https://registry.npmjs.org/@npmcli/fs/-/fs-1.0.0.tgz (sha512-8ltnOpRR/oJbOp8vaGUnipOi3bqkcW+sLHFlyXIr08OGHmVJLB1Hn7QtGXbYcpVtH1gAYZTlmDXtE4YV0+AMMQ==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for @popperjs/core@https://registry.npmjs.org/@popperjs/core/-/core-2.10.2.tgz (sha512-IXf3XA7+XyN7CP9gGh/XB0UxVMlvARGEgGXLubFICsUMGz6Q+DU+i4gGlpOxTjKvXjkJDJC8YdqdKkDj9qZHEQ==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for @types/node@https://registry.npmjs.org/@types/node/-/node-14.17.33.tgz (sha512-noEeJ06zbn3lOh4gqe2v7NMGS33jrulfNqYFDjjEbhpDEHR5VTxgYNQSBqBlJIsBJW3uEYDgD6kvMnrrhGzq8g==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for @storybook/channel-postmessage@https://registry.npmjs.org/@storybook/channel-postmessage/-/channel-postmessage-6.2.3.tgz (sha512-h7E1OrKKoKNkC0NINr0vbFHPSh1jDfYm5c2WTwKLyGo/zM1wrYzx1Hkj2lPrgKNBt0xQfzmrnY1tfV5Tr1TMIQ==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for @emotion/styled@https://registry.npmjs.org/@emotion/styled/-/styled-10.0.27.tgz (sha512-iK/8Sh7+NLJzyp9a5+vIQIXTYxfT4yB/OJbjzQanB2RZpvmzBQOHZWhpAMZWYEKRNNbsD6WfBw5sVWkb6WzS/Q==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for @babel/plugin-transform-react-pure-annotations@https://registry.npmjs.org/@babel/plugin-transform-react-pure-annotations/-/plugin-transform-react-pure-annotations-7.16.0.tgz (sha512-NC/Bj2MG+t8Ef5Pdpo34Ay74X4Rt804h5y81PwOpfPtmAK3i6CizmQqwyBQzIepz1Yt8wNr2Z2L7Lu3qBMfZMA==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for @babel/preset-react@https://registry.npmjs.org/@babel/preset-react/-/preset-react-7.16.0.tgz (sha512-d31IFW2bLRB28uL1WoElyro8RH5l6531XfxMtCeCmp6RVAF1uTfxxUA0LH1tXl+psZdwfmIbwoG4U5VwgbhtLw==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for @babel/plugin-transform-react-display-name@https://registry.npmjs.org/@babel/plugin-transform-react-display-name/-/plugin-transform-react-display-name-7.16.0.tgz (sha512-FJFdJAqaCpndL+pIf0aeD/qlQwT7QXOvR6Cc8JPvNhKJBi2zc/DPc4g05Y3fbD/0iWAMQFGij4+Xw+4L/BMpTg==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for @babel/plugin-transform-react-jsx-development@https://registry.npmjs.org/@babel/plugin-transform-react-jsx-development/-/plugin-transform-react-jsx-development-7.16.0.tgz (sha512-qq65iSqBRq0Hr3wq57YG2AmW0H6wgTnIzpffTphrUWUgLCOK+zf1f7G0vuOiXrp7dU1qq+fQBoqZ3wCDAkhFzw==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for @babel/plugin-transform-react-jsx@https://registry.npmjs.org/@babel/plugin-transform-react-jsx/-/plugin-transform-react-jsx-7.16.0.tgz (sha512-rqDgIbukZ44pqq7NIRPGPGNklshPkvlmvqjdx3OZcGPk4zGIenYkxDTvl3LsSL8gqcc3ZzGmXPE6hR/u/voNOw==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for @storybook/html@https://registry.npmjs.org/@storybook/html/-/html-6.2.3.tgz (sha512-ZzuRXlwlfdh8j2m/w2HrTwyxzVC6lghcm5WqttEnOc7nrUgY8IAxHRsaHfsnBC097WTl+ZyiBBhVMIvxprlkng==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for @storybook/core-client@https://registry.npmjs.org/@storybook/core-client/-/core-client-6.2.3.tgz (sha512-rUy20uuK07PZwoda9k4rnp1MJ2G498wAlOA6XClkKi84+Xe2Ug5PAL/qrDxM+PVyZtxMaiwZE18lvgMo71Bh0A==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for @storybook/core-common@https://registry.npmjs.org/@storybook/core-common/-/core-common-6.2.3.tgz (sha512-alZOFgyC9dMwM6D6ZHM24ROJeFmGH/5EJCxKTRAv9zbXmGkzTar/f7HQH7e/pUxhEESHx18D1bxkNDhfWhaR3w==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for @storybook/addon-actions@https://registry.npmjs.org/@storybook/addon-actions/-/addon-actions-6.2.3.tgz (sha512-RXjTNH+YUYxnOzvfJ0NllJ3+jvb9R8kNq74bS9gDRvg5WY0SFIeN+Eh11wW3PJvmx15xO1+ALJjpCGRjcKzWiQ==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for @es-joy/jsdoccomment@https://registry.npmjs.org/@es-joy/jsdoccomment/-/jsdoccomment-0.12.0.tgz (sha512-Gw4/j9v36IKY8ET+W0GoOzrRw17xjf21EIFFRL3zx21fF5MnqmeNpNi+PU/LKjqLpPb2Pw2XdlJbYM31VVo/PQ==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for @storybook/channels@https://registry.npmjs.org/@storybook/channels/-/channels-6.2.3.tgz (sha512-TTzq5VqZK4/sOKDsq7ZoqpSLQsp16HDTP5ovVXFWxyAlk66E57tWiYnjQy/uXwZDEwzfQEGUsCED3/rFxbvwqg==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for @storybook/builder-webpack4@https://registry.npmjs.org/@storybook/builder-webpack4/-/builder-webpack4-6.2.3.tgz (sha512-f0vFITDMyHDBzlOqoCfi0pgTgOZxbQvEveQv2DshQkpHyiktEFRx8EhVx2r0S/eP9NTAdq3hN1QOWx0FtZxb2w==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for @emotion/styled-base@https://registry.npmjs.org/@emotion/styled-base/-/styled-base-10.0.31.tgz (sha512-wTOE1NcXmqMWlyrtwdkqg87Mu6Rj1MaukEoEmEkHirO5IoHDJ8LgCQL4MjJODgxWxXibGR3opGp1p7YvkNEdXQ==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for @storybook/client-logger@https://registry.npmjs.org/@storybook/client-logger/-/client-logger-6.2.3.tgz (sha512-i4oB9EuKCj9V6l6sRSQ33RP4g3GBtSfRCho9AU+A10U4Yfn7emUllEchCz9s5QOhnSTtJXZ8Xk4tUmp/3YWkGQ==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for @babel/plugin-syntax-decorators@https://registry.npmjs.org/@babel/plugin-syntax-decorators/-/plugin-syntax-decorators-7.16.0.tgz (sha512-nxnnngZClvlY13nHJAIDow0S7Qzhq64fQ/NlqS+VER3kjW/4F0jLhXjeL8jcwSwz6Ca3rotT5NJD2T9I7lcv7g==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for @babel/plugin-proposal-decorators@https://registry.npmjs.org/@babel/plugin-proposal-decorators/-/plugin-proposal-decorators-7.16.0.tgz (sha512-ttvhKuVnQwoNQrcTd1oe6o49ahaZ1kns1fsJKzTVOaS/FJDJoK4qzgVS68xzJhYUMgTnbXW6z/T6rlP3lL7tJw==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for @storybook/addons@https://registry.npmjs.org/@storybook/addons/-/addons-6.2.3.tgz (sha512-IQ4JUalGm53KJ3DtbpsmFsTRNdEHY3AhyVF1xXu6PeO8IDAPQ+yD7hBBR23ZwkBiqmPoq272Y0e/MK64H4fTaA==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for @babel/plugin-syntax-jsx@https://registry.npmjs.org/@babel/plugin-syntax-jsx/-/plugin-syntax-jsx-7.16.0.tgz (sha512-8zv2+xiPHwly31RK4RmnEYY5zziuF3O7W2kIDW+07ewWDh6Oi0dRq8kwvulRkFgt6DB97RlKs5c1y068iPlCUg==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for prompts@https://registry.npmjs.org/prompts/-/prompts-2.4.0.tgz (sha512-awZAKrk3vN6CroQukBL+R9051a4R3zCZBlJm/HBfrSZ8iTpYix3VX1vU4mveiLpiwmOJT4wokTF9m6HUk4KqWQ==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for @storybook/api@https://registry.npmjs.org/@storybook/api/-/api-6.2.3.tgz (sha512-DZwttOQ2AqiR32y/oVy45QcGgY4WlK/vH/NgvwPEJk1VfvlOrLCGa7rFjcZxXrgXM5jPRbgDXThnHPG/em/DPg==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for node-releases@https://registry.npmjs.org/node-releases/-/node-releases-1.1.77.tgz (sha512-rB1DUFUNAN4Gn9keO2K1efO35IDK7yKHCdCaIMvFO7yUYmmZYeDjnGKle26G4rwj+LKRQpjyUUvMkPglwGCYNQ==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for espree@https://registry.npmjs.org/espree/-/espree-9.0.0.tgz (sha512-r5EQJcYZ2oaGbeR0jR0fFVijGOcwai07/690YRXLINuhmVeRY4UKSAsQPe/0BNuDgwP7Ophoc1PRsr2E3tkbdQ==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for globby@https://registry.npmjs.org/globby/-/globby-11.0.1.tgz (sha512-iH9RmgwCmUJHi2z5o2l3eTtGBtXek1OYlHrbcxOYugyHLmAsZrPj43OtHThd62Buh/Vv6VyCBD2bdyWcGNQqoQ==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for espree@https://registry.npmjs.org/espree/-/espree-9.0.0.tgz (sha512-r5EQJcYZ2oaGbeR0jR0fFVijGOcwai07/690YRXLINuhmVeRY4UKSAsQPe/0BNuDgwP7Ophoc1PRsr2E3tkbdQ==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for browserslist@https://registry.npmjs.org/browserslist/-/browserslist-4.14.2.tgz (sha512-HI4lPveGKUR0x2StIz+2FXfDk9SfVMrxn6PLh1JeGUwcuoDkdKZebWiyLRJ68iIPDpMI4JLVDf7S7XzslgWOhw==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for @babel/plugin-transform-parameters@https://registry.npmjs.org/@babel/plugin-transform-parameters/-/plugin-transform-parameters-7.16.0.tgz (sha512-XgnQEm1CevKROPx+udOi/8f8TiGhrUWiHiaUCIp47tE0tpFDjzXNTZc9E5CmCwxNjXTWEVqvRfWZYOTFvMa/ZQ==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for oojs@https://registry.npmjs.org/oojs/-/oojs-5.0.0.tgz (sha512-JFx5wZsD0xwFHG6StlgpfJk7Mk+gf3fF/GteEOv0RHla1zGpgmmZ2xsQWIg9WykTWjd2/9xHEtvvlno2fNnrGw==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for use-composed-ref@https://registry.npmjs.org/use-composed-ref/-/use-composed-ref-1.1.0.tgz (sha512-my1lNHGWsSDAhhVAT4MKs6IjBUtG6ZG11uUqexPH9PptiIZDQOzaF4f5tEbJ2+7qvNbtXNBbU3SfmN+fXlWDhg==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for markdown-to-jsx@https://registry.npmjs.org/markdown-to-jsx/-/markdown-to-jsx-6.11.4.tgz (sha512-3lRCD5Sh+tfA52iGgfs/XZiw33f7fFX9Bn55aNnVNUd2GzLDkOWyKYYD8Yju2B1Vn+feiEdgJs8T6Tg0xNokPw==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for csstype@https://registry.npmjs.org/csstype/-/csstype-3.0.9.tgz (sha512-rpw6JPxK6Rfg1zLOYCSwle2GFOOsnjmDYDaBwEcwoOg4qlsIVCN789VkBZDJAGi4T07gI4YSutR43t9Zz4Lzuw==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for babel-plugin-polyfill-corejs3@https://registry.npmjs.org/babel-plugin-polyfill-corejs3/-/babel-plugin-polyfill-corejs3-0.3.0.tgz (sha512-JLwi9vloVdXLjzACL80j24bG6/T1gYxwowG44dg6HN/7aTPdyPbJJidf6ajoA3RPHHtW0j9KMrSOLpIZpAnPpg==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for babel-plugin-polyfill-corejs3@https://registry.npmjs.org/babel-plugin-polyfill-corejs3/-/babel-plugin-polyfill-corejs3-0.3.0.tgz (sha512-JLwi9vloVdXLjzACL80j24bG6/T1gYxwowG44dg6HN/7aTPdyPbJJidf6ajoA3RPHHtW0j9KMrSOLpIZpAnPpg==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for @babel/plugin-proposal-export-default-from@https://registry.npmjs.org/@babel/plugin-proposal-export-default-from/-/plugin-proposal-export-default-from-7.16.0.tgz (sha512-kFAhaIbh5qbBwETRNa/cgGmPJ/BicXhIyrZhAkyYhf/Z9LXCTRGO1mvUwczto0Hl1q4YtzP9cRtTKT4wujm38Q==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for @babel/preset-env@https://registry.npmjs.org/@babel/preset-env/-/preset-env-7.3.1.tgz (sha512-FHKrD6Dxf30e8xgHQO0zJZpUPfVZg+Xwgz5/RdSWCbza9QLNk4Qbp40ctRoqDxml3O8RMzB1DU55SXeDG6PqHQ==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for @emotion/core@https://registry.npmjs.org/@emotion/core/-/core-10.1.1.tgz (sha512-ZMLG6qpXR8x031NXD8HJqugy/AZSkAuMxxqB46pmAR7ze47MhNJ56cdoX243QPZdGctrdfo+s08yZTiwaUcRKA==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for @babel/core@https://registry.npmjs.org/@babel/core/-/core-7.2.2.tgz (sha512-59vB0RWt09cAct5EIe58+NzGP4TFSD3Bz//2/ELy3ZeTeKF6VTD1AXlH8BGGbCX0PuobZBsIzO7IAI9PH67eKw==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for @babel/helper-compilation-targets@https://registry.npmjs.org/@babel/helper-compilation-targets/-/helper-compilation-targets-7.16.0.tgz (sha512-S7iaOT1SYlqK0sQaCi21RX4+13hmdmnxIEAnQUB/eh7GeAnRjOUgTYpLkUOiRXzD+yog1JxP0qyAQZ7ZxVxLVg==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for @storybook/components@https://registry.npmjs.org/@storybook/components/-/components-6.2.3.tgz (sha512-8STtn4oggc/JsIrRT3HbYwcRUC/6GcSd3Mk+tHYfor8IQ6Iu9bFIUcH7PJrk6d4Ah2aX8Fc0P31y2mlY/4tclw==) seems to be corrupted. Trying again.
npm WARN deprecated @humanwhocodes/object-schema@1.2.1: Use @eslint/object-schema instead
npm WARN tarball tarball data for @babel/plugin-syntax-export-default-from@https://registry.npmjs.org/@babel/plugin-syntax-export-default-from/-/plugin-syntax-export-default-from-7.16.0.tgz (sha512-xllLOdBj77mFSw8s02I+2SSQGHOftbWTlGmagheuNk/gjQsk7IrYsR/EosXVAVpgIUFffLckB/iPRioQYLHSrQ==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for @babel/eslint-parser@https://registry.npmjs.org/@babel/eslint-parser/-/eslint-parser-7.16.0.tgz (sha512-c+AsYOHjI+FgCa+ifLd8sDXp4U4mjkfFgL9NdQWhuA731kAUJs0WdJIXET4A14EJAR9Jv9FFF/MzPWJfV9Oirw==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for @babel/plugin-proposal-async-generator-functions@https://registry.npmjs.org/@babel/plugin-proposal-async-generator-functions/-/plugin-proposal-async-generator-functions-7.16.0.tgz (sha512-nyYmIo7ZqKsY6P4lnVmBlxp9B3a96CscbLotlsNuktMHahkDwoPYEjXrZHU0Tj844Z9f1IthVxQln57mhkcExw==) seems to be corrupted. Trying again.
npm WARN tarball tarball data for @babel/preset-env@https://registry.npmjs.org/@babel/preset-env/-/preset-env-7.16.0.tgz (sha512-cdTu/W0IrviamtnZiTfixPfIncr2M1VqRrkjzZWlr1B4TVYimCFK5jkyOdP4qw2MrlKHi+b3ORj6x8GoCew8Dg==) seems to be corrupted. Trying again.
npm WARN deprecated uuid@3.4.0: Please upgrade to version 7 or higher. Older versions may use Math.random() in certain circumstances, which is known to be problematic. See https://v8.dev/blog/math-random for details.
npm WARN tarball tarball data for @babel/preset-env@https://registry.npmjs.org/@babel/preset-env/-/preset-env-7.16.0.tgz (sha512-cdTu/W0IrviamtnZiTfixPfIncr2M1VqRrkjzZWlr1B4TVYimCFK5jkyOdP4qw2MrlKHi+b3ORj6x8GoCew8Dg==) seems to be corrupted. Trying again.
npm WARN deprecated uuid@3.4.0: Please upgrade to version 7 or higher. Older versions may use Math.random() in certain circumstances, which is known to be problematic. See https://v8.dev/blog/math-random for details.
npm WARN deprecated uuid@3.4.0: Please upgrade to version 7 or higher. Older versions may use Math.random() in certain circumstances, which is known to be problematic. See https://v8.dev/blog/math-random for details.
npm WARN deprecated uuid@3.4.0: Please upgrade to version 7 or higher. Older versions may use Math.random() in certain circumstances, which is known to be problematic. See https://v8.dev/blog/math-random for details.
npm WARN deprecated gauge@2.7.4: This package is no longer supported.
npm WARN tarball tarball data for @babel/helper-remap-async-to-generator@https://registry.npmjs.org/@babel/helper-remap-async-to-generator/-/helper-remap-async-to-generator-7.16.0.tgz (sha512-MLM1IOMe9aQBqMWxcRw8dcb9jlM86NIw7KA0Wri91Xkfied+dE0QuBFSBjMNvqzmS0OSIDsMNC24dBEkPUi7ew==) seems to be corrupted. Trying again.
npm WARN deprecated @stylelint/postcss-css-in-js@0.37.2: Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.
npm WARN deprecated request@2.88.2: request has been deprecated, see https://github.com/request/request/issues/3142
npm WARN deprecated @babel/plugin-proposal-async-generator-functions@7.16.0: This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-async-generator-functions instead.
npm WARN deprecated sinon@4.5.0: 16.1.1
npm WARN deprecated iltorb@2.4.5: The zlib module provides APIs for brotli compression/decompression starting with Node.js v10.16.0, please use it over iltorb
npm WARN deprecated sinon@12.0.1: 16.1.1
npm WARN deprecated eslint@7.32.0: This version is no longer supported. Please see https://eslint.org/version-support for other options.
npm WARN deprecated core-js@2.6.12: core-js@<3.23.3 is no longer maintained and not recommended for usage due to the number of issues. Because of the V8 engine whims, feature detection in old core-js versions could cause a slowdown up to 100x even if nothing is polyfilled. Some versions have web compatibility issues. Please, upgrade your dependencies to the actual version of core-js.
npm WARN deprecated core-js@3.19.1: core-js@<3.23.3 is no longer maintained and not recommended for usage due to the number of issues. Because of the V8 engine whims, feature detection in old core-js versions could cause a slowdown up to 100x even if nothing is polyfilled. Some versions have web compatibility issues. Please, upgrade your dependencies to the actual version of core-js.
npm WARN deprecated core-js@3.19.1: core-js@<3.23.3 is no longer maintained and not recommended for usage due to the number of issues. Because of the V8 engine whims, feature detection in old core-js versions could cause a slowdown up to 100x even if nothing is polyfilled. Some versions have web compatibility issues. Please, upgrade your dependencies to the actual version of core-js.
npm WARN deprecated core-js@3.19.1: core-js@<3.23.3 is no longer maintained and not recommended for usage due to the number of issues. Because of the V8 engine whims, feature detection in old core-js versions could cause a slowdown up to 100x even if nothing is polyfilled. Some versions have web compatibility issues. Please, upgrade your dependencies to the actual version of core-js.
npm WARN deprecated core-js@3.19.1: core-js@<3.23.3 is no longer maintained and not recommended for usage due to the number of issues. Because of the V8 engine whims, feature detection in old core-js versions could cause a slowdown up to 100x even if nothing is polyfilled. Some versions have web compatibility issues. Please, upgrade your dependencies to the actual version of core-js.
npm WARN deprecated core-js@3.19.1: core-js@<3.23.3 is no longer maintained and not recommended for usage due to the number of issues. Because of the V8 engine whims, feature detection in old core-js versions could cause a slowdown up to 100x even if nothing is polyfilled. Some versions have web compatibility issues. Please, upgrade your dependencies to the actual version of core-js.
npm WARN deprecated core-js@3.19.1: core-js@<3.23.3 is no longer maintained and not recommended for usage due to the number of issues. Because of the V8 engine whims, feature detection in old core-js versions could cause a slowdown up to 100x even if nothing is polyfilled. Some versions have web compatibility issues. Please, upgrade your dependencies to the actual version of core-js.
npm WARN deprecated core-js@3.19.1: core-js@<3.23.3 is no longer maintained and not recommended for usage due to the number of issues. Because of the V8 engine whims, feature detection in old core-js versions could cause a slowdown up to 100x even if nothing is polyfilled. Some versions have web compatibility issues. Please, upgrade your dependencies to the actual version of core-js.
npm WARN deprecated core-js@3.19.1: core-js@<3.23.3 is no longer maintained and not recommended for usage due to the number of issues. Because of the V8 engine whims, feature detection in old core-js versions could cause a slowdown up to 100x even if nothing is polyfilled. Some versions have web compatibility issues. Please, upgrade your dependencies to the actual version of core-js.
npm WARN deprecated core-js@3.19.1: core-js@<3.23.3 is no longer maintained and not recommended for usage due to the number of issues. Because of the V8 engine whims, feature detection in old core-js versions could cause a slowdown up to 100x even if nothing is polyfilled. Some versions have web compatibility issues. Please, upgrade your dependencies to the actual version of core-js.
npm WARN deprecated core-js@3.19.1: core-js@<3.23.3 is no longer maintained and not recommended for usage due to the number of issues. Because of the V8 engine whims, feature detection in old core-js versions could cause a slowdown up to 100x even if nothing is polyfilled. Some versions have web compatibility issues. Please, upgrade your dependencies to the actual version of core-js.
npm WARN deprecated core-js@3.19.1: core-js@<3.23.3 is no longer maintained and not recommended for usage due to the number of issues. Because of the V8 engine whims, feature detection in old core-js versions could cause a slowdown up to 100x even if nothing is polyfilled. Some versions have web compatibility issues. Please, upgrade your dependencies to the actual version of core-js.
npm WARN deprecated core-js@3.19.1: core-js@<3.23.3 is no longer maintained and not recommended for usage due to the number of issues. Because of the V8 engine whims, feature detection in old core-js versions could cause a slowdown up to 100x even if nothing is polyfilled. Some versions have web compatibility issues. Please, upgrade your dependencies to the actual version of core-js.
npm WARN deprecated core-js@3.19.1: core-js@<3.23.3 is no longer maintained and not recommended for usage due to the number of issues. Because of the V8 engine whims, feature detection in old core-js versions could cause a slowdown up to 100x even if nothing is polyfilled. Some versions have web compatibility issues. Please, upgrade your dependencies to the actual version of core-js.
npm WARN deprecated core-js@3.19.1: core-js@<3.23.3 is no longer maintained and not recommended for usage due to the number of issues. Because of the V8 engine whims, feature detection in old core-js versions could cause a slowdown up to 100x even if nothing is polyfilled. Some versions have web compatibility issues. Please, upgrade your dependencies to the actual version of core-js.
npm WARN deprecated core-js@3.19.1: core-js@<3.23.3 is no longer maintained and not recommended for usage due to the number of issues. Because of the V8 engine whims, feature detection in old core-js versions could cause a slowdown up to 100x even if nothing is polyfilled. Some versions have web compatibility issues. Please, upgrade your dependencies to the actual version of core-js.
npm WARN deprecated core-js@3.19.1: core-js@<3.23.3 is no longer maintained and not recommended for usage due to the number of issues. Because of the V8 engine whims, feature detection in old core-js versions could cause a slowdown up to 100x even if nothing is polyfilled. Some versions have web compatibility issues. Please, upgrade your dependencies to the actual version of core-js.
npm WARN deprecated core-js@3.19.1: core-js@<3.23.3 is no longer maintained and not recommended for usage due to the number of issues. Because of the V8 engine whims, feature detection in old core-js versions could cause a slowdown up to 100x even if nothing is polyfilled. Some versions have web compatibility issues. Please, upgrade your dependencies to the actual version of core-js.
npm WARN deprecated core-js@3.19.1: core-js@<3.23.3 is no longer maintained and not recommended for usage due to the number of issues. Because of the V8 engine whims, feature detection in old core-js versions could cause a slowdown up to 100x even if nothing is polyfilled. Some versions have web compatibility issues. Please, upgrade your dependencies to the actual version of core-js.
npm WARN deprecated core-js@3.19.1: core-js@<3.23.3 is no longer maintained and not recommended for usage due to the number of issues. Because of the V8 engine whims, feature detection in old core-js versions could cause a slowdown up to 100x even if nothing is polyfilled. Some versions have web compatibility issues. Please, upgrade your dependencies to the actual version of core-js.
npm WARN deprecated core-js@3.19.1: core-js@<3.23.3 is no longer maintained and not recommended for usage due to the number of issues. Because of the V8 engine whims, feature detection in old core-js versions could cause a slowdown up to 100x even if nothing is polyfilled. Some versions have web compatibility issues. Please, upgrade your dependencies to the actual version of core-js.
npm WARN deprecated core-js@3.19.1: core-js@<3.23.3 is no longer maintained and not recommended for usage due to the number of issues. Because of the V8 engine whims, feature detection in old core-js versions could cause a slowdown up to 100x even if nothing is polyfilled. Some versions have web compatibility issues. Please, upgrade your dependencies to the actual version of core-js.
npm WARN deprecated core-js-pure@3.19.1: core-js-pure@<3.23.3 is no longer maintained and not recommended for usage due to the number of issues. Because of the V8 engine whims, feature detection in old core-js versions could cause a slowdown up to 100x even if nothing is polyfilled. Some versions have web compatibility issues. Please, upgrade your dependencies to the actual version of core-js-pure.
npm ERR! code 1
npm ERR! path /src/repo/node_modules/iltorb
npm ERR! command failed
npm ERR! command sh -c node ./scripts/install.js || node-gyp rebuild
npm ERR! info install installing standalone, skipping download.
npm ERR! gyp info it worked if it ends with ok
npm ERR! gyp info using node-gyp@11.1.0
npm ERR! gyp info using node@20.19.2 | linux | x64
npm ERR! gyp info find Python using Python version 3.13.5 found at "/usr/bin/python3"
npm ERR! gyp info spawn /usr/bin/python3
npm ERR! gyp info spawn args [
npm ERR! gyp info spawn args '/usr/share/nodejs/node-gyp/gyp/gyp_main.py',
npm ERR! gyp info spawn args 'binding.gyp',
npm ERR! gyp info spawn args '-f',
npm ERR! gyp info spawn args 'make',
npm ERR! gyp info spawn args '-I',
npm ERR! gyp info spawn args '/src/repo/node_modules/iltorb/build/config.gypi',
npm ERR! gyp info spawn args '-I',
npm ERR! gyp info spawn args '/usr/share/nodejs/node-gyp/addon.gypi',
npm ERR! gyp info spawn args '-I',
npm ERR! gyp info spawn args '/usr/include/nodejs/common.gypi',
npm ERR! gyp info spawn args '-Dlibrary=shared_library',
npm ERR! gyp info spawn args '-Dvisibility=default',
npm ERR! gyp info spawn args '-Dnode_root_dir=/usr/include/nodejs',
npm ERR! gyp info spawn args '-Dnode_gyp_dir=/usr/share/nodejs/node-gyp',
npm ERR! gyp info spawn args '-Dnode_lib_file=/usr/include/nodejs/<(target_arch)/node.lib',
npm ERR! gyp info spawn args '-Dmodule_root_dir=/src/repo/node_modules/iltorb',
npm ERR! gyp info spawn args '-Dnode_engine=v8',
npm ERR! gyp info spawn args '--depth=.',
npm ERR! gyp info spawn args '--no-parallel',
npm ERR! gyp info spawn args '--generator-output',
npm ERR! gyp info spawn args 'build',
npm ERR! gyp info spawn args '-Goutput_dir=.'
npm ERR! gyp info spawn args ]
npm ERR! gyp ERR! build error
npm ERR! gyp ERR! stack Error: not found: make
npm ERR! gyp ERR! stack at getNotFoundError (/usr/share/nodejs/which/which.js:10:17)
npm ERR! gyp ERR! stack at /usr/share/nodejs/which/which.js:57:18
npm ERR! gyp ERR! stack at new Promise (<anonymous>)
npm ERR! gyp ERR! stack at step (/usr/share/nodejs/which/which.js:54:21)
npm ERR! gyp ERR! stack at /usr/share/nodejs/which/which.js:71:22
npm ERR! gyp ERR! stack at new Promise (<anonymous>)
npm ERR! gyp ERR! stack at subStep (/usr/share/nodejs/which/which.js:69:33)
npm ERR! gyp ERR! stack at /usr/share/nodejs/which/which.js:80:22
npm ERR! gyp ERR! stack at /usr/share/nodejs/isexe/index.js:42:5
npm ERR! gyp ERR! stack at /usr/share/nodejs/isexe/mode.js:8:5
npm ERR! gyp ERR! System Linux 6.1.0-30-cloud-amd64
npm ERR! gyp ERR! command "/usr/bin/node" "/usr/share/nodejs/node-gyp/bin/node-gyp.js" "rebuild"
npm ERR! gyp ERR! cwd /src/repo/node_modules/iltorb
npm ERR! gyp ERR! node -v v20.19.2
npm ERR! gyp ERR! node-gyp -v v11.1.0
npm ERR! gyp ERR! not ok
npm ERR! A complete log of this run can be found in:
npm ERR! /cache/_logs/2025-10-05T07_51_07_432Z-debug-0.log
--- stdout ---
--- end ---
Verifying that tests still pass
$ /usr/bin/npm ci
--- stderr ---
npm WARN ERESOLVE overriding peer dependency
npm WARN While resolving: @babel/helper-define-polyfill-provider@0.2.4
npm WARN Found: @babel/core@7.2.2
npm WARN node_modules/@babel/core
npm WARN dev @babel/core@"7.2.2" from the root project
npm WARN 85 more (@babel/helper-compilation-targets, ...)
npm WARN
npm WARN Could not resolve dependency:
npm WARN peer @babel/core@"^7.4.0-0" from @babel/helper-define-polyfill-provider@0.2.4
npm WARN node_modules/babel-plugin-polyfill-corejs2/node_modules/@babel/helper-define-polyfill-provider
npm WARN @babel/helper-define-polyfill-provider@"^0.2.4" from babel-plugin-polyfill-corejs2@0.2.3
npm WARN node_modules/babel-plugin-polyfill-corejs2
npm WARN
npm WARN Conflicting peer dependency: @babel/core@7.28.4
npm WARN node_modules/@babel/core
npm WARN peer @babel/core@"^7.4.0-0" from @babel/helper-define-polyfill-provider@0.2.4
npm WARN node_modules/babel-plugin-polyfill-corejs2/node_modules/@babel/helper-define-polyfill-provider
npm WARN @babel/helper-define-polyfill-provider@"^0.2.4" from babel-plugin-polyfill-corejs2@0.2.3
npm WARN node_modules/babel-plugin-polyfill-corejs2
npm WARN ERESOLVE overriding peer dependency
npm WARN While resolving: @babel/helper-define-polyfill-provider@0.1.5
npm WARN Found: @babel/core@7.2.2
npm WARN node_modules/@babel/core
npm WARN dev @babel/core@"7.2.2" from the root project
npm WARN 85 more (@babel/helper-compilation-targets, ...)
npm WARN
npm WARN Could not resolve dependency:
npm WARN peer @babel/core@"^7.4.0-0" from @babel/helper-define-polyfill-provider@0.1.5
npm WARN node_modules/babel-plugin-polyfill-corejs3/node_modules/@babel/helper-define-polyfill-provider
npm WARN @babel/helper-define-polyfill-provider@"^0.1.5" from babel-plugin-polyfill-corejs3@0.1.7
npm WARN node_modules/babel-plugin-polyfill-corejs3
npm WARN
npm WARN Conflicting peer dependency: @babel/core@7.28.4
npm WARN node_modules/@babel/core
npm WARN peer @babel/core@"^7.4.0-0" from @babel/helper-define-polyfill-provider@0.1.5
npm WARN node_modules/babel-plugin-polyfill-corejs3/node_modules/@babel/helper-define-polyfill-provider
npm WARN @babel/helper-define-polyfill-provider@"^0.1.5" from babel-plugin-polyfill-corejs3@0.1.7
npm WARN node_modules/babel-plugin-polyfill-corejs3
npm WARN ERESOLVE overriding peer dependency
npm WARN While resolving: @babel/helper-define-polyfill-provider@0.2.4
npm WARN Found: @babel/core@7.2.2
npm WARN node_modules/@babel/core
npm WARN dev @babel/core@"7.2.2" from the root project
npm WARN 85 more (@babel/helper-compilation-targets, ...)
npm WARN
npm WARN Could not resolve dependency:
npm WARN peer @babel/core@"^7.4.0-0" from @babel/helper-define-polyfill-provider@0.2.4
npm WARN node_modules/babel-plugin-polyfill-regenerator/node_modules/@babel/helper-define-polyfill-provider
npm WARN @babel/helper-define-polyfill-provider@"^0.2.4" from babel-plugin-polyfill-regenerator@0.2.3
npm WARN node_modules/babel-plugin-polyfill-regenerator
npm WARN
npm WARN Conflicting peer dependency: @babel/core@7.28.4
npm WARN node_modules/@babel/core
npm WARN peer @babel/core@"^7.4.0-0" from @babel/helper-define-polyfill-provider@0.2.4
npm WARN node_modules/babel-plugin-polyfill-regenerator/node_modules/@babel/helper-define-polyfill-provider
npm WARN @babel/helper-define-polyfill-provider@"^0.2.4" from babel-plugin-polyfill-regenerator@0.2.3
npm WARN node_modules/babel-plugin-polyfill-regenerator
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: undefined,
npm WARN EBADENGINE required: { node: '12.22.5' },
npm WARN EBADENGINE current: { node: 'v20.19.2', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: '@es-joy/jsdoccomment@0.12.0',
npm WARN EBADENGINE required: { node: '^12 || ^14 || ^16 || ^17' },
npm WARN EBADENGINE current: { node: 'v20.19.2', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: 'eslint-plugin-jsdoc@37.0.3',
npm WARN EBADENGINE required: { node: '^12 || ^14 || ^16 || ^17' },
npm WARN EBADENGINE current: { node: 'v20.19.2', npm: '9.2.0' }
npm WARN EBADENGINE }
npm ERR! code EUSAGE
npm ERR!
npm ERR! `npm ci` can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync. Please update your lock file with `npm install` before continuing.
npm ERR!
npm ERR! Invalid: lock file's @wikimedia/mw-node-qunit@6.2.1 does not satisfy @wikimedia/mw-node-qunit@6.4.2
npm ERR! Invalid: lock file's bundlesize@0.18.1 does not satisfy bundlesize@0.18.2
npm ERR! Invalid: lock file's jsdoc@3.6.7 does not satisfy jsdoc@3.6.11
npm ERR! Invalid: lock file's less@3.8.1 does not satisfy less@3.13.1
npm ERR! Invalid: lock file's webpack-cli@3.3.11 does not satisfy webpack-cli@3.3.12
npm ERR! Missing: jsdom@18.0.1 from lock file
npm ERR! Missing: mustache@4.2.0 from lock file
npm ERR! Invalid: lock file's oojs@2.2.2 does not satisfy oojs@6.0.0
npm ERR! Invalid: lock file's prettier@1.11.1 does not satisfy prettier@2.4.1
npm ERR! Invalid: lock file's qunit@2.7.0 does not satisfy qunit@2.17.2
npm ERR! Missing: sinon@12.0.1 from lock file
npm ERR! Invalid: lock file's axios@0.21.4 does not satisfy axios@1.12.2
npm ERR! Invalid: lock file's github-build@1.2.3 does not satisfy github-build@1.2.4
npm ERR! Invalid: lock file's follow-redirects@1.14.5 does not satisfy follow-redirects@1.15.11
npm ERR! Missing: form-data@4.0.4 from lock file
npm ERR! Missing: proxy-from-env@1.1.0 from lock file
npm ERR! Invalid: lock file's axios@0.21.3 does not satisfy axios@1.6.0
npm ERR! Missing: @types/markdown-it@12.2.3 from lock file
npm ERR! Invalid: lock file's markdown-it@10.0.0 does not satisfy markdown-it@12.3.2
npm ERR! Invalid: lock file's markdown-it-anchor@5.3.0 does not satisfy markdown-it-anchor@8.6.7
npm ERR! Invalid: lock file's marked@2.1.3 does not satisfy marked@4.3.0
npm ERR! Invalid: lock file's underscore@1.13.1 does not satisfy underscore@1.13.7
npm ERR! Missing: @types/linkify-it@5.0.0 from lock file
npm ERR! Missing: @types/mdurl@2.0.0 from lock file
npm ERR! Missing: copy-anything@2.0.6 from lock file
npm ERR! Missing: make-dir@2.1.0 from lock file
npm ERR! Missing: native-request@1.1.2 from lock file
npm ERR! Missing: tslib@1.14.1 from lock file
npm ERR! Missing: is-what@3.14.1 from lock file
npm ERR! Missing: argparse@2.0.1 from lock file
npm ERR! Invalid: lock file's entities@2.0.3 does not satisfy entities@2.1.0
npm ERR! Invalid: lock file's linkify-it@2.2.0 does not satisfy linkify-it@3.0.3
npm ERR! Invalid: lock file's interpret@1.2.0 does not satisfy interpret@1.4.0
npm ERR! Missing: yargs@13.3.2 from lock file
npm ERR! Missing: cliui@5.0.0 from lock file
npm ERR! Missing: find-up@3.0.0 from lock file
npm ERR! Missing: string-width@3.1.0 from lock file
npm ERR! Missing: y18n@4.0.3 from lock file
npm ERR! Missing: yargs-parser@13.1.2 from lock file
npm ERR! Missing: acorn@8.15.0 from lock file
npm ERR! Missing: acorn-globals@6.0.0 from lock file
npm ERR! Missing: cssom@0.5.0 from lock file
npm ERR! Missing: cssstyle@2.3.0 from lock file
npm ERR! Missing: data-urls@3.0.2 from lock file
npm ERR! Missing: decimal.js@10.6.0 from lock file
npm ERR! Missing: domexception@4.0.0 from lock file
npm ERR! Missing: escodegen@2.1.0 from lock file
npm ERR! Missing: form-data@4.0.4 from lock file
npm ERR! Missing: html-encoding-sniffer@3.0.0 from lock file
npm ERR! Missing: http-proxy-agent@5.0.0 from lock file
npm ERR! Missing: https-proxy-agent@5.0.1 from lock file
npm ERR! Missing: is-potential-custom-element-name@1.0.1 from lock file
npm ERR! Missing: parse5@6.0.1 from lock file
npm ERR! Missing: saxes@5.0.1 from lock file
npm ERR! Missing: tough-cookie@4.1.4 from lock file
npm ERR! Missing: w3c-xmlserializer@3.0.0 from lock file
npm ERR! Missing: webidl-conversions@7.0.0 from lock file
npm ERR! Missing: whatwg-encoding@2.0.0 from lock file
npm ERR! Missing: whatwg-mimetype@3.0.0 from lock file
npm ERR! Missing: whatwg-url@10.0.0 from lock file
npm ERR! Missing: ws@8.18.3 from lock file
npm ERR! Missing: xml-name-validator@4.0.0 from lock file
npm ERR! Missing: @tootallnate/once@2.0.0 from lock file
npm ERR! Missing: agent-base@6.0.2 from lock file
npm ERR! Missing: xml-name-validator@4.0.0 from lock file
npm ERR! Missing: acorn@7.4.1 from lock file
npm ERR! Missing: acorn-walk@7.2.0 from lock file
npm ERR! Missing: cssom@0.3.8 from lock file
npm ERR! Invalid: lock file's abab@2.0.5 does not satisfy abab@2.0.6
npm ERR! Missing: whatwg-url@11.0.0 from lock file
npm ERR! Missing: estraverse@5.3.0 from lock file
npm ERR! Missing: source-map@0.6.1 from lock file
npm ERR! Missing: es-set-tostringtag@2.1.0 from lock file
npm ERR! Missing: hasown@2.0.2 from lock file
npm ERR! Missing: es-errors@1.3.0 from lock file
npm ERR! Invalid: lock file's get-intrinsic@1.1.1 does not satisfy get-intrinsic@1.3.0
npm ERR! Invalid: lock file's has-tostringtag@1.0.0 does not satisfy has-tostringtag@1.0.2
npm ERR! Missing: call-bind-apply-helpers@1.0.2 from lock file
npm ERR! Missing: es-define-property@1.0.1 from lock file
npm ERR! Missing: es-object-atoms@1.1.1 from lock file
npm ERR! Invalid: lock file's function-bind@1.1.1 does not satisfy function-bind@1.1.2
npm ERR! Missing: get-proto@1.0.1 from lock file
npm ERR! Missing: gopd@1.2.0 from lock file
npm ERR! Invalid: lock file's has-symbols@1.0.2 does not satisfy has-symbols@1.1.0
npm ERR! Missing: math-intrinsics@1.1.0 from lock file
npm ERR! Missing: dunder-proto@1.0.1 from lock file
npm ERR! Invalid: lock file's commander@2.12.2 does not satisfy commander@7.2.0
npm ERR! Missing: node-watch@0.7.2 from lock file
npm ERR! Missing: @sinonjs/fake-timers@8.1.0 from lock file
npm ERR! Missing: @sinonjs/samsam@6.1.3 from lock file
npm ERR! Missing: diff@5.2.0 from lock file
npm ERR! Missing: nise@5.1.9 from lock file
npm ERR! Missing: supports-color@7.2.0 from lock file
npm ERR! Missing: @sinonjs/commons@3.0.1 from lock file
npm ERR! Missing: @sinonjs/fake-timers@11.3.1 from lock file
npm ERR! Invalid: lock file's @sinonjs/text-encoding@0.7.1 does not satisfy @sinonjs/text-encoding@0.7.3
npm ERR! Missing: just-extend@6.2.0 from lock file
npm ERR! Missing: path-to-regexp@6.3.0 from lock file
npm ERR! Missing: universalify@0.2.0 from lock file
npm ERR! Missing: url-parse@1.5.10 from lock file
npm ERR! Missing: querystringify@2.2.0 from lock file
npm ERR! Missing: requires-port@1.0.0 from lock file
npm ERR! Missing: iconv-lite@0.6.3 from lock file
npm ERR! Missing: tr46@3.0.0 from lock file
npm ERR! Missing: form-data@4.0.4 from lock file
npm ERR! Missing: strip-ansi@5.2.0 from lock file
npm ERR! Missing: wrap-ansi@5.1.0 from lock file
npm ERR! Missing: locate-path@3.0.0 from lock file
npm ERR! Missing: p-locate@3.0.0 from lock file
npm ERR! Missing: path-exists@3.0.0 from lock file
npm ERR! Missing: p-limit@2.3.0 from lock file
npm ERR! Missing: emoji-regex@7.0.3 from lock file
npm ERR! Missing: is-fullwidth-code-point@2.0.0 from lock file
npm ERR! Missing: ansi-regex@4.1.1 from lock file
npm ERR!
npm ERR! Clean install a project
npm ERR!
npm ERR! Usage:
npm ERR! npm ci
npm ERR!
npm ERR! Options:
npm ERR! [-S|--save|--no-save|--save-prod|--save-dev|--save-optional|--save-peer|--save-bundle]
npm ERR! [-E|--save-exact] [-g|--global] [--install-strategy <hoisted|nested|shallow>]
npm ERR! [--legacy-bundling] [--global-style]
npm ERR! [--omit <dev|optional|peer> [--omit <dev|optional|peer> ...]]
npm ERR! [--strict-peer-deps] [--no-package-lock] [--foreground-scripts]
npm ERR! [--ignore-scripts] [--no-audit] [--no-bin-links] [--no-fund] [--dry-run]
npm ERR! [-w|--workspace <workspace-name> [-w|--workspace <workspace-name> ...]]
npm ERR! [-ws|--workspaces] [--include-workspace-root] [--no-install-links]
npm ERR!
npm ERR! aliases: clean-install, ic, install-clean, isntall-clean
npm ERR!
npm ERR! Run "npm help ci" for more info
npm ERR! A complete log of this run can be found in:
npm ERR! /cache/_logs/2025-10-05T07_53_15_139Z-debug-0.log
--- stdout ---
--- end ---
Traceback (most recent call last):
File "/venv/lib/python3.13/site-packages/runner/__init__.py", line 2030, in main
libup.run(args.repo, args.output, args.branch)
~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/venv/lib/python3.13/site-packages/runner/__init__.py", line 1972, in run
self.npm_audit_fix(new_npm_audit)
~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^
File "/venv/lib/python3.13/site-packages/runner/__init__.py", line 274, in npm_audit_fix
self.npm_test()
~~~~~~~~~~~~~^^
File "/venv/lib/python3.13/site-packages/runner/__init__.py", line 321, in npm_test
self.check_call(["npm", "ci"])
~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^
File "/venv/lib/python3.13/site-packages/runner/shell2.py", line 63, in check_call
res.check_returncode()
~~~~~~~~~~~~~~~~~~~~^^
File "/usr/lib/python3.13/subprocess.py", line 508, in check_returncode
raise CalledProcessError(self.returncode, self.args, self.stdout,
self.stderr)
subprocess.CalledProcessError: Command '['/usr/bin/npm', 'ci']' returned non-zero exit status 1.