dependency remediation

clawnify/clawflow#71 was closed unmerged on 2026-11-11 20:01:14 utc: withdrawn as a duplicate of #69, which already moves openclaw to 2026.9.2 in the same package-lock.json.

clawnify/clawflow#70 was closed unmerged on 2026-11-11 19:48:11 utc: withdrawn as a duplicate of #69, which already moves openclaw to 2026.9.2 in the same package-lock.json.

geshan/geshan.github.com#722 was closed unmerged on 2026-11-11 07:42:31 utc: the read answered closed with no merge, and no fix is recorded.

payloadcms/payload#19442 was closed unmerged on 2026-11-08 10:40:00 utc: the read answered closed with no merge, and no fix is recorded.

creation dates are when each pull request was opened, in utc, except a contributed row, whose date is the instant EZO's contribution was posted.

states were checked at the last read of each row, the newest on 2026-11-13 15:37:00 utc; the newest state this record carries is 2026-11-13 14:05:55 utc.

evidence is the method used to show a finding, not its severity.

a row records a pull request and its outcome: open, waiting on its maintainer; closed unmerged, kept as recorded; fixed on dev, fixed upstream, or merged, naming the fix.

ln-dev7/landing-pages#1 was closed unmerged on 2026-11-06 06:59:00 utc: the read answered closed with no merge, and no fix is recorded.

symfony/demo#1680 was closed unmerged on 2026-11-06 09:26:59 utc: the read answered closed with no merge, and no fix is recorded.

firelex/jeff#19 was closed unmerged on 2026-11-06 09:15:34 utc: the read answered closed with no merge, and no fix is recorded.

honeygarg389/Whatscrm_6.1.0#1: one lock entry, three fields, moves vm2 3.11.6 to 3.11.7 with package.json byte-identical to the base commit.

honeygarg389/Whatscrm_6.1.0#1: npm ci already fails on the base commit over a missing @google-cloud/firestore entry, reproduced there, so the install proof is npm install.

chunhui-shi/avitam-teach#1: the change is one generation's lockfile, and no other lockfile in the repository carries a vm2 entry.

chunhui-shi/avitam-teach#1: npm audit on that generation falls from 18 advisories to 17, and the remaining critical one is next, a separate dependency.

schmisev/huitml#1: one lock entry, three fields, and package.json is byte-identical to the base commit.

schmisev/huitml#1: the first commit moved the entry while the pull request was open, and the second took it to 0.8.27 rather than leave it a release behind.

jeonwonwooo/PAMA-Studio#16: the lock entry moves 9router 0.4.31 to 0.4.37, adding enquirer and dropping systray, with package.json untouched.

jeonwonwooo/PAMA-Studio#16: the pull request is one commit, 48 insertions and 47 deletions in package-lock.json, and its body records no run.

harmony7/compute-js-rsc#1: the declared range already admitted the patch, so package.json is byte-identical and only the lockfile moves.

harmony7/compute-js-rsc#1: npm ci installs 19.0.9 in all three packages, the last 19.0.x release, and the entries resolve registry tarballs with their sha512.

davesnx/workshop-fun-ocaml#1: the declared range already admitted the patch, so package.json is byte-identical and only the lockfile moves.

davesnx/workshop-fun-ocaml#1: npm ci installs 19.1.10 in all three packages, the last 19.1.x release, and the entries resolve registry tarballs with their sha512.

VrtxOmega/constellation-journal#2: npm ci installs electron 25.8.4 and npm audit no longer reports the two entries this pin clears.

VrtxOmega/constellation-journal#2: 25.x is end-of-life, so the later Electron advisories remain and a supported major is a separate change.

eternauta1337/superclaude#1: the CLI and cli-platform-android move together to 18.0.1, and the CLI reports that version.

eternauta1337/superclaude#1: the regenerated lockfile is byte-identical, and the diff is the two pins in the manifest and the lockfile.

webtypen/webframez-react#1: react, react-dom and react-server-dom-webpack move together from 19.1.1 to 19.1.10, none deprecated after the bump.

webtypen/webframez-react#1: npm ci, six scoped tests and npm run build pass on the bumped tree, and npm audit reports no entry for the three.

wentorai/Research-Claw#78: the patch is a real diff against 2026.9.2, 36 files and 76 hunks, re-hashed into the lockfile so a frozen install resolves it.

wentorai/Research-Claw#78: three production readers of the retired sessions.json were repaired, and the frozen install, extension build, probes and patch tests pass.

sii-system/agent-opik-plugin#20: openclaw moves 2026.8.1 to 2026.9.2 in the development harness host's manifest and lockfile, two files at +266/-266.

sii-system/agent-opik-plugin#20: the harness is a development and test fixture, not shipped runtime code, so the exposure is a fixture's and not a consumer's.

sii-system/agent-opik-plugin#20: two published repository advisories cover 2026.8.1, patched at 2026.8.2 and at 2026.9.2, so the new pin is the first release outside both.

sii-system/agent-opik-plugin#20: the second advisory is absent from every package-mapped source: npm's bulk feed is empty at both versions and OSV holds a GIT range only.

sii-system/agent-opik-plugin#20: harness/openclaw/index.ts imports openclaw/plugin-sdk/plugin-entry, so the plugin API the harness uses resolves under 2026.9.2.

sii-system/agent-opik-plugin#20: npm ci --ignore-scripts installed 2026.9.2 and npm run build (tsc) exited 0, while a pristine lock control left the lockfile unchanged.

sii-system/agent-opik-plugin#20: no live OpenClaw gateway ran, and harness/openclaw has no test script, so the build is its only check.

heypinchy/pinchy#1295: openclaw moves 2026.7.1-2 to 2026.9.2 in the root, runtime and web manifests, the Dockerfile, the config test, osv-scanner.toml and the pnpm lockfile.

heypinchy/pinchy#1295: the prerelease pin 2026.7.1-2 sorts below the advisory's 2026.7.2 lower bound, so it sits outside it, while 59 of its 722 advisories still hit it.

heypinchy/pinchy#1295: 2026.8.1 leaves two advisories, 2026.9.1 one and 2026.9.2 none, while 2026.9.36 needs Node 24.22.1 and 2026.9.2 keeps the repository on Node 22.

heypinchy/pinchy#1295: the undici override widens from below 8.10.2 to below 8.12.2 because 2026.9.2 pins undici exactly at 8.10.2, which carries eight advisories.

heypinchy/pinchy#1295: kysely is pinned to 0.29.5 to remove a duplicate that broke tsc with two @better-auth/core type identities, and koffi joins ignoredBuiltDependencies.

heypinchy/pinchy#1295: a frozen install, typecheck, lint, prettier, build and 323 tests passed, and osv-scanner answered no issues on both lockfiles.

heypinchy/pinchy#1295: at HEAD two of eight reload-planner cases timed out at 20s on a cold first run in the baseline worktree; all 309 pass on the bumped tree.

2014-y/NexoraAgent#1: openclaw moves 2026.9.1 to 2026.9.2 in package.json and package-lock.json, and the two extension development pins move from 2026.5.28 to 2026.9.2.

2014-y/NexoraAgent#1: the published advisory covers 2026.7.2 to below 2026.9.2, so the pinned 2026.9.1 sits inside it and 2026.9.2 is the first release outside.

2014-y/NexoraAgent#1: the 722-advisory repository corpus over the lockfile scores 1 to 0.

2014-y/NexoraAgent#1: the lock control changed metadata only, 72 insertions and 33 deletions, and the bump repairs pre-existing protobufjs and @types/node drift.

2014-y/NexoraAgent#1: absent from every package-mapped advisory source, while npm's bulk feed answers 107 at a 2026.4.21 control, so the feed is live and the empty answer is real.

2014-y/NexoraAgent#1: this is the first pull request the repository has ever received, and the only double-digit-star repository in the pool's gate-passing set.

2014-y/NexoraAgent#1: npm ci, a full npm install and the repository's own stable-update script passed; the full guard runner did not run because its child spawn returns ENOENT.

lidless-labs/adguardctrl#28: openclaw moves 2026.8.35 to 2026.9.2 in package.json and package-lock.json, two files at +191/-203; npm audit stays 2 moderate and --omit=dev stays 0.

lidless-labs/adguardctrl#28: the published advisory covers 2026.7.2 to below 2026.9.2, so the pinned 2026.8.35 sits inside it and 2026.9.2 is the first fixed release.

lidless-labs/adguardctrl#28: the 722-advisory repository corpus scores 1 to 0, while the residual minimatch 10.2.6 entry is a different package under another advisory and stays.

lidless-labs/adguardctrl#28: CONTRIBUTING.md blocks commits without the co-author trailer it names, so this commit carries it, the exception the no-attribution rule allows.

lidless-labs/adguardctrl#28: verify passed 48/48 files and 261/261 tests; three first-run timing failures did not reproduce, neither failing file imports openclaw; vitest 10/10.

lidless-labs/adguardctrl#28: peerDependencies stays ^2026.4.22, so a consumer can still run an affected host at 2026.7.2 to 2026.8.x; raising it is a breaking change.

lidless-labs/adguardctrl#28: absent from every package-mapped advisory source: npm's bulk feed answers {} at both versions while a control at 2026.4.21 returns 77.

ademu/openclaw-ademu#41: openclaw moves 2026.9.1 to 2026.9.2 in package.json, package-lock.json and README.md, three files at +114/-102.

ademu/openclaw-ademu#41: the published advisory covers 2026.7.2 to below 2026.9.2, so the pinned 2026.9.1 sits inside it and 2026.9.2 is the first release outside.

ademu/openclaw-ademu#41: 2026.9.36 declares zod 4.6.7 against this repo's 4.4.3, so tsc dies on the _zod.version.minor 6-vs-4 discriminant and the pin stops at 2026.9.2.

ademu/openclaw-ademu#41: absent from every package-mapped advisory source: npm's bulk feed is empty, both advisory records 404 and OSV holds only a CVE alias with a GIT range.

ademu/openclaw-ademu#41: npm audit falls from 18 to 11, clearing @hono/node-server, body-parser, fast-uri, hono, ip-address, proxy-addr and qs and adding none.

ademu/openclaw-ademu#41: install, build, typecheck, the acceptance script, audit and pack:check ran, with ACCEPTANCE PASS against OpenClaw 2026.9.2, and no live host ran.

ademu/openclaw-ademu#41: the peer range stays >=2026.8.1, so hosts 2026.8.1 to 2026.9.1 remain permitted inside the advisory; raising that floor is a separate change.

tetherto/qvac#5582: the openclaw devDependency moves 2026.8.1 to 2026.9.2 in the plugin's manifest, with the lockfile regenerated and the 2026.6.0 peer floor unchanged.

tetherto/qvac#5582: #5026 merged the same bump on 2026-10-14 in the same two files, and CONTRIBUTING.md's Dependency bumps section prescribes it, so the convention is the repo's.

tetherto/qvac#5582: two published advisories cover the old pin and neither covers 2026.9.2, checked against 762 global npm and 722 repository advisory ranges.

tetherto/qvac#5582: absent from every package-mapped source: npm's bulk feed is empty at both versions, both GHSA records 404, and OSV holds only a GIT range with no npm package.

tetherto/qvac#5582: 2026.9.36 and 2026.10.2 both fail tsc with TS2379 on the plugin's openclaw config type, so the pin stops at the advisory floor, not on preference.

tetherto/qvac#5582: install, lint, typecheck, build and tests executed, one workspace test already failing on base, and no live OpenClaw gateway ran.

tetherto/qvac#5582: osv-scanner over the lockfile reads 51 vulnerable entries and 240 vulnerabilities before, 51 and 229 after, the 11 fewer all undici 8.10.0 to 8.10.2.

Tencent/openclaw-weixin#377: openclaw 2026.8.1 to 2026.9.2 in devDependencies and package-lock.json, with no source change and the published plugin unchanged.

Tencent/openclaw-weixin#377: the advisory covers openclaw from 2026.7.2 to below 2026.9.2, so 2026.8.1 sits inside it and 2026.9.2 is the first fixed release.

Tencent/openclaw-weixin#377: absent from every package-mapped source: the GitHub record is unreviewed with no vulnerability entries and OSV's record carries no package field.

Tencent/openclaw-weixin#377: openclaw is a dev dependency and an unchanged peer and the advisory is host-side; no plugin-SDK import reaches the Discord voice path.

Tencent/openclaw-weixin#377: that reach and the unshrunk SDK surface are static readings, not an exercised advisory path, and no live OpenClaw Gateway ran.

Tencent/openclaw-weixin#377: install, lint, typecheck and build exit 0, and the audit falls from 22 vulnerable entries to 15 by clearing 24 and adding none.

Tencent/openclaw-weixin#377: the peer range and host floor stay 2026.5.12, which still admits 2026.7.2 to 2026.9.1, so a host in that window needs the upgrade.

EtienneLescot/n8n-as-code#705: the openclaw devDependency moves 2026.8.2 to 2026.9.2 in one manifest line, with no committed lockfile and the peer range unchanged.

EtienneLescot/n8n-as-code#705: exactly one published advisory range covers the pinned 2026.8.2, patched at 2026.9.2, and the new pin is outside it.

EtienneLescot/n8n-as-code#705: the advisory is absent from npm's bulk feed and every package-mapped source, so npm audit stays 25 with no openclaw entry before or after.

EtienneLescot/n8n-as-code#705: the plugin imports one type from openclaw and its packed tarball carries no openclaw code, so consumer exposure is the peer range.

EtienneLescot/n8n-as-code#705: install, tsc at three versions and the build ran, but no live OpenClaw host did, and the prompt-context test is red on main before and after.

EtienneLescot/n8n-as-code#705: the maintainer has never merged a Dependabot pull request here and bulk-closed the last six, so the row claims no merge signal.

soimy/openclaw-channel-dingtalk#643: the dev pin and the install floor both move 2026.8.1 to 2026.9.2, clearing the two advisories that cover the old pin.

soimy/openclaw-channel-dingtalk#643: it was first cut at 2026.9.36 and repinned, because that release reworded the external-content warning nine trust-boundary tests assert on.

soimy/openclaw-channel-dingtalk#643: repinned to the floor, it is CLEAN with a passing test job.

soimy/openclaw-channel-dingtalk#643: the published artifact never ships openclaw (a dev dependency and an optional peer), so consumer exposure is the peer range.

soimy/openclaw-channel-dingtalk#643: both advisories are absent from every package-mapped advisory source, so a package query returns nothing and the audit count does not move.

DingTalk-Real-AI/dingtalk-openclaw-connector#686: the floor move clears all 61 openclaw entries the audit reports at 2026.8.1.

DingTalk-Real-AI/dingtalk-openclaw-connector#686: the published artifact never ships openclaw (files allowlist and neverBundle), so consumer exposure is the peer range.

DingTalk-Real-AI/dingtalk-openclaw-connector#686: both advisories are absent from every package-mapped advisory source, so a package query returns nothing.

NVIDIA-AI-Blueprints/video-search-and-summarization#2852: 5 files, +2626/-1572; npm audit 17 (1 critical) to 5 (0 critical), clearing 40 advisories absent from every global feed.

NVIDIA-AI-Blueprints/video-search-and-summarization#2852: BASE_IMAGE NemoClaw v0.0.127 still ships openclaw 2026.7.1, and v0.0.128 ships 2026.9.1, one advisory short.

NVIDIA-AI-Blueprints/video-search-and-summarization#2852: no published tag carries 2026.9.2, so it clears the build dependency and does not move the shipped runtime.

newsnowlabs/dockside#69: OSV carries all six advisories keyed by CVE but maps no package, so a package query at the shipped 1.68.2 returns nothing and the bump is manual.

germanynick/n8n-nodes-binance#15: the nine n8n ranges live only in n8n's own repository advisory database, absent from the global database and OSV, so no scanner reports them.

context-dot-dev/webdog#37: a lockfile-only bump clearing four global-database better-auth advisories and nine repository-only ones; the manifest range already permitted 1.7.x.

Dokploy/dokploy#5867: the sso package's 1.6.27 patch carries the published fix and 1.6.34 is the latest 1.6.x patch, while the 1.7.x advisory is not cleared by this bump.

snyk/snyk-gradle-plugin#362: the plugin pins shescape exactly, so 2.1.14 shipped to every consumer; 2.1.15 is the minimal BusyBox escaping patch and keeps Node 20 support.

will-be-done/will-be-done#144: the first 8.30.0 revision sat inside a published advisory's affected range; the head b3f13749 raises the floor to ^8.41.0 and resolves 8.46.0.

google/clasp#1182: a dependency bump for a published advisory that awaits a signed Google Contributor License Agreement before review, not a finding of ours.

blocksecteam/metasuites#56: a dependency bump for two published advisories, not a finding of ours; the manifest and lockfile moved to 3.4.17 and node_modules read back 3.4.17.

mission-apprentissage/flux-retour-cfas#4715: the bump missed the ui workspace package.json, whose next pin the maintainer's own #4716 moved to 15.5.28.

pillarjs/iconv-lite#443: the added tests went from 9 passing and 4 failing without the change to 13 passing with it.

pillarjs/iconv-lite#443: the full suite went from 676 passing and 8 pending to 680 passing and 8 pending, with no existing test changed.

pillarjs/iconv-lite#443: lint exits 0, and the head commit f2cb582 is verified with reason valid.

pillarjs/iconv-lite#443: an exhaustive sweep of U+0080 to U+10FFFF found 19 mis-encoded code points before the change and none unexplained after it.

mikro-orm/mikro-orm#8577: AbstractSqlDriver.find() wraps QueryBuilder.execute() in this.rethrow, so em.find() converts driver errors but a direct QueryBuilder does not.

mikro-orm/mikro-orm#8577: The same failing query threw TableNotFoundException through em.find() and a raw SqliteError through qb.getResultList() or qb.getCount().

mikro-orm/mikro-orm#8577: On pglite the raw error carries a minified constructor name, so a caller cannot branch on it at all.

mikro-orm/mikro-orm#8577: The execute promise now runs through IDatabaseDriver.convertException(), while connection.execute() stays unconverted below the driver with no converter.

mikro-orm/mikro-orm#8577: The added regression test went from 4 of 4 failed to 4 of 4 passed across all four sqlite driver variants.

mikro-orm/mikro-orm#8577: The whole EntityManager sqlite suite reports 268 passed, 1 skipped, 0 failed.

mikro-orm/mikro-orm#8577: tsc -p packages/sql --noEmit exits 0, and the head commit c36b779 is verified with reason valid.

mikro-orm/mikro-orm#8576: Platform.validateMetadata refused partitionBy and row-level security when unsupported but never checked an entity schema, which SQLite cannot address.

mikro-orm/mikro-orm#8576: supportsSchemas() answers false on SQLite unless databases are attached, while the shared schema generator still emits schema.table.

mikro-orm/mikro-orm#8576: the declaration therefore passed init and failed later, as the driver's unknown database on create and no such table: schema.sqlite_master on update.

mikro-orm/mikro-orm#8576: the check is added beside the two existing guards, and supportsSchemas() is declared on the base Platform so the validator can reach it.

mikro-orm/mikro-orm#8576: without the patch libsql took the schema and threw unknown database; with it it throws a MetadataError at init, while pglite still creates one.

mikro-orm/mikro-orm#8576 was closed unmerged on 2026-11-03 23:27:04 utc: the guard rejects every MySQL and MariaDB entity with a schema at discovery.

mikro-orm/mikro-orm#8576: no advisory exists for this defect, so the pull request is the disclosure; the commit 78b0183 is verified, so it is signed.

apache/pouchdb#9293 was closed unmerged on 2026-11-03 14:24:55 utc: its author withdrew it under the project's contribution policy, which refuses AI-generated contributions.

apache/pouchdb#9293: local documents carry 0-N revisions with no version history, but the indexeddb adapter had no _putLocal or _removeLocal and gave them 1- and 2- revisions.

apache/pouchdb#9293: memory and idb gave 0-1 then 0-2; indexeddb gave 1- then 2-, and with the patch all three give 0-1 then 0-2.

apache/pouchdb#9293: the same ordinary document gets a byte-identical first revision on all three adapters, so the divergence is confined to local documents.

apache/pouchdb#9293: the adapter was internally consistent, so this is a low-severity contract violation that a maintainer may call cosmetic.

mikro-orm/mikro-orm#8575: em.insertMany returns one primary key for any number of rows because insertedIds is never assigned, so the fallback gives the last key or null on pglite.

mikro-orm/mikro-orm#8575: without the patch insertMany returned [3], and [101] or [null] with caller keys; with it [3,4] and [100,101] on better-sqlite3, libsql and pglite.

mikro-orm/mikro-orm#8575: no advisory exists for this defect, so the pull request is the disclosure; the commit 28cfdc1 is verified, so it is signed.

unjs/db0#271 was closed unmerged on 2026-11-03 11:45:41 utc by the maintainer 61 seconds after it opened, not merged; the file on main is unchanged.

unjs/unstorage#869 was closed unmerged on 2026-11-03 11:45:22 utc by the maintainer, not merged; the file on main is unchanged.

unjs/unstorage#868 was closed unmerged on 2026-11-03 11:45:23 utc by the maintainer, not merged; the file on main is unchanged.

unjs/unstorage#867 was closed unmerged on 2026-11-03 11:45:25 utc by the maintainer, not merged; the file on main is unchanged.

unjs/unstorage#866 was closed unmerged on 2026-11-03 11:45:26 utc by the maintainer, not merged; the file on main is unchanged.

handlebars-lang/handlebars.js#2197: no advisory exists for this defect, so the pull request is the disclosure; the commit 6172d570 is verified, so it is signed.

handlebars-lang/handlebars.js#2196: no advisory exists for this defect, so the pull request is the disclosure; the commit 6eaee659 is verified, so it is signed.

handlebars-lang/handlebars.js#2195: no advisory exists for this defect, so the pull request is the disclosure; the commit 603659f1 is verified, so it is signed.

anthropics/anthropic-sdk-typescript#1294: no advisory exists for this defect, so the pull request is the disclosure; the commit 780f3d53 is verified, so it is signed.

anthropics/anthropic-sdk-typescript#1293: no advisory exists for this defect, so the pull request is the disclosure; the commit 4186497c is verified, so it is signed.

handlebars-lang/handlebars.js#2194: no advisory exists for this defect, so the pull request is the disclosure; commit 89f5c703 is verified, so unlike the older rows it is signed.

handlebars-lang/handlebars.js#2194: precompile never emitted compilerOptions, so a string partial compiled at render time with undefined options while compile() honoured them.

handlebars-lang/handlebars.js#2194: two specs cover context isolation and strict mode, fail on master and pass with the patch, and the rest of the partials spec stays green at 62.

handlebars-lang/handlebars.js#2194: the spec carries a serializable subset of the options, and precompile() still mutates the caller's options object where compile() copies it.

smithy-lang/smithy-typescript#2349: no advisory exists for this defect, so the pull request is the disclosure, and the branch head 10641364 is unsigned.

smithy-lang/smithy-typescript#2349: the JSON deserializers guard a __proto__ key, and the CBOR ones did not, so m.admin read true through the prototype chain.

smithy-lang/smithy-typescript#2349: the CBOR decoder disagreed with itself by map size, injecting the key at 24 entries and keeping it as an own property at 25.

smithy-lang/smithy-typescript#2349: @aws-sdk/core 3.979.1 inherits the decoder through @smithy/core ^3.38.0, so the defect reaches the AWS SDK v3 client family.

smithy-lang/smithy-typescript#2349: the new spec went from 11 failed and 4 passed to 15 passed, and the scoped CBOR suite reports 622 passed and 1 skipped.

smithy-lang/smithy-typescript#2349: the patch touches six files, +293/-3, and its base is main at 27bdf42.

ajv-validator/ajv#2694: no advisory exists for this defect, so the pull request is the disclosure, and the branch head a5dfda40 is unsigned.

ajv-validator/ajv#2694: a patternProperties-only schema with removeAdditional "all" kept isAdmin from {name,email,isAdmin:true}, while an empty properties object stripped it.

ajv-validator/ajv#2694: ajv 6.12.6 stripped the same key, so the miss is a v7 keyword-split regression rather than a documented choice.

ajv-validator/ajv#2694: four new spec cases fail against the unpatched sources and pass with the patch, taking the spec from 4 to 8 passing.

ajv-validator/ajv#2694: the patch touches two files, +63/-1, and its base is master at f177fe32.

sinclairzx81/typebox#1733: no advisory exists for this defect, so the pull request is the disclosure, and the branch head 6358f328 is unsigned.

sinclairzx81/typebox#1733: the fast path decided no extra keys with Object.getOwnPropertyNames(value).length === schema.required.length, a count rather than a test.

sinclairzx81/typebox#1733: an inherited required key satisfied that count, so {} on a {toString}-required schema went false to true and {c:1} went true to false.

sinclairzx81/typebox#1733: a 5,000-pair seeded differential fuzz cut mismatches from 134 to 1, and from 155 to 0 with prototype excluded from the generator.

sinclairzx81/typebox#1733: a second commit fixes the prototype key in the emitted guard, which named only __proto__ and constructor, and adds a class-instance regression test.

sinclairzx81/typebox#1733: Validator.Errors() returns [] on the accelerated path, so before the fix the fail-open value answered true with no diagnostic.

sinclairzx81/typebox#1733: 317 tests pass with the change; without it, the schema compile spec was 17 pass and 3 fail, and the compile spec 26 pass and 1 fail.

node-formidable/formidable#1124: no advisory exists for this defect, so the pull request is the disclosure, and the commit 1c3b01cc is unsigned.

node-formidable/formidable#1124: maxFieldsSize was compared only in _handlePart's field branch, so the JSON and urlencoded plugins never checked it.

node-formidable/formidable#1124: a 2 MiB urlencoded value and a 2 MiB JSON value were accepted whole before, and both answer 1006/413 after.

node-formidable/formidable#1124: JSON never emitted the field event, so maxFields was ignored there, and three keys under maxFields 2 are rejected 1007/413 after.

node-formidable/formidable#1124: a 64 KiB multipart field answers 1006/413 on both trees, the control, and 1,024 bytes is still accepted while 1,025 is rejected after the fix.

node-formidable/formidable#1124: only values are counted, as _handlePart always counted them, so a 2 MiB key with a 1-byte value still passes.

node-formidable/formidable#1124: #1091 bounds maxTotalFileSize rather than maxFieldsSize, and #1113 is the octet-stream plugin, and neither is touched here.

Automattic/mongoose#16670: no advisory exists for this defect, so the pull request is the disclosure, and the tip 52736feb is an empty signing commit, so the change is unsigned.

Automattic/mongoose#16670: sanitizeFilter ran only in Query._castConditions (lib/query.js:2421-2429), so find and updateOne sanitised, aggregate() and bulkWrite() did not.

Automattic/mongoose#16670: aggregate([{ $match: { password: { $ne: null } } }]) matched 2 on base and 0 with the patch, on a real MongoDB with two matching documents.

Automattic/mongoose#16670: a bulkWrite deleteMany deleted 2 of 2 on base and was rejected with CastError, 0 deleted, with the patch, and a legitimate delete by id went from 0 to 1.

Automattic/mongoose#16670: the new test file passed 13 of 13 with the patch against 3 of 13 on unpatched master, and the commit ba2f97bb is unsigned.

Automattic/mongoose#16670: the reach is top-level $match stages only; $lookup.pipeline, $facet and $unionWith.pipeline nested pipelines are not covered.

Automattic/mongoose#16670: with the option on, a $match carrying $expr, $text, $where or $jsonSchema now throws at construction, and mongoose.trusted() is the escape hatch.

vercel/ai#24427: no advisory exists for this defect, so the pull request is the disclosure.

vercel/ai#24427: bufferedToolResults never cleared an entry whose request never arrived, so it stayed for the process lifetime.

vercel/ai#24427: 50 unmatched 1 MiB results retained 49.8 MiB of heap before the fix and 14.8 MiB after.

vercel/ai#24427: a control turn collecting buffered entries released their exact bytes, and a fully matched 20-turn session stayed flat, so not every session meets this.

vercel/ai#24427: eviction is oldest-first and not on the turn boundary, because the buffer serves a result arriving between turns that the next turn's request collects.

vercel/ai#24427: JSON.stringify().length counts UTF-16 code units rather than bytes and leaves out the toolCallId beside each result, so the cap is approximate.

vercel/ai#24427: a result over 16 MiB is evicted at once; an evicted result leaves a later requestToolResult pending forever with no error; the cap is per buffer, not per process.

vercel/ai#24426: no advisory exists for this defect, so the pull request is the disclosure.

vercel/ai#24426: the relay read every POST body into memory with no limit, before the tool-name allow-list and the authorizer.

vercel/ai#24426: a 64 MiB body grew peak RSS by 198 MiB over a 65 MiB baseline, and 16 concurrent 128 MiB bodies reached 2,737 MiB.

vercel/ai#24426: the sibling ACP relay caps at 16 MiB and answers 413, and the same 2 GiB of concurrent traffic answered 16 x 413 at 341 MiB against it.

vercel/ai#24426: with the fix the same test answers 16 x 413 at 197 MiB, against 2,737 MiB on base.

vercel/ai#24426: the cap is per request, not per process, and the relay carries no credential unlike its ACP sibling.

vercel/ai#24426 was closed unmerged on 2026-11-03 23:17:16 utc: the maintainer asked how the defect was met and who stands behind the account.

foxhui/WebAI2API#125: no advisory exists for this defect, so the pull request is the disclosure.

foxhui/WebAI2API#125: the OpenAI route handler keeps every chunk, then calls Buffer.concat(chunks).toString() with no byte counter and no Content-Length check.

foxhui/WebAI2API#125: the server is plain node:http with no body parser, the compose file publishes 3000:3000, and auth reads only the header before any body byte.

foxhui/WebAI2API#125: the published image took 512 MiB to 1,170 MiB RSS in 3.9 s and 1,024 MiB to 2,144 to 2,195 MiB in 7.9 to 8.7 s, and patched 413 in 147 to 170 ms at 157 MiB.

foxhui/WebAI2API#125: the repository's own modules on node:http took 512 MiB to 1,549 MiB and 1,024 MiB to 3,171 MiB, and patched answered 413 throughout.

foxhui/WebAI2API#125: the try catches the throw, so it survives; the damage is memory and a 500 where a 413 is right, and an OOM kill is an inference: no memory limit was set.

foxhui/WebAI2API#125: shipped non-empty server.auth needs a token, and only an empty one opens the endpoint; the admin reader has that shape and was deliberately left untouched.

vinilana/jev-gateway#68: no advisory exists for this defect, so the pull request is the disclosure; CVE ID request filed with MITRE 2026-11-03, ticket 2137133, assignment pending.

vinilana/jev-gateway#68: the body-parsing helper hands each decoder the compressed bytes with no output limit, so a body expands as far as it likes before anything reads it.

vinilana/jev-gateway#68: every route reaches that helper; there is no body limit and no Content-Length check; a remote install needs HOST set, which the README does not enforce.

vinilana/jev-gateway#68: on base 83b5b98 a 2,087,281-byte gzip body took the process from 108 MB to a peak of 8,307 MB, and the memory was not released.

vinilana/jev-gateway#68: the next two requests each timed out at 30 s while GET /health answered 200, so the process was alive but not serving and nothing restarts it.

vinilana/jev-gateway#68: the patch answered 413 in 9.591 ms at 106 MB RSS, unchanged from baseline, with the server still serving; the 32 MiB cap is policy, not measured.

vinilana/jev-gateway#68: a default install binds 127.0.0.1 and sets no CORS headers, so no cross-origin page can read a response and there is no drive-by browser vector.

italia/dati-semantic-mcp#21: no advisory exists for this defect, so the pull request is the disclosure.

italia/dati-semantic-mcp#21: the MCP route kept every chunk and called Buffer.concat(chunks).toString() with no byte counter and no Content-Length check.

italia/dati-semantic-mcp#21: the bounded reader already served the upload route, added six days after the MCP route and never applied to it.

italia/dati-semantic-mcp#21: base took a 734 MB body to exit 1 at 2,144 MiB and a 524 MB body to 400 at 2,116 MiB, and the published image exits 1 on the same body.

italia/dati-semantic-mcp#21: patched, all three routes answer 413 at 127 MiB with the process up, where base got EPIPE on the upload and a dead process on the sparql read.

italia/dati-semantic-mcp#21: HTTP mode binds 0.0.0.0 and publishes 8088:3000 with no credential check, while the default stdio transport listens on nothing.

0xranx/golembot#67: no advisory exists for this package, so the pull request is the disclosure; OSV and the GitHub advisory API both returned nothing.

0xranx/golembot#67: readBody buffers every chunk, and Buffer.concat(chunks).toString('utf-8') throws past V8's 536,870,888-character limit inside the stream's end callback.

0xranx/golembot#67: eight routes read bodies this way, and a 734,003,200-byte POST exited the process in 0.32 s, 3 of 3 runs on the repo build and 2 of 2 on golembot@0.52.0.

0xranx/golembot#67: peak RSS was 2.0 to 2.2 GiB; below the crash a 524 MB body still buffered to 1,581 MiB, 3.2 times its size, and the patch answered 413 in 0.010 s at 87 MiB.

0xranx/golembot#67: a default install binds 127.0.0.1 with auth off, so it is a local-process denial of service only, never a remote one.

0xranx/golembot#67: remote only when --host or gateway.host leaves loopback; Dockerfile and compose on 127.0.0.1 answer 000 through the published port, against 200 on 0.0.0.0.

0xranx/golembot#67: PATCH /api/config read its body outside its try, so the 413 would kill it; the fleet module's body reads are uncovered; the 16 MiB cap is policy, not measured.

vpulim/node-soap#1541: no advisory exists for this package, so the pull request is the disclosure; CVE ID request filed with MITRE 2026-11-02, ticket 2137075, assignment pending.

vpulim/node-soap#1541: a gzip body past V8's string limit throws ERR_STRING_TOO_LONG outside the try/catch, and a 25-byte non-gzip body hits Z_DATA_ERROR with no error listener.

vpulim/node-soap#1541: a 3.2 MB gzip body reaching 700 MiB exited 1 on both runs at fdde4774 and on soap@1.14.0, and the new test file fails on base with 500 !== 413.

vpulim/node-soap#1541: reach is a library callsite through soap.listen, the README's first server example, at 1,416,828 npm downloads last week and 3,597,487 in thirty days.

vpulim/node-soap#1541: an app that pre-parses req.body with its own body parser returns earlier and is bounded by that parser's limit, so this path never runs there.

vpulim/node-soap#1541: the 16 MiB cap is a policy choice, not a measured requirement; it bounds plain bodies too, deliberately, and a maintainer may want a different constant.

vpulim/node-soap#1541: peak RSS was 2.0 to 2.2 GiB sampled with ps, where the research record read 769.6 MiB through an in-process sampler; this row cites the ps figure.

f/prompts.chat#1358: a dependency bump for published advisories, not a finding of ours; the range, the lockfile and one server line move.

f/prompts.chat#1358: the route reads and parses the body itself under a 1 MiB cap, so the transport never sees the stream and 1.25.1 maps every batch element with no cap.

f/prompts.chat#1358: the differential is the evidence: a 200-message batch answered 200 with 200 responses on 1.25.1 and a 400 rejection on 1.32.0.

f/prompts.chat#1358: the second advisory's fix ships off by default, so the patch also sets maxToolInputElements to 10,000 on the server built at server.ts:25.

f/prompts.chat#1358: six of the eight advisories are precautionary here: no OAuth client, no tasks feature, no bearer-auth path, and a fresh server and transport per request.

f/prompts.chat#1358: it is not the repository's first pull request; #1238, open since 2026-07-31, moves the same package to 1.26.0 and still carries four of the eight advisories.

f/prompts.chat#1358: no live deployed crash is claimed, and the impact stops at the request that carries the batch.

Ebony-Vinyl/dsh-our-free-model#735: a dependency bump for a published advisory, not a finding of ours; the pin and the lockfile move, with no source change.

Ebony-Vinyl/dsh-our-free-model#735: the pinned copy asserts on ERR_TLS_CERT_ALTNAME_INVALID at lib/dispatcher/client-h1.js:971, and an uncaught AssertionError ends the process.

Ebony-Vinyl/dsh-our-free-model#735: npm ci --ignore-scripts installed 8.11.2 on the base and 8.12.2 on the patch, exit 0 both; no suite or live renegotiation ran.

Ebony-Vinyl/dsh-our-free-model#735: reach is precautionary: eac.js:131 imports undici, :148 builds EnvHttpProxyAgent and :204 fetches with it.

Ebony-Vinyl/dsh-our-free-model#735: the input is the remote endpoint: a crash needs a configured proxy and a mismatched TLS 1.2 renegotiation.

Ebony-Vinyl/dsh-our-free-model#735: the bundles are not rebuilt: pack.js and business.mjs still inline 8.11.2, and build-channel-pack.mjs is manual and in no workflow.

Ebony-Vinyl/dsh-our-free-model#735: the channel-pack manifest declares ^8.11.2, admits 8.12.2, has no lock and is untouched; it is not the repository's first pull request.

emcie-co/parlant#841: a dependency bump for a published advisory, not a finding of ours; the declared floor and the lockfile move, with no source change.

emcie-co/parlant#841: the declared floor was itself vulnerable: pyproject.toml:151 asked for python-multipart 0.0.27 or newer, inside the advisory's affected range.

emcie-co/parlant#841: the first packet gated through a uv lock, a first for the pipeline and not for the repository.

emcie-co/parlant#841: reach is install-level only: python-multipart arrives solely as a transitive dependency of mcp, whose wheel declares it without importing it.

emcie-co/parlant#841: across 298 Python files there is no import python_multipart, no request.form() and no Form(...) or UploadFile, so no live request path is claimed.

emcie-co/parlant#841: poetry.lock is deliberately untouched and still pins 0.0.20; poetry check --lock and poetry lock both exit 1, so it cannot be regenerated.

emcie-co/parlant#841: the pull request merged with the floor and lock as submitted, and no proof of concept, build or test run is claimed.

payload-auth/payload-auth#172: a dependency bump for a published advisory, not a finding of ours; both payload declarations and the lockfile move, with no source change.

payload-auth/payload-auth#172: the @payloadcms adapters move with it, each declaring an exact payload peer, so a payload-only bump would leave them unmet.

payload-auth/payload-auth#172: the fix was verified by running the shipped getFieldsToSign from the registry tarballs under one config.

payload-auth/payload-auth#172: 3.79.0 and 3.79.1 are byte-identical and return id attacker-id, collection admins and email admin@example.com.

payload-auth/payload-auth#172: 3.90.0 returns id real-id, collection users and email real@example.com; a saveToJWT field naming a reserved claim overwrites it.

payload-auth/payload-auth#172: reach is unproven for this repository; no saveToJWT string mapping exists in the tree and allowedFields is ["name"] in the demo and the dev fixture.

payload-auth/payload-auth#172: it reads open, mergeable true and mergeable_state blocked; the package build ran, the demo's next build did not, and no proof of concept is claimed.

radcrew/cryptopets#88: a dependency bump for a published advisory, not a finding of ours; the lockfile alone moves and the website manifest keeps ^15.1.6, which admits the fix.

radcrew/cryptopets#88: the advisory names next, but the vulnerable code is sharp; both upstream fix commits change one line, next's optional-dependency pin on sharp.

radcrew/cryptopets#88: next 15.5.28 declares sharp ^0.34.3 || ^0.35.5, which still admits 0.34.5, and a next-only bump leaves 0.34.5 in the lock.

radcrew/cryptopets#88: the fix here is precautionary; dangerouslyAllowSVG is false and remotePatterns is empty, so an SVG request answers 400 before the optimizer runs.

radcrew/cryptopets#88: /_next/image is live and unauthenticated and loads sharp for a PNG on both arms, so the optimizer path is real; the SVG trigger is not.

radcrew/cryptopets#88: pnpm install --frozen-lockfile and pnpm build exited 0 on both arms; 35 moved lock entries were checked, 13 match, 22 absent-but-none, none stale.

radcrew/cryptopets#88: no proof of concept, lint, test or deploy ran; the row reads open, mergeable true and mergeable_state blocked.

ItzCrazyKns/Vane#1230: a dependency bump for a published advisory, not a finding of ours; zod ^4.1.12 moves to ^4.6.6, resolving 4.6.7.

ItzCrazyKns/Vane#1230: it also caps sources and history at 1,000 and files at 100 on the unauthenticated POST /api/chat body schema.

ItzCrazyKns/Vane#1230: neither half closes the bug alone; without the caps the bump still echoes 50,000 issues, and without the bump the caps still echo 50,001.

ItzCrazyKns/Vane#1230: on a 50,000-element sources body, 4.3.6 with no caps returns 50,000 issues in a 4,238,934-byte response after 329 ms.

ItzCrazyKns/Vane#1230: 4.6.7 with no caps still returns 50,000 issues and 4,238,934 bytes in 112 ms, and 4.3.6 with the caps returns 50,001 issues and 4,239,010 bytes in 220 ms.

ItzCrazyKns/Vane#1230: 4.6.7 with the caps returns one issue and a 120-byte response in 2 ms, and a 1,000-element array still parses while 1,001 returns one too_big.

ItzCrazyKns/Vane#1230: the differential runs the route's own schema and issues.map mapping, not a live request or a build; the row reads open, mergeable true and unstable, +10/-4.

tinacms/llama-link#8: two 27 June 2023 nightlies move to tinacms 3.15.0 and @tinacms/cli 4.0.4, resolving @tinacms/app 2.6.0; no affected copy is left.

tinacms/llama-link#8: a dependency bump, not a finding of ours; the repository is the TinaCMS organisation's own starter, so every scaffolded project inherited the nightlies.

tinacms/llama-link#8: the jump also sets engines.node to 22.x || 24.x and adds _sys.hasReferences to the template's own queries, without which tsc rejects the query types.

tinacms/llama-link#8: reach is app-level; the Tina config builds the admin into the served public folder and the Next config rewrites /admin to it, so the template ships an admin.

tinacms/llama-link#8: base bundle index-b6c84c06.js carries the pre-fix splat expression; the patched index-D7Xw73fx.js calls resolvePreviewPath and shows the off-origin warning.

tinacms/llama-link#8: no deploy was observed and no hosted admin was checked, and the browser postMessage round-trip was not run; reach is the built bundle in the tree.

tinacms/llama-link#8: the row reads open, mergeable true and mergeable_state unstable, as the 2026-11-01 23:27:36 utc sweep answered.

cnumr/best-practices-wordpress#246: neither package alone is enough; @tinacms/cli alone clears the app but leaves the direct tinacms 2.10.1, and tinacms alone leaves both.

cnumr/best-practices-wordpress#246: four selections were resolved separately, and only @tinacms/cli 4.0.4 with tinacms 3.15.0 lands @tinacms/app 2.6.0.

cnumr/best-practices-wordpress#246: https://rwp.greenit.fr/admin/ and https://best-practices-wordpress.vercel.app/admin/ serve byte-identical html and the same index-ba5c39b7.js.

cnumr/best-practices-wordpress#246: that 6,626,277-byte bundle, sha256 beginning 90ee78fa, carries the pre-fix expression and neither offOrigin nor the fix's warning text.

cnumr/best-practices-wordpress#246: the deployed bundle's originating commit is not proven; it carries the repo's title and schema names, not a commit we can show.

cnumr/best-practices-wordpress#246: the vulnerable admin stays live until this merges and redeploys.

cnumr/best-practices-wordpress#246: the row reads open, mergeable true and mergeable_state blocked, as the 2026-11-01 22:48:36 utc sweep answered.

silexlabs/silex-dashboard#6: a dependency bump for a published advisory, not a finding of ours; the manifest, the lockfile and the workflow's Node pin 20 to 22 move.

silexlabs/silex-dashboard#6: it moves @tinacms/cli 1.11.0 to 4.0.4, landing tinacms 3.15.0 and @tinacms/app 2.6.0.

silexlabs/silex-dashboard#6: only @tinacms/cli is declared, and 1.11.0 pins @tinacms/app 2.3.4 and tinacms 2.9.0 exactly, so ^1.9.5 cannot reach a fix.

silexlabs/silex-dashboard#6: adding @tinacms/app 2.6.0 directly is worse: npm nests 2.3.4 under the CLI, the copy tinacms dev builds the admin from.

silexlabs/silex-dashboard#6: the reach is app-level but not deployed: tina:dev builds the admin into templates/assets/admin, which eleventy copies into _site/assets.

silexlabs/silex-dashboard#6: https://v3.silex.me/assets/admin/index.html answers 404 and the published npm tarball carries no index.html in its admin folder.

silexlabs/silex-dashboard#6: the row reads open, mergeable true and mergeable_state blocked, as the 2026-11-01 22:34:09 utc sweep answered.

tinacms/tina-self-hosted-ssg-demo#7: a dependency bump for a published advisory, not a finding of ours, moving tinacms 1.6.7 to 3.15.0 and @tinacms/app 2.3.11 to 2.6.0.

tinacms/tina-self-hosted-ssg-demo#7: it moves @tinacms/cli 1.12.6 to 4.0.4, @tinacms/datalayer to 3.0.0, tinacms-authjs to 24.0.5 and tinacms-gitprovider-github to 5.0.0.

tinacms/tina-self-hosted-ssg-demo#7: it moves .nvmrc and NODE_VERSION 20 to 22 for @tinacms/cli 4.0.4's node 22 or 24 rule, and Vercel's own setting is in its UI, not the tree.

tinacms/tina-self-hosted-ssg-demo#7: https://tina-self-hosted-ssg-demo.vercel.app/admin/ answers 200, the TinaCMS organisation's own demo serving its own unfixed admin.

tinacms/tina-self-hosted-ssg-demo#7: https://tina-self-hosted-ssg-demo.vercel.app/admin/assets/index-8a60c3e1.js carries the pre-fix /${splat} expression twice.

tinacms/tina-self-hosted-ssg-demo#7: none of resolvePreviewPath, getExpectedPreviewOrigin or isFromTrustedPreviewOrigin appears in that bundle.

tinacms/tina-self-hosted-ssg-demo#7: the row reads open, mergeable true and mergeable_state unstable, as the 2026-11-01 22:04:51 utc sweep answered.

3p3r/payloadcms-db-dynamo#1: a dependency bump for a published advisory, not a finding of ours; only the lockfile moves and the manifest keeps ^3.85.0.

3p3r/payloadcms-db-dynamo#1: the repository's first pull request of any state, one file changed, +151/-138.

3p3r/payloadcms-db-dynamo#1: the reach is library-level only, because the adapter serves no route and declares no collection.

3p3r/payloadcms-db-dynamo#1: the duplicated value reaches DynamoDB through create.ts:33-48 when a host app mounts Payload's REST API.

3p3r/payloadcms-db-dynamo#1: the patch does not fix the whole tree; the bundled example app's lockfile still resolves payload 3.84.1, inside the affected range.

3p3r/payloadcms-db-dynamo#1: that example manifest pins 3.84.1 exactly, so a lock-only change cannot move it.

3p3r/payloadcms-db-dynamo#1: the row reads open, mergeable true and mergeable_state unstable, as the 2026-11-01 21:19:39 utc sweep answered.

govtechmy/kd-portal#102: a dependency bump for a published advisory, not a finding of ours; the manifest and the lockfile both move.

govtechmy/kd-portal#102: the bump moves payload 3.17.1 to 3.90.0 and the eight @payloadcms packages with a 3.90.0 release, pinning each latest specifier.

govtechmy/kd-portal#102: @payloadcms/next 3.90.0 peers next at 15.2.9 or later, so next moves 15.1.11 to 15.2.9 and react and react-dom move 19.0.0 to 19.2.1.

govtechmy/kd-portal#102: the reach is live, https://www.digital.gov.my answers POST /api/users/:id/duplicate with 403, the route present and auth-gated.

govtechmy/kd-portal#102: the patched build answers the same POST with 404 because the endpoint is no longer registered, so the deployed build still serves the route 3.90.0 removes.

govtechmy/kd-portal#102: the 3.17.1 probe answered a signed-in self-duplicate with 200 and copied the role its create access denies; the 3.90.0 probe answered 404.

govtechmy/kd-portal#102: no user document was read; the field copy was measured locally on the repository's own Users collection.

AminZibayi/Corporio#33: a dependency bump for a published advisory, not a finding of ours; the lockfile and the manifest both move.

AminZibayi/Corporio#33: the bump moves tinacms 2.10.1 to 3.15.0 and @tinacms/cli 2.0.3 to 3.0.0, declaring react and react-dom.

AminZibayi/Corporio#33: the reach is app-level but not deployed, https://corporio.onrender.com/admin/ is byte-identical to the committed 1,841-byte shell.

AminZibayi/Corporio#33: that shell loads http://localhost:4001/src/main.tsx in dev mode and carries no TinaCMS bundle.

AminZibayi/Corporio#33: the deploy runs the site build alone, which compiles Hugo and never the TinaCMS admin, so no admin is served.

AminZibayi/Corporio#33: the base arm produced a 7,581,554-byte TinaCMS chunk, and that build artifact is the proof; no live vulnerable bundle is claimed.

thedivtagguy/site#6: a dependency bump for a published advisory, not a finding of ours; the lockfile and the manifest both move.

thedivtagguy/site#6: the bump moves tinacms 2.7.0 to 3.14.0 and @tinacms/cli 1.5.36 to 3.0.0 across the lockfile and the manifest.

thedivtagguy/site#6: the reach is app-level but not deployed, https://aman.bh/admin/ serves a 390-byte Sveltia CMS shell and not this repository's TinaCMS admin.

thedivtagguy/site#6: npm run build runs tinacms build into static/admin, whose index.html and assets are gitignored, so no admin build is committed.

thedivtagguy/site#6: the base arm produced a 4,374,181-byte admin bundle, and that build artifact is the proof; no live vulnerable bundle is claimed.

srgg/ianasamoilova.com#44: a dependency bump for a published advisory and the repository's first pull request, not a finding of ours.

srgg/ianasamoilova.com#44: the patch moves package.json alone and commits no lockfile, so the bump is manifest only.

srgg/ianasamoilova.com#44: the reach is app-level but not deployed, https://ianasamoilova.com/admin/ answers 404 and static/admin is not committed.

srgg/ianasamoilova.com#44: the deploy installs with pnpm and builds only Hugo, so no admin is built or served.

srgg/ianasamoilova.com#44: the committed pnpm lock still pins tinacms 2.8.3, so a frozen-lockfile install refuses the bumped manifest.

srgg/ianasamoilova.com#44: the vulnerable admin exists only when someone runs the Tina build locally, so no live vulnerable bundle is claimed.

DeFiGeek-Community/landing-page#162: a dependency bump for a published advisory, not a finding of ours; the lockfile and the version pins both move.

DeFiGeek-Community/landing-page#162: a multi-major jump, tinacms 1.5.2 to 3.15.0 and @tinacms/cli 1.5.8 to 2.7.0; the lock respun from v2 to v3 across 1,891 changed entries.

DeFiGeek-Community/landing-page#162: the reach is app-level but not deployed, https://defigeek.xyz/admin/ answers 404 and the gh-pages tip holds only admin/.gitignore.

DeFiGeek-Community/landing-page#162: the vulnerable admin exists only when someone runs the build, so no live vulnerable bundle is claimed.

DeFiGeek-Community/landing-page#162: npm run build exits 1 on both arms at the same Tina Cloud Missing clientId, token check, and the offline tinacms build exits 0.

Rickyoung221/portfolio-template#13: a dependency bump for a published advisory, not a finding of ours; the lockfile and the version pins both move.

Rickyoung221/portfolio-template#13: the reach is app-level, https://portfolio-template-usagi.vercel.app/admin/ served a 7,217,340-byte bundle whose sha256 begins d502bddf.

Rickyoung221/portfolio-template#13: the bundle carries the pre-fix expression and neither offOrigin nor the fix's warning text.

Rickyoung221/portfolio-template#13: the vulnerable admin stays live until this merges and redeploys.

Rickyoung221/portfolio-template#13: no browser was driven, so the measurement is the served bytes, not a rendered exploit.

cnumr/best-practices-packaged-software#15: a dependency bump for a published advisory, not a finding of ours; the lockfile and the version pins both move.

cnumr/best-practices-packaged-software#15: the reach is app-level and measured, https://reipro.greenit.fr/admin/ served a 6,631,250-byte bundle whose sha256 begins 7b9392d7.

cnumr/best-practices-packaged-software#15: the bundle carries the pre-fix expression and neither offOrigin nor the fix's warning text.

cnumr/best-practices-packaged-software#15: the vulnerable admin stays live until this merges and redeploys.

cnumr/best-practices-packaged-software#15: no browser was driven, so the measurement is the served bytes, not a rendered exploit.

sourcefuse/backstage#254: the app was not booted, and the probe drove the package's own router with stub services, so no live request was made.

superglue-ai/superglue#703 was closed unmerged on 2026-10-26 11:29:59 utc; its pull request page no longer resolves, so its row is kept without a link.

presenton/presenton#999 and #1000 were closed unmerged on 2026-10-30, superseded by the maintainer's own #1002, which fixed both advisories upstream.

openocta/openocta#122: a lockfile bump for a published advisory, not a finding of ours.

openocta/openocta#122: the manifest is unchanged because its ^0.10.0 range already admitted 0.10.2, so only the lockfile moves.

openocta/openocta#122: the measurement is per URL case, not per file: all 8 invalid cases reached window.open on 0.10.0, none on 0.10.2, and the 7 valid cases open on both.

openocta/openocta#122: no browser ran; the observable is the argument window.open receives in an in-process probe.

payload-auth/payload-auth#171 updates the repository's own dev/test and demo pins, not a consumer peer range.

meceware/wapy.dev#112: the takeover was proven on the app's own build; no live account was touched.

TrackGeek/api#110: unit tests pass 10/10 on both trees; no live deployment was probed.

kaushikchintam/lifftlabs#37: a live request showed the vulnerable path; no live takeover was attempted.

nkopp-cmd/travelchat-ai#630: the live sign-in start answers PROVIDER_NOT_FOUND, one config change from vulnerable, not exploitable today.

openhoat/rag-hub-mcp#31: the request-body half is bounded by the app's own 10 MiB body limit; no live deployment was probed.

nikandr-surkov/ai-saas-starter#3: the takeover was proven on the app's own auth instance; no live deployment was probed.

valto/valuatum-capability-hub#1: the request-body half is bounded by the app's own 64 KB JSON parser; no live deployment was probed.

HaD0Yun/CozyClay#1016: loopback only behind a Host/Origin guard, so local processes and a deployment that forwards the port can reach it, not the internet by default.

jiezeng2004-design/dsh-chatgpt-bridge#13: loopback, default token auth; vectors reach the token holder or any deployment exposing it, not the internet; no live deployment probed.

elfa-ai/mcp#39: loopback behind a per-request API key, so the vectors reach the key holder or a deployment exposing the listener, not the internet; no live deployment was probed.

fatwang2/search2ai#52: the CLI binds 0.0.0.0 and /mcp needs no credential unless AUTH_KEYS is set; no live instance was probed.

tableau/tableau-mcp#1159 was closed unmerged on 2026-10-30 19:31:31 utc; OAuth is on by default and the probe disabled it, so reachability depends on deployment auth.

karanb192/reddit-mcp-buddy#85: /mcp is unauthenticated by design and the Dockerfile sets HTTP mode on 0.0.0.0, so the image publishes it to its network; no running host was probed.

hyperdrift-io/deputy-workforce-mcp#1: loopback behind a 32-byte bearer token and a 1 MiB body cap, so only the batch-length half was measurable; no live deployment probed.

deadletterq/mcp-opennutrition#24: no authentication of its own and a Dockerfile running --http, so anyone who reaches the process reaches it; no live deployment probed.

deadletterq/mcp-opennutrition#24 was closed unmerged on 2026-11-01 17:12:24 utc; no fix is recorded.

anthropics/cwc-workshops#31: /wiki/mcp needs no authentication, and a 1,000-message batch returned 1,000 responses in 183.8 ms on 1.29.0, while 1.32.2 refuses any batch over 100.

deadletterq/mcp-opennutrition#25: documentation-only fix, the image listens on 9113 while the README mapped 3000, verified on the published image, no runtime behaviour changed.

deadletterq/mcp-opennutrition#25 was closed unmerged on 2026-11-01 17:12:17 utc; no fix is recorded.

dataforseo/mcp-server-typescript#67: no live deployment to probe, so the boundary was measured against both builds locally, not a hosted instance.

aplaceforallmystuff/mcp-arr#65: the low-level SDK Server has no maxToolInputElements option, so the element bound is a copied counter, and no live deployment was probed.

noskillish/bankmcp#20: /mcp requires an OAuth access token, so the reachable exposure is an authenticated-client denial of service; no live deployment was probed.

trylinky/linky#27: the takeover was reproduced on the repo's own createAuth() against a local Postgres, and the hosted lin.ky deployment was not probed.

PV-Bhat/vibe-check-mcp-server#117: the low-level Server has no maxToolInputElements option, so the bound is a copied counter; 1.32.2 alone still walked 500,002 elements in 81.3 ms.

chirag127/Clear-Thought-MCP-server#28: both halves close; the bump takes the batch, and the app's own request reader bounds the body the transport is handed pre-parsed.

jinzcdev/leetcode-mcp-server#24: the bump takes the batch, and the app's own express.json() already capped bodies at 100 KiB, so only the element bound was needed.

foglamp-labs/foglamp#97: production reachability rests on a read-only GET /api/auth-methods showing magicLink and google enabled; no production account was touched.

radishbuild/mirofish-cloud#1: the takeover was executed against the repository's own createAuth() on a fresh database; no live deployment was probed.

ZubeidHendricks/youtube-mcp-server#34: the 256-element cap is over three times the widest legitimate call because its schemas declare no maximum; no live deployment was probed.

Doulor/DoulorCloud#73: a quadratic decode, not a crash, so the timing is the finding; a maintainer may prefer the minimum fixed 4.0.8 over the 4.2.0 this bumps to.

directionally-local/autopilot#1087: a quadratic decode, not a crash, so the ordering across runs is the finding; the bump goes to 4.2.0 rather than the minimum fixed 4.0.8.

branleeharris/mbox_viewer#1: 2.04 MB of encoded words blocks 5.1-5.6 s on 4.0.4 against 32-49 ms on 4.2.0; the 480 KB plain control takes 3.3 ms, so the decode is the cost.

justlovemaki/PrismFlowAgent#3: a 3,407-byte file of openers held the server 131 s on 0.18.5 against 15 ms on 0.20.3, which npm does not ship; the fix is the SheetJS CDN tarball.

manjurulhoque/django-job-portal#94: a distinct-name control costs 195-287 ms on both trees, so the overlap check is the cost; 3.2.12 aborts at 250,000 comparisons in 0.4-0.9 s.

tgbot-collection/YYeTsBot#457: a 64 KB folded request costs 15-23 ms on 6.5.5 against 1.0-1.2 ms on 6.6; the same bytes unfolded cost 1.4-2.6 ms, and no crash was seen.

symfony/demo#1680: a 15,200-byte Cache-Control header costs 799.7 ms on 8.1.0 against 19.9 ms on 8.1.10; the same bytes with x for each space run cost 25.1 ms on 8.1.0.

dittofeed/dittofeed#1881: a 2,015 B AUTH reply takes 7,187.04 ms on 6.9.7 and 2.06 ms on 10.3.1, while the same bytes with x cost 1.82 ms on 6.9.7, so the run is the trigger.

krayin/laravel-crm#2702: on the admin-only upload, a 225,076 B SVG of 25,000 nested PHP tags takes 5,324.4 ms on 0.22.0 and 24.1 ms on 1.1.1, while untagged bytes cost 14.9 ms.

django-music-publisher#70: a 769,995 B Accept of 96 8,000-semicolon runs takes 1,780.44 ms to a 406 on 3.18.1 against 0.65 ms on 3.18.2; x in those bytes costs 12.28 ms on 3.18.1.

numbas/editor#858: a stored theme README of 16,000 emphasis pairs (80 KB) takes 22.1-22.3 s on 3.1.3 against 178-188 ms on 3.3.4 under runserver; 80 KB of text costs 20.9-26.5 ms.

modem-dev/sideshow#270: a 400,009 B crafted surface takes 5,122.66 ms on 14.3.0 against 129.05 ms on 14.3.3 in-process; the same bytes with x for [ take 95.81 and 95.53 ms.

VipMaxxxx/payincus#11: a 60,002 B zone identifier takes 1,540.07 ms on 10.1.0 in one process against 0.07 ms on 10.7.5; the same bytes with x for the newline cost 0.12 ms.

capnajax/rest#1: a 300,000 B TOML body of 20,000 array-of-tables headers takes 8,037.74 ms on 5.0.0 against 70.51 ms on 5.0.1; 20,000 single tables cost 60.60 ms.

joemccann/dillinger#942: a 192,000 B body of 32,000 quote pairs takes 2,008.22 ms on 14.1.0 against 20.92 ms on 14.3.2; x for each closing quote costs 23.21 ms on 14.1.0.

anshumancodes/flask_steganography_app#2: a crafted 512-byte XBM and its one-byte control ran through /encode: 229.4 s on 12.0.0 vs 6.44 ms for the control, 6.25 ms on 13.0.0.

calamianmdspharmacy/calamian_client#21: 24/26/28/30-digit phone literals cost 95.6/305.7/1,185.5/5,140.3 ms on 1.25.0 vs 13.4-15.6 ms on 2.0.1; a valid 30-digit run cost 13.7 ms.

sooperset/mcp-atlassian#1799: a 32 MiB initialize POST answered 200 on 1.28.1 (+65,680 KB RSS median) and 413 on 1.30.0 at the SDK's 4 MiB default, which a deployment can override.

virgiliojr94/localpdf.io#14: a 127-byte APNG declaring 32,000 frames held its /convert route 127,501.459 ms on 12.1.1 against 121.482 ms on 13.0.0, control 200 in 14 ms on both.

aartiq/servicenow-mcp#15: a cross-origin 307 replayed the body and a custom header to the redirect target on 1.30.0, nothing on 1.32.2, at the SDK boundary, not the app route.

FrelyHQ/frely-cli#143: a cross-service bearer token passed 3/3 at 1.30.0 and answered HTTP 401 3/3 at 1.32.2, measured at the SDK's function boundary, not the app route.

FrelyHQ/frely-cli#143 was closed unmerged on 2026-11-03 06:15:52 utc; no fix is recorded.

superglue-ai/superglue#706: a 2,657,791-byte !!omap took 16,065.6 ms through POST /v1/extract on 4.2.0 and 256.0 ms on 4.3.2; a same-volume plain mapping took about 0.14 s on both.

StarWink0712/Jianmo-resume#1: the avatar route answers only on loopback behind the session token, so one 321-byte EPS upload holds a desktop thread until restart.

mage-ai/mage-ai#6215: the crafted commit must reach the repository the project syncs from, and the default API key plus user token make every authenticated caller pay the 5.2 s.

ChatGPTNextWeb/NextChat#6929: measured on the two Docker base images with a minimal Node server; the NextChat server itself was not built or started.

Unstructured-IO/unstructured-api#595: the repository's own prepline_general code and lock pins ran under uvicorn on loopback on macOS arm64, not the published linux/amd64 image.

calpaterson/csvbase#153: tracing runs only when enable_datadog is set; gunicorn's 4094-byte limit-request-line caps a request near 0.05 s, so 12.817 s is the uncapped flask run.

yaojingang/GEORank#47: admin-only endpoint, but FastAPI parses the form body before its auth dependency, so the 10.1 s parse runs unauthenticated; measured with DEBUG=false.

NCATSTranslator/Relay#900: an 8,003-byte tracestate header costs about 0.10 s under gunicorn's 8,190-byte field limit; a deployment that raises that limit pays more per byte.

pildorasdeprogramacion/Proyecto_PDF#1: a 32,000,109-byte CR/LF preamble costs 4213.5 ms on 0.0.9 against 10.5 ms on 0.0.32 through the app's own /protect-pdf/ route.

alexkham/webdevdata-app#1: a 166,532-byte body of 4,000 chained merge keys costs 3590.687 ms on js-yaml 4.1.0 against 6.848 ms on 4.3.2 through the app's own YAML route.

vas3k/TaxHacker#199: the 4,397,806-byte action-ref body answers in 54.975 ms on next 16.4.1 against 5,761.744 ms on 16.2.10 through the app's own POST /dashboard.

vas3k/TaxHacker#199 supersedes Dependabot's #171, whose next 16.3.5 stays inside the advisory; the 1,336-line diff is npm's own resolution (sharp ^0.35.5), not hand edits.

jakowenko/double-take#366: a 340,034-byte body of 20,000 empty merge sources holds its PATCH /api/config route for 2.24 s on js-yaml 4.1.0 against 15.1 ms on 4.3.2.

jakowenko/double-take#366 ran on the app's own Node 16.20.2 build, since canvas 2.9.1 and better-sqlite3 7.5.3 do not build on Node 26, and on a lab-only port, not the default.

BerriAI/litespeed#34: a 2,000,015-byte body of 1,000,000 non-object providers takes 592.1 ms with a 66,888,955 B reply on zod 4.5.4 against 9.7 ms and 65 B on 4.6.6.

BerriAI/litespeed#34: the server binds 127.0.0.1 and rejects a non-local Host header, so a local process or a same-origin page reaches it, not an arbitrary host.

Geodan/mapproxyadmin#14: a 117,787-byte document of 4,000 nested namespaces costs 787.7 ms and 888,544 KB peak memory on 0.9.6 against 197.9 ms and 147,776 KB on 0.9.12.

nick-moyer/mp3-file-analysis#1: a 252-byte boundary fills a 256-byte needle's skip table with 0, so @fastify/busboy 3.2.0 hangs the event loop permanently; 3.2.4 answers in 129 ms.

nick-moyer/mp3-file-analysis#1: both 1,391-byte requests go in the same two TCP writes and differ only in boundary length; the lab used port 3300, not the default 3000.

nick-moyer/mp3-file-analysis#1: the repository is small and quiet, created 2026-01-15, last pushed 2026-01-18, with no license file.

AscendGrace/ProAI#2: a 196-byte multipart field items[4294967294] stops the server on multer 2.1.1, and 2.5.0 alone still hangs; fieldArrayIndexLimit 1000 answers 500 in 9 ms.

Ckokoski/Fibb#21: a 150-byte docx declaring 4,026,531,840 bytes costs 8,347 ms and 8,141,280 KB peak RSS on the unauthenticated upload route, and 0.6.1 answers in 23 ms.

wfogame/Excel#2: a 2,434-byte workbook declaring A1:XFD1048576 holds the unauthenticated /upload/json past 120,006 ms at 472,512 KB; the sheetRows bound answers 413 in 1.6 ms.

wfogame/Excel#2: the lab bound the port through PORT because this host's 3000 is held by grafana; no app code or route changed, and the repository has no test suite.

maleeqB/excel-merger#1: a 2,434-byte workbook declaring A1:XFD1048576 holds the unauthenticated POST /merge past 120,004 ms at 7.25 GiB; the sheetRows bound answers 413 in 8 ms.

DumbWareio/DumbAssets#141: a 2,434-byte workbook declaring A1:XFD1048576 holds /api/import-assets past 125,106 ms at 452,352 KB; the sheetRows bound answers 413 in 1.5 ms.

DumbWareio/DumbAssets#141: /upload/json, /upload/pdf and /upload/sql share the unbounded parse, and the default config answers all three without a credential.

DumbWareio/DumbAssets#141: the lab bound the port through PORT because this host's 3000 is held by grafana; no app code or route changed, and the repository has no test suite.

janbezovsek/Nodejs-excel-import#1: the same declared-grid defect class on a different callsite, index.js:12-14, with its own upload route and patch.

janbezovsek/Nodejs-excel-import#1: the only route is POST /upload and no auth middleware exists, so a 2.4 KB workbook reaches the parser without a credential.

janbezovsek/Nodejs-excel-import#1: a 2,434-byte workbook declaring A1:XFD1048576 held POST /upload past 120,002 ms at 428,880 KB; the sheetRows bound answers 413 in 1.9 ms.

janbezovsek/Nodejs-excel-import#1: measured on a local loopback checkout from its own npm ci; no live deployment was probed, and the repository has not pushed since 2024-10-09.

srotzin/hive-coinbase-mirror#1: six codings with Content-Length 1 and an early close made the route answer 200 in 3.6 ms on 6.25.0, then the process exited 1; 6.29.1 stayed alive.

srotzin/hive-coinbase-mirror#1: the body stream is built before the coding check, so the unhandled ResponseContentLengthMismatchError hits an orphaned stream after the answer.

srotzin/hive-coinbase-mirror#1: the caller picks target_facilitator_url and any non-empty x-payment header passes, so one response from a URL the caller supplies ends the process.

srotzin/hive-coinbase-mirror#1: measured on a local loopback checkout, and the mirror deployment was not probed; the repository has not pushed since 2026-05-01.

bagusprmjaya/monolith-dashboard-ejs-nodejs#1: the car-rental form's startRent field reaches moment() with no format string, so the rfc2822 parser runs on the submitted value.

bagusprmjaya/monolith-dashboard-ejs-nodejs#1: a 300,000-character startRent field costs 37,194 ms on moment 2.29.1, and a GET /login issued meanwhile waits 36,193 ms.

bagusprmjaya/monolith-dashboard-ejs-nodejs#1: the 2.29.4 bump answers a 500,000-character startRent field in 22 ms and a 200,000-character one in 6 ms, with a GET /login at 1 ms.

bagusprmjaya/monolith-dashboard-ejs-nodejs#1: the route sits behind the app's shipped default account, so the crafted field is reachable without a credential the operator changed.

xslasd/step2glb#4: multer at app.js:19 buffers the whole upload in memory with limits unset, so 800 MB raises RSS 182 MB to 1,472 MB before a 200; the 10 MiB bound answers 413.

j-w-yun/song-recommender#2: express.urlencoded at app.js:97 parses every POST before routing, so a field nested 500,000 brackets deep holds the event loop for 19,333 ms.

j-w-yun/song-recommender#2: the 4.22.3 lockfile resolves body-parser 1.20.9 and qs 6.16.2 through the tree, not just the direct pin, and refuses that body with 400 in 7 ms.

j-w-yun/song-recommender#2: the patch rewrites package-lock.json across express's dependency tree, so it is not a one-line version edit.

g7vind/File-Metadata-Microservice-API-freecodecamp#1: multer at index.js:7 buffers the upload with limits unset, so 512 MiB took RSS to 1,097,056 KB; the 5 MiB bound answers 413.

ItzCrazyKns/Vane#1222: scrape_url hands any string to page.goto, so file:///etc/passwd and a 302 to loopback returned their contents; the patch allows http(s) only.

dungeon-revealer/dungeon-revealer#1677: busboy's limits stay Infinity, so /api/notes/import held a 1 GiB note and the process exited 3 of 3, against 413 in 0.08 s.

dungeon-revealer/dungeon-revealer#1677: the repository is maintenance-dormant, its last merged pull request 2023-03-17, and issue #1655's one comment asks whether it is abandoned.

dungeon-revealer/dungeon-revealer#1677: it is not archived and still accepts pull requests, and its Renovate bot pushed on 2026-10-26.

dungeon-revealer/dungeon-revealer#1677: the pull request closed unmerged, so the fix still waits on a maintainer who may not be watching.

dungeon-revealer/dungeon-revealer#1677 was closed unmerged on 2026-10-31 23:28:00 utc; no fix is recorded.

Inist-CNRS/lodex#3766: busboy keeps limits.fields at Infinity, so 1,000,000 fields with thirty [0] segments exit the API process 3 of 3 at 2.36-2.43 GB, against 413 in 0.032 s.

Inist-CNRS/lodex#3766: 1,000,000 plain fields are 79.9 MB and cost +107 MB, while 300,000 bracketed fields are 50.9 MB and cost +1.08 GB; the count and the nesting, not the bytes.

Inist-CNRS/lodex#3766: pull request #3677, open since 2026-09-07 and blocked, caps imported documents at 50,000 and never reaches the multipart parser, so it is a different fix.

Inist-CNRS/lodex#3766: the repository is active and Dependabot ran on 2026-10-30, but #3677 has been blocked since 2026-09-07, so a merged fix is not guaranteed.

Inist-CNRS/lodex#3766: no advisory covers this defect; the patch bounds four multipart callsites with one shared parser, and no library release applies a finite field count.

galtproject/geesome-node#1501: the local async-busboy forwards its options to busboy 1.6.0, so limits.fields, limits.files and limits.parts stay at Infinity.

galtproject/geesome-node#1501: 1,000,000 fields with thirty [0] segments exit 3 of 3 at 2.53-2.61 GB against the 2,048 MB heap; the patch answers 413 in 0.020 s at +16 MB.

galtproject/geesome-node#1501: 300,000 bracketed fields are 50.0 MB and cost +1.77 GB while 300,000 plain fields are 23.0 MB and cost +92 MB; the count and nesting, not the bytes.

galtproject/geesome-node#1501: the callsites set fileSize, and files: 1 on assets; the wrapper's fieldsLimit, filesLimit and partsLimit listeners answer 413, but nothing set them.

galtproject/geesome-node#1501: no advisory covers this defect; the parser is local, so no busboy release applies a finite field count and the row names a callsite bound.

galtproject/geesome-node#1501: the repository is active, a dozen pull requests merged on 2026-10-30, and it accepts pull requests from outside contributors.

galtproject/geesome-node#1501: it has no licence file and private reporting disabled, so a public pull request was the only channel and the merge landed on master.

Christianoooooo/sharely#215: the shared multer instance sets only fileSize, so fields, parts, fieldNestingDepth and fieldArrayIndexLimit stay at Infinity.

Christianoooooo/sharely#215: POST /upload parses before requireApiKey, so 1,000,000 fields with thirty [0] segments exit the process 3 of 3 at 2.26-2.28 GB.

Christianoooooo/sharely#215: 300,000 nested fields are 52.4 MB and cost +1.87 GB, while 1,000,000 plain fields are 84.9 MB and cost +191 MB; the nesting is the amplifier.

Christianoooooo/sharely#215: the patch sets fields 100, fieldNestingDepth 10 and fieldArrayIndexLimit 1,000, and answers the 174.9 MB body 413 in 0.44 s.

Christianoooooo/sharely#215: the repository is active, its last merge #214 on 2026-10-24 and 115 commits since 2026-10-01, and it accepts pull requests.

Christianoooooo/sharely#215: two file parts crash the pristine route (LIMIT_UNEXPECTED_FILE before path is set, then fs.unlink(undefined)); the patch answers 400 and stays up.

Christianoooooo/sharely#215: no advisory covers the defect and multer 2.5.0 documents these limits as Infinity, so the patch bounds the callsite and names no package version.

vas3k/TaxHacker#200: the env schema declares BETTER_AUTH_SECRET with a default 24-character string and the shipped image sets no value for it.

vas3k/TaxHacker#200: a session_token and session_data pair signed with that default is accepted for any user id, including an id with no row in users or sessions.

vas3k/TaxHacker#200: the cookie-cache path reads no session or user row, so get-session answers 200 while list-sessions answers 200 [] and a cookie-less request answers 401.

vas3k/TaxHacker#200: the patch requires the variable rather than generating one, because the same secret derives the AES-256-GCM key for stored mailbox passwords.

vas3k/TaxHacker#200: 19 pull requests are open on the repository, and #181 also touches .env.example for an unrelated LLM-provider change.

vas3k/TaxHacker#200: the .env.example overlap is evidence of a shared file, not a duplicate, and this copy claims no priority over #181.

vas3k/TaxHacker#200: the published advisory names releases up to 0.8.2 and 0.8.5 still ships the default, so the fix is a release that requires the variable.

superglue-ai/superglue#707: the MCP server keeps every transport in a module-level map whose only deletion is transport.onclose.

superglue-ai/superglue#707: neither the file nor the SDK transport at 1.29.0 or 1.32.0 carries a timeout or an interval, so an abandoned session is never released.

superglue-ai/superglue#707: 500 open sessions cost 20,588 kB, 41.18 kB each, and 35,763 authenticated initializes never released their RSS.

superglue-ai/superglue#707: the patch deletes a transport idle past 30 minutes on a one-minute sweep, closes it and unref()s the interval, so onclose runs as it would on DELETE.

superglue-ai/superglue#707: a TTL sweep was chosen over a cap, which refuses a live client while every dead session keeps its slot.

superglue-ai/superglue#707: the process stayed alive at 99.94% of one core and no OOM kill was recorded, so a restart is the only way back.

superglue-ai/superglue#707: no advisory covers the defect, so the row names an app-side callsite fix and no package version.

ItzCrazyKns/Vane#1223: GET /api/config answers with no cookie and spreads each provider entry, so the stored apiKey travels in the response.

ItzCrazyKns/Vane#1223: the shipped image answered 200 with no cookie, and an unauthenticated POST /api/providers stored a canary key that the next read returned verbatim.

ItzCrazyKns/Vane#1223: a bogus session cookie is treated the same as no cookie, and no API route reads a session or an authorization header.

ItzCrazyKns/Vane#1223: the repository has no middleware at 1.12.2 or on master, and the README lists adding authentication as unimplemented.

ItzCrazyKns/Vane#1223: the patch redacts every credential-named string recursively across the response, because a session gate is not a file it can add.

ItzCrazyKns/Vane#1223: POST /api/providers keeps accepting an unauthenticated write, whose damage is a configuration change rather than a credential leak.

ItzCrazyKns/Vane#1223: the same unauthenticated surface reaches the scrape tool, which returns a local file's text as the chat sources.

ItzCrazyKns/Vane#1224: POST /api/providers stores config.baseURL with no scheme, host or address check, and the next chat request fetches that base URL.

ItzCrazyKns/Vane#1224: a provider pointing at host.docker.internal received the classifier request, and the chat streamed the canary text back as the assistant block.

ItzCrazyKns/Vane#1224: the shipped image reports 1.12.2, newer than the release the advisory covers, and still fetches the caller-supplied base URL.

ItzCrazyKns/Vane#1224: the patch accepts only http and https, resolves the host and refuses loopback, link-local and private ranges before the request.

ItzCrazyKns/Vane#1224: a self-hosted operator running Ollama or another model server on the machine or LAN exposes it behind a public hostname instead.

ItzCrazyKns/Vane#1224: creating a provider needs no credentials, and the fetch fires on the classifier call before any user-visible answer.

ItzCrazyKns/Vane#1224: the path is the base URL plus /chat/completions, so only internal services that speak the OpenAI shape answer usefully.

vas3k/TaxHacker#201: generateInvoicePDF renders the caller's invoice object and never calls getCurrentUser, so the invoice PDF action needs no session.

vas3k/TaxHacker#201: the PDF header renders Image with src set to data.businessLogo, and the renderer resolves that source server-side while rendering.

vas3k/TaxHacker#201: the shipped image fetched a canary logo from host.docker.internal and embedded a PNG placed at /tmp inside the container in the returned PDF.

vas3k/TaxHacker#201: businessLogo may be an object, so a measured call controlled the method, headers and body of the fetch, not only its address.

vas3k/TaxHacker#201: the loader follows redirects with no timeout or size cap and buffers the whole body, and a 30-entry cache serves a repeated URL.

vas3k/TaxHacker#201: the patch accepts only http, https or an inline data source, resolves the host and refuses loopback, link-local and private ranges.

vas3k/TaxHacker#201: local paths are rejected before rendering, so a file on disk no longer reaches the returned PDF through an image source.

vas3k/TaxHacker#202: the settings action testLLMProviderAction builds an LLMConfig and calls testLLMProvider without calling getCurrentUser().

vas3k/TaxHacker#202: a request with no Cookie header answered 200 and the canary logged POST /v1/chat/completions, so the target's answer returns in the action's message.

vas3k/TaxHacker#202: only the openai_compatible branch reads baseUrl, and the same call with provider openai produced no canary hit and a 401 from api.openai.com.

vas3k/TaxHacker#202: the patch resolves baseUrl before the call and refuses anything that is not http or https or that resolves to loopback, link-local or a private range.

vas3k/TaxHacker#202: the guard sits in the shared provider client, so the test action and the normal chat path both construct their client through it.

vas3k/TaxHacker#202: the shipped image reports 0.8.5, the last release the advisory names, and master's action still passes baseUrl straight through.

superglue-ai/superglue#708: the Deno tool-execution worker's import map pins basic-ftp 5.3.0, whose RE_LINE runs adjacent unbounded groups over a Unix listing line.

superglue-ai/superglue#708: a crafted 448 KB listing took 206,634 ms to parse against 120 ms for a benign listing of the same length at the library boundary.

superglue-ai/superglue#708: POST /v1/tools/run answered success=true after 214.4 s, with the worker at 99.3 percent CPU and no error surfaced.

superglue-ai/superglue#708: basic-ftp 6.2.1 replaces the regex with a non-backtracking parse and parses the same crafted 56 KB listing in 52 ms.

superglue-ai/superglue#708: the route needs a bearer token and a caller-supplied one-step ftp tool, so the caller names the host and the server sends the bytes.

superglue-ai/superglue#708: the patch moves the import map's pin at :15 and regenerates the lock, and it changes no application code.

harrynull/bilibili_blacklist#49: the repository pins body-parser 1.19.0 at package-lock.json:315 and mounts its urlencoded parser globally at app.ts:17.

harrynull/bilibili_blacklist#49: 1.19.0 hardcodes depth: Infinity, so a form post pays the full nesting walk before any route or cookie check.

harrynull/bilibili_blacklist#49: one 102,003-byte field nested 34,000 levels parses in 83.046 ms against 0.196 ms flat, a 423.7x difference.

harrynull/bilibili_blacklist#49: a 10 ms timer scheduled into that request fires 71-72 ms late, and 8 clients over 2 s complete 28 requests.

harrynull/bilibili_blacklist#49: the GET issued during that window answers after 2,159.16 ms, and the 100 kb default body limit is the only cap.

harrynull/bilibili_blacklist#49: 1.20.9 answers the same body 400 in 1.02 ms through the depth 32 and strictDepth defaults that landed in 1.20.3.

harrynull/bilibili_blacklist#49: patched, the same window completes 4,880 requests at 2,440 req/s; the row tracks a published 2024 advisory, not a new finding.

hubwiz/example-node#7: app.js:32 mounts multer() with no limits, and package.json declares ~0.1.6 with no lockfile, so a fresh install resolves 0.1.8 (busboy 0.2.14).

hubwiz/example-node#7: the committed node_modules tree runs 0.1.6 (busboy 0.2.9), and both versions keep limits.fields and limits.parts at Infinity.

hubwiz/example-node#7: through the repository's own app.js on Node v26.13.0, a 2 MiB body of 16,384 fields takes 12.2 s and +125 MB RSS, with a peak near 292 MB.

hubwiz/example-node#7: 8,192 fields takes 2.69-2.77 s, and 1,500 file parts write 1,500 temp files before the request is answered.

hubwiz/example-node#7: the patch sets fields 1,000 and parts 1,001 and answers 413 on either bound, so the same 16,384-field body is 413 in 70 ms at +18 MB.

hubwiz/example-node#7: multer 0.1.x discards fields past a limits bound, so the patch creates the parser per request to answer 413; 1,500 file parts then answer 413 in 24 ms.

hubwiz/example-node#7: no CVE or GHSA covers multer 0.1.8, busboy 0.2.14 or dicer 0.2.5, and the default branch last moved in 2015-01-29.

aks2161989/fullstack-ecommerce-testing-suite#1: npm prints the @hapi/joi@17.1.1 deprecation on install, and the pull request moves the dependency to the joi name at 17.1.1.

aks2161989/fullstack-ecommerce-testing-suite#1: both packages publish git commit b3833c4, and their lib trees are byte-identical across 31 files, so the package code never changes.

aks2161989/fullstack-ecommerce-testing-suite#1: validation.js:1 is the repository's only require of the package, and the regenerated lock keeps 17.1.1 with no version move.

aks2161989/fullstack-ecommerce-testing-suite#1: npm ci on the regenerated lock installs cleanly and no longer prints the @hapi/joi deprecation.

aks2161989/fullstack-ecommerce-testing-suite#1: the repository's own validation tests pass 12/12 on both trees, on Node 26 and Node 22.

aks2161989/fullstack-ecommerce-testing-suite#1: registerValidation and loginValidation matched on value, error.message, error.name and error.details over 48 payloads.

aks2161989/fullstack-ecommerce-testing-suite#1: this is maintenance, not a security fix: no advisory covers @hapi/joi@17.1.1, and only the package name changes.

sylvahh/LotR-SDK#1: the lockfile moves follow-redirects 1.14.7 to 1.16.2 in both entries, and package.json stays because its ^1.14.7 range already admits 1.16.2.

sylvahh/LotR-SDK#1: the pinned 1.14.7 sits inside four published advisory ranges that 1.16.2 clears, so the row tracks advisories already public, not a finding of ours.

sylvahh/LotR-SDK#1: the newest advisory closes only through the caller's 1.16 sensitiveHeaders opt-in; the default strips only Authorization, Proxy-Authorization and Cookie.

sylvahh/LotR-SDK#1: on a loopback cross-host redirect through the repository's own axios client, Proxy-Authorization reached the target at 1.14.7 and was stripped at 1.16.2.

sylvahh/LotR-SDK#1: npm ci installs 331 packages and npm ls reports follow-redirects@1.16.2, deduped under the axios 0.25.0 that lib/LibResource.ts:1 uses.

sylvahh/LotR-SDK#1: lib/lib.ts:3 imports a utils module that is absent, so the repository's own suite fails at base identically with and without the change.

sylvahh/LotR-SDK#1: the repository's last push was 2025-06-27, 491 days before this row, so this is a dependency update, not active maintenance.

vchain-us/jsvcn#30: the lockfile resolves lodash 4.18.1 in place of 4.17.20, and package.json stays because its ^4.17.20 range already admits 4.18.1.

vchain-us/jsvcn#30: lodash is a devDependency the repository's source never imports, so the lock dedupes the build-toolchain copy under @babel/core, not a callsite fix.

vchain-us/jsvcn#30: the pin sits inside five published advisory ranges that 4.18.1 clears, so the row tracks advisories already public, not a finding of ours.

vchain-us/jsvcn#30: the repository's default branch last moved 2021-01-27, so the row claims no active maintenance.

darobin/notion-backup#45: the lockfile resolves axios 0.21.2 in place of 0.21.1 and moves follow-redirects to a ^1.14.0 range, while package.json keeps ^0.21.1.

darobin/notion-backup#45: the hazard sits in the XHR adapter's header parser, so the measurement drove the repository's own client through that adapter.

darobin/notion-backup#45: a 50,002-byte header value takes 832.68 ms at 0.21.1 against 1.78 ms at 0.21.2, median of 3.

darobin/notion-backup#45: the lock closes one published advisory range that 0.21.2 clears, so the row tracks advisories already public, not a finding of ours.

darobin/notion-backup#45: the default branch last moved 2024-10-03, so the row claims no active maintenance.

darobin/notion-backup#45: all eight qualified targets for this boundary were more than a year dormant, so the row rests on the published advisory, not on activity.

darobin/notion-backup#45: 23 further advisories still cover 0.21.2, the same 23 as 0.21.4, and closing them needs a manifest range move to 0.34.0 that this row does not make.

cnichte/md-curcuma#1: the lockfile resolves lodash 4.18.1 in place of 4.17.21, while package.json stays and no application source is edited.

cnichte/md-curcuma#1: its own _.omit call passes one key string rather than the array path one advisory needs, it never calls _.template, and this bump fixes no callsite.

cnichte/md-curcuma#1: the pin sits inside three published advisory ranges that 4.18.1 clears, so the row tracks advisories already public, not a finding of ours.

cnichte/md-curcuma#1: the default branch last moved 2026-10-20, so the repository is active but tiny and the row claims no long-running maintenance.

cnichte/md-curcuma#1: the pull request is the repository's first of any state, and the repository publishes no security policy.

cnichte/md-curcuma#1: the installed module rejects the imports payload at 4.18.1 that 4.17.21 executes, so the resolved runtime copy moves.

carlosbarreraacuna/front-almacen#1: the lockfile resolves lodash 4.18.1 in place of 4.17.21, while package.json stays and no application source is edited.

carlosbarreraacuna/front-almacen#1: the repository's only lodash import is debounce in its useSmartAutocomplete hook, which none of these ranges affects, so this fixes no callsite.

carlosbarreraacuna/front-almacen#1: the pin sits inside three published advisory ranges that 4.18.1 clears, so the row tracks advisories already public, not a finding of ours.

carlosbarreraacuna/front-almacen#1: the default branch last moved 2026-04-17, 196 days before this row, so the row claims no active maintenance.

carlosbarreraacuna/front-almacen#1: the pull request is the repository's first of any state, and the repository publishes no security policy.

carlosbarreraacuna/front-almacen#1: the installed module rejects the imports payload at 4.18.1 that 4.17.21 executes, so the resolved runtime copy moves.

anandgeorgejohny/Cline-AI-CLI-aNd-Editor-#1: the diff is one line, lodash 4.17.21 to 4.18.1, one addition and one deletion, while package.json and the source stay unchanged.

anandgeorgejohny/Cline-AI-CLI-aNd-Editor-#1: the lock writes no resolved or integrity for registry packages, so the version line moves and no hash changes.

anandgeorgejohny/Cline-AI-CLI-aNd-Editor-#1: lodash is a runtime transitive through the repository's own declared archiver dependency, and no shipped source imports it.

anandgeorgejohny/Cline-AI-CLI-aNd-Editor-#1: its only callsite, testing-platform harness utils, calls only _.isArray, _.isPlainObject, _.mapValues and _.isEqual.

anandgeorgejohny/Cline-AI-CLI-aNd-Editor-#1: none of those calls reaches an affected function, so the resolved runtime copy moves and the bump fixes no callsite.

anandgeorgejohny/Cline-AI-CLI-aNd-Editor-#1: the pin sits inside three published advisory ranges that 4.18.1 clears, so the row tracks advisories already public.

anandgeorgejohny/Cline-AI-CLI-aNd-Editor-#1: default branch add-fe-banner last moved 2026-04-16; it publishes no security policy; this is its first pull request of any state.

NitinTheGreat/DealHarbor-Frontend#16: the diff is one line, lodash 4.17.21 to 4.18.1, 3 additions and 3 deletions, while package.json and the source stay unchanged.

NitinTheGreat/DealHarbor-Frontend#16: the lock resolves 4.18.1 in place of 4.17.21 at version, resolved and integrity, and the entry stays a runtime dependency.

NitinTheGreat/DealHarbor-Frontend#16: its only lodash import is debounce in the seller-search component, which none of these ranges touches.

NitinTheGreat/DealHarbor-Frontend#16: the pin sits inside three published advisory ranges that 4.18.1 clears, so the row tracks advisories already public, not a finding of ours.

NitinTheGreat/DealHarbor-Frontend#16: an executed probe of the installed module flips 6 of 6 advisory-sink checks between the two versions.

NitinTheGreat/DealHarbor-Frontend#16: the change moves the resolved runtime copy and fixes no callsite.

NitinTheGreat/DealHarbor-Frontend#16: last push 2026-01-21, 282 days before this row; it publishes no security policy; this is its first open pull request of any state.

buku-masjid/buku-masjid#160: package-lock.json moves the axios entry to 1.20.0 at version, resolved and integrity, while package.json's ^1.1.2 range admits it and stays.

buku-masjid/buku-masjid#160: the same lockfile entry moves axios's form-data range from ^4.0.5 to ^4.0.6.

buku-masjid/buku-masjid#160: axios is a devDependency that Vite bundles into the built client, so the shipped bundle moves and no server runtime dependency does.

buku-masjid/buku-masjid#160: the application imports neither the fetch adapter nor the HTTP/2 adapter, where most of the cleared advisories sit.

buku-masjid/buku-masjid#160: the pin sits inside twelve published advisory ranges that 1.20.0 clears, so the row tracks advisories already public, not a finding of ours.

buku-masjid/buku-masjid#160: four pull requests merged on 2026-10-27 and 2026-10-28, and its last push was 2026-10-28, so it is actively maintained.

buku-masjid/buku-masjid#160: its audience and merge history make it the most active and highest-audience target among the rows published around it.

piyushgarg-dev/chaicode-genai-2026-cohort#2: the lock entry moves axios to 1.20.0 at version, resolved and integrity, while package.json's ^1.18.1 range admits it and stays.

piyushgarg-dev/chaicode-genai-2026-cohort#2: the same lockfile entry moves axios's form-data range from ^4.0.5 to ^4.0.6.

piyushgarg-dev/chaicode-genai-2026-cohort#2: axios is a runtime dependency and the repository ships no build artifact, so the installed copy is the one that runs.

piyushgarg-dev/chaicode-genai-2026-cohort#2: the script uses the default Node HTTP adapter, not the fetch or HTTP/2 adapters where most of the cleared advisories sit.

piyushgarg-dev/chaicode-genai-2026-cohort#2: the pin sits inside twelve published advisory ranges that 1.20.0 clears, so the row tracks advisories already public.

piyushgarg-dev/chaicode-genai-2026-cohort#2: the repository's last push was 2026-07-08, and #2 is its first pull request of any state.

piyushgarg-dev/chaicode-genai-2026-cohort#2: the install needs --legacy-peer-deps for a pre-existing peer conflict unrelated to this change and identical at base.

CrazyRobMiles/RaspberryPi-DialTelephone#1: package.json's ^4.18.2 range admits 4.20.0 and stays unchanged; only package-lock.json moves the express entry.

CrazyRobMiles/RaspberryPi-DialTelephone#1: the patch is a subtree move in express's dependency tree, 12 entries change version, 15 added, 5 removed, 479 lines added, 201 deleted.

CrazyRobMiles/RaspberryPi-DialTelephone#1: the lock clears one published express response.redirect() XSS advisory range, graded low, the weakest advisory the record carries.

CrazyRobMiles/RaspberryPi-DialTelephone#1: the resolved package moves and the advisory range clears, but the repository never calls res.redirect(); five routes call res.render().

CrazyRobMiles/RaspberryPi-DialTelephone#1: the bump fixes no callsite and claims no exploit; at 4.19.2 the 302 body carries an anchor href, and at 4.20.0 it renders as text.

CrazyRobMiles/RaspberryPi-DialTelephone#1: the install needs --ignore-scripts because epoll and speaker fail node-gyp at speaker 0.5.4 on Node 26, while express is pure JavaScript.

CrazyRobMiles/RaspberryPi-DialTelephone#1: the repository's last push was 2025-04-01, about nineteen months before this row, and #1 is its first pull request of any state.

drojasu-coder/Ejercicio1Pr-cticaenclase2#1: the advisory's two affected ranges are 2.0.0 to below 2.4.0 and 0 to below 1.20.9, fixed in 2.4.0 and 1.20.9.

drojasu-coder/Ejercicio1Pr-cticaenclase2#1: package.json's ^1.20.2 range admits the patch release and does not move; one package-lock entry changes, 14 additions and 14 deletions.

drojasu-coder/Ejercicio1Pr-cticaenclase2#1: 1.20.9 is the 1.x backport of that fix, published 2026-10-22T11:38:27Z, 71 seconds before 2.4.0.

drojasu-coder/Ejercicio1Pr-cticaenclase2#1: server.js:5 requires body-parser and server.js:14-15 mounts json() and urlencoded({extended:true}) globally.

drojasu-coder/Ejercicio1Pr-cticaenclase2#1: a gzip body plus 100 KiB of trailing 0x00 bytes answers 200 then exits 1 on 1.20.8, and 200 with the process alive on 1.20.9.

drojasu-coder/Ejercicio1Pr-cticaenclase2#1: the exit is an unhandled Z_DATA_ERROR (incorrect header check), and a bodyless POST stays 400 on both versions.

drojasu-coder/Ejercicio1Pr-cticaenclase2#1: 1.20.9 was chosen over 2.4.0 because the 2.x line turns the bodyless-POST 400 into 500.

superglue-ai/superglue#709: the Deno tool-execution worker's import map pinned npm:xlsx@0.18.5, whose styles regex backtracks on a crafted workbook.

superglue-ai/superglue#709: npm's latest xlsx is still 0.18.5, so the patch imports https://cdn.sheetjs.com/xlsx-0.20.2/package/xlsx.mjs from the SheetJS CDN.

superglue-ai/superglue#709: the published advisory lists introduced: 0 and no fixed event, because the fixed build never reached npm.

superglue-ai/superglue#709: a 400,000-byte payload took 113,732 ms at 0.18.5 against 55.7 ms at 0.20.3, a 2,042x difference.

superglue-ai/superglue#709: POST /v1/tools/run completed after 119.4 s with the core's 60 s timeout never firing.

superglue-ai/superglue#709: four files change: the inline import with a @deno-types directive, deno.lock, deno.json, and the worker launcher gaining --allow-import=cdn.sheetjs.com.

superglue-ai/superglue#709: deno check reported the same 2 pre-existing TS2322 errors on base and patch; the first push failed it with 4 new ones and was not submitted.

superglue-ai/superglue#710: one resolved lock entry moves proxy-addr 2.0.7 to 2.0.8 with package.json byte-identical, as express 5.2.1 declares ^2.0.7 and its nested 4.22.2 ~2.0.7.

superglue-ai/superglue#710: a 9.1 critical advisory, where an IPv4-mapped IPv6 subnet with a short prefix compiles to all-zero leading bits and matches every IPv4 address.

superglue-ai/superglue#710: every unauthenticated client, over the network with no privileges or interaction, is trusted at hop 0, so req.ip and req.ips return its X-Forwarded-For.

superglue-ai/superglue#710: that defeats IP-based authorization, rate limiting and audit logging.

superglue-ai/superglue#710: the HTTP server is Fastify, which uses @fastify/proxy-addr 5.1.0 rather than this package, and no trust proxy configuration exists.

superglue-ai/superglue#710: express supplies types only and elides from the emitted JavaScript, and its 4.22.2 copy under mcp-remote runs only when that CLI is invoked.

superglue-ai/superglue#710: this clears a critical advisory from the dependency tree and does not claim a reachable path.

superglue-ai/superglue#711: one resolved lock entry moves @fastify/busboy 3.2.0 to 3.2.2 with package.json byte-identical, as @fastify/multipart 9.4.0 declares ^3.0.0.

superglue-ai/superglue#711: the parser runs on the executed path: packages/core/api/api-server.ts:62 registers @fastify/multipart and each upload to /v1/extract is parsed by 3.2.0.

superglue-ai/superglue#711: three advisories land at once: a 5.8 moderate CRLF injection in a part filename or field name, and two 7.5 high denials of service.

superglue-ai/superglue#711: a part header named __proto__ or constructor throws this.header[h].push is not a function on 3.2.0 and parses on 3.2.2.

superglue-ai/superglue#711: a 252-byte boundary makes the streaming search needle 256 bytes and hangs 3.2.0 past 2,000 ms under SIGKILL while 3.2.2 completes in 49 ms.

superglue-ai/superglue#711: the extract handler takes the part's filename, and a filename a\rb\nc.txt delivered as the file event by 3.2.0 is skipped by 3.2.2.

superglue-ai/superglue#711: npm ci --ignore-scripts --no-audit --no-fund exited 0 with 1,427 packages each, and tsc for packages/shared and packages/core exited 0, 0 errors.

luchenqun/my-bookmark#60: one resolved lock entry moves @fastify/busboy 3.2.0 to 3.2.2 with package.json byte-identical, as @fastify/multipart 9.4.0 declares ^3.0.0.

luchenqun/my-bookmark#60: /userRegister and /userLogin need no account, so a parse-time throw or hang at /bookmarkUpload is a remote denial of service by any registered user.

luchenqun/my-bookmark#60: three advisories land at once: a 5.8 moderate CRLF injection in a part filename or field name, and two 7.5 high denials of service.

luchenqun/my-bookmark#60: a part header named __proto__ or constructor throws this.header[h].push is not a function on 3.2.0 and parses on 3.2.2.

luchenqun/my-bookmark#60: a 252-byte boundary makes the streaming search needle 256 bytes and blocks the event loop past 2,006 ms under SIGKILL, where 3.2.2 completes in 49 ms.

luchenqun/my-bookmark#60: the upload handler reads file.toBuffer() and never file.filename, so the CRLF filename defect is not separately observable there.

luchenqun/my-bookmark#60: npm ci --ignore-scripts --no-audit --no-fund exited 0 on base and patched, 268 packages each, and prisma generate plus build exited 0 on both.

superglue-ai/superglue#712: one resolved lock entry moves fast-uri 3.1.2 to 3.1.9 with package.json byte-identical, while deno.lock pins 3.1.0 untouched.

superglue-ai/superglue#712: eleven advisories clear, seven at 7.5 and four at 6.1, 4.8, 3.7 and 3.7, while 3.1.3, the first named fix, still reports twelve with ten of these open.

superglue-ai/superglue#712: 7.5s: IDN, literal backslash, backslash introducer, percent-encoded scheme, malformed IPv6, repeated percent-decoding, unvalidated port in serialize.

superglue-ai/superglue#712: require('fastify') puts fast-uri in require.cache, 1 module before app.ready() and 4 after a response schema, and a route answers 200.

superglue-ai/superglue#712: @fastify/ajv-compiler 4.0.5 and fast-json-stringify 6.4.0 require it, ajv exposes ajv/dist/runtime/uri, and routes declare no request schemas.

superglue-ai/superglue#712: no attacker-supplied URI is known to reach the vulnerable functions here; this clears eleven advisories from a loaded library and claims no exploit.

superglue-ai/superglue#712: npm ci --ignore-scripts --no-audit --no-fund exited 0 on base and patched, 1,427 packages each, and tsc for shared and core exited 0 with 0 errors.

callstackincubator/codex-mobile-dev-plugin#79: package.json pins @fastify/busboy exactly at 3.2.0, so this moves the manifest and its one lock entry, not a transitive lock.

callstackincubator/codex-mobile-dev-plugin#79: 3.2.0 carries three published parser advisories: two denials of service fixed in 3.2.1 and a CRLF injection fixed in 3.2.2.

callstackincubator/codex-mobile-dev-plugin#79: the route is POST /api/apps/install on a loopback bind that enforces no token when --token is off, its default for 127.0.0.1.

callstackincubator/codex-mobile-dev-plugin#79: a __proto__ part header returns 400 in 3.5 ms on 3.2.0 and 502 in 52.9 ms on 3.2.4, where the part parsed and reached adb install.

callstackincubator/codex-mobile-dev-plugin#79: the trigger is the parser's own 8 KiB trailer split, not a client choice: a 252-byte boundary then returns nothing on 3.2.0.

callstackincubator/codex-mobile-dev-plugin#79: the client gave up at 12,002 ms, a follow-up timed out at 4,002 ms and CPU rose 0:00.19 to 0:15.67; 3.2.4 answers 502 in 21.4 ms.

callstackincubator/codex-mobile-dev-plugin#79: the denial is a hung event loop in the parsing process, not a crash: the listener stays open and later requests time out.

zai-org/Synapse#14: one resolved lock entry moves @fastify/busboy 3.2.0 to 3.2.2 with package.json byte-identical, as @fastify/multipart 8.3.1 declares ^3.0.0.

zai-org/Synapse#14: three advisories land at once: a 5.8 moderate CRLF injection in a part filename or field name, and two 7.5 high denials of service.

zai-org/Synapse#14: a __proto__ part posted to POST /workspaces/:workspaceId/files answers 413 on 3.2.0 and 201 on 3.2.2, a real request through the app's own start command.

zai-org/Synapse#14: authMiddleware and workspaceMiddleware bound the reachable surface to an authenticated workspace member uploading a file, not an anonymous visitor.

zai-org/Synapse#14: a filename a\rb\nc.txt arrives as originalName "a\rb\nc.txt" on 3.2.0, while 3.2.2 skips the part and answers 400.

zai-org/Synapse#14: a 252-byte boundary hangs 3.2.0 past 2,008 ms under SIGKILL while 3.2.2 completes in 42 ms.

zai-org/Synapse#14: npm ci exited 0 with 1,743 packages each, npm run typecheck exited 0, and the start command served the upload with the files suites 51/51 on both.

superglue-ai/superglue#713: one resolved lock entry moves brace-expansion 1.1.15 to 1.1.21 with package.json byte-identical, and 1.1.21 is the lowest release clearing all six.

superglue-ai/superglue#713: six advisories clear in that one entry, four at 7.5 and two at 5.3; a positive control proves the Module._load hook fires.

superglue-ai/superglue#713: the six fixes are 1.1.16, 1.1.17, 1.1.18, 1.1.19, 1.1.20 and 1.1.21, and each advisory carries an introduced 0 and a fixed 1.1.x range.

superglue-ai/superglue#713: the 7.5s are parseCommaParts recursion, unbounded expansion length, nested-group recursion and a bypass of the unbounded-expansion fix.

superglue-ai/superglue#713: reachability is build and tooling only: copyfiles at packages/core/package.json:21 is a devDependency, then glob, minimatch 3.1.5 and brace-expansion.

superglue-ai/superglue#713: nothing under packages/ imports it and no script calls copyfiles; a Module._load hook logged no brace-expansion load while GET /v1/health answered 200.

superglue-ai/superglue#713: npm ci exited 0 on base and patched, 1,427 packages each, tsc 0 errors on both trees, and both server arms answered health 200 and mcp 401.

nodeSolidServer/node-solid-server#1877: one lock entry moves @fastify/busboy 3.2.0 to 3.2.4 at package.json ^3.2.0 byte-identical, clearing two high 7.5 and one moderate advisory.

nodeSolidServer/node-solid-server#1877: post.mjs:1 statically imports it and ldp-middleware.mjs:25 registers router.post('/*'), so it loads at server start, not per request.

nodeSolidServer/node-solid-server#1877: post.mjs:45 tests req.is('multipart/form-data'), :54 builds it and :76 pipes the body; allow.mjs:7-9 skips auth when webid is off.

nodeSolidServer/node-solid-server#1877: a Module._load hook logged that startup load, with a positive control that fires and a negative control that does not.

nodeSolidServer/node-solid-server#1877: a __proto__ header gave 500 in 2.50 ms on 3.2.0, 200 in 2.81 ms on 3.2.4; a CRLF name stored raw CR and LF, skipped on 3.2.4.

nodeSolidServer/node-solid-server#1877: a 252-byte boundary split 20,604 + 4,262 returned nothing on 3.2.0: client 12,001 ms, GET 4,001 ms, CPU 0:00.42 to 0:12.21.

nodeSolidServer/node-solid-server#1877: 3.2.4 answered that split in 153.28 ms, while one write returned 200 on both, so the trigger is the split write, not the boundary length.

eevan7a9/real-estate-management#107: it is @fastify/multipart 9.4.0's own dependency, ^3.0.0 resolved to 3.2.0 in the lock, not an unused direct declaration.

eevan7a9/real-estate-management#107: a Module._load hook logged it loading before the listening line, with a positive control that fires and a negative control that does not.

eevan7a9/real-estate-management#107: its own node entry point ran unmodified against a real mongo:7 on a signed token and one fixture property; a bare request gets 401 in 2.57 ms.

eevan7a9/real-estate-management#107: a __proto__ part header gave 500 in 5.07 ms on 3.2.0, 201 in 16.86 ms on 3.2.4; a CRLF filename gave 201 delivered, 400 with the part skipped.

eevan7a9/real-estate-management#107: a 252-byte boundary split 20,608 + 150 ms + 4,262 returned nothing on 3.2.0: client 6,003 ms, GET 4,001 ms, CPU 0:00.61 to 0:04.82.

eevan7a9/real-estate-management#107: 3.2.4 answered it in 154.80 ms, while one write returned 201 on both, so the trigger is the split write, not the boundary length.

eevan7a9/real-estate-management#107: the lock change is three entries, not one: the bump plus npm 11 dropping peer true from acorn and eslint, versions unchanged.

marklogic/node-client-api#1129: package.json pins "@fastify/busboy": "3.2.0" with no range; .npmrc's min-release-age=14 was bypassed for the 9-day 3.2.4 with --min-release-age=0.

marklogic/node-client-api#1129: the manifest moved with the lock: npm refused it with EUSAGE, "lock file's @fastify/busboy@3.2.4 does not satisfy @fastify/busboy@3.2.0".

marklogic/node-client-api#1129: a Module._load hook logged it loading at require time, before any request, with a positive control that fires and a negative control that does not.

marklogic/node-client-api#1129: a __proto__ part header rejected a legitimate response on 3.2.0 in 100 ms with the parser's own TypeError, and resolved in 106 ms on 3.2.4.

marklogic/node-client-api#1129: a 252-byte boundary split 20,625 + 150 ms + 4,262 hung 3.2.0: killed at 5,000 ms, 4.62 s CPU, heartbeat stopped 202.47 ms, against 230 ms on 3.2.4.

marklogic/node-client-api#1129: the same bytes in one write resolved on both, so the trigger is fragmentation, not the boundary length.

marklogic/node-client-api#1129: the body is a response, so the server or an intermediary owns the boundary; the row claims a mock-server consequence, not a deployed compromise.

CyborgTests/playwright-reports-server#217: busboy is in no package.json here; it arrives only as @fastify/multipart 10.0.0's own ^3.0.0 dependency, so the lock is its only home.

CyborgTests/playwright-reports-server#217: the lock change is three sites, not one: the packages entry, the snapshots key and the @fastify/multipart dependency edge, 8 lines +4/-4.

CyborgTests/playwright-reports-server#217: the snapshots key is provably mandatory: left at 3.2.0, pnpm install --frozen-lockfile fails with ERR_PNPM_LOCKFILE_MISSING_DEPENDENCY.

CyborgTests/playwright-reports-server#217: a Module._load hook logged the parser before the listening line, with a positive control that fires and a negative control that does not.

CyborgTests/playwright-reports-server#217: through POST /api/report/upload: __proto__ header 500 in 6.90 ms to 200 in 18.82 ms; CRLF filename 200 stored to 400 skipped.

CyborgTests/playwright-reports-server#217: a 252-byte boundary split over two writes never answered: client 6,002 ms, GET /api/ping 4,000 ms, 8.56 s CPU, against 500 in 155.25 ms.

CyborgTests/playwright-reports-server#217: both boundary rows return 500: the patch fixes the hang, not the synthetic body, so a 6-second stuck-process hang becomes a 155 ms error.

the 3.2.4 integrity was verified two ways: the locally computed sha512 equals dist.integrity, and one changed character fails install with ERR_PNPM_TARBALL_INTEGRITY.

the pnpm gate ran on Node 24: --frozen-lockfile on Node 26 exits 1 with ERR_PNPM_UNSUPPORTED_ENGINE because better-sqlite3 caps at 25.

the lock-shape rule was skipped here: check-packet-shape.mjs recognises only package-lock.json, so the install exit code and the snapshots-key proof carry the guarantee.

xiongsircool/aurora-rss-reader#17: the parser is transitive through @fastify/multipart 8.3.1 and declared in no package.json, so the lock is its only home.

xiongsircool/aurora-rss-reader#17: POST /api/opml/import has no preHandler, onRequest or preValidation hook, so the body is parsed before any application check.

xiongsircool/aurora-rss-reader#17: the server registers no auth hook, so a multipart body from any reachable client reaches the parser unauthenticated.

xiongsircool/aurora-rss-reader#17: a Module._load hook logged the parser before the listening line, with a positive control that fires and a negative control that does not.

xiongsircool/aurora-rss-reader#17: a __proto__ part header made 3.2.0 close the connection and exit in 15.56 ms (TypeError at HeaderParser.js:95) against 200 in 29.55 ms on 3.2.4.

xiongsircool/aurora-rss-reader#17: a 252-byte boundary split across two writes left 3.2.0 with no response and 9.78 s of CPU before SIGKILL, against 200 in 179 ms on 3.2.4.

xiongsircool/aurora-rss-reader#17: the handler never reads data.filename, so the CRLF difference on this route is 200-stored versus 400-skipped, not an injection.

the committed aurora-rss-reader lock was stale: pnpm install --frozen-lockfile fails on main with ERR_PNPM_OUTDATED_LOCKFILE, so the pull request refreshes it before moving busboy.

the true diff is 158 lock entries, +678/-11, not a one-line bump: five declared dependencies were never locked and better-sqlite3 drifted ^9.4.0 to ^12.6.2.

both boundary arms use a synthetic multipart body, not a real OPML export, so the hang and the exit are parser behaviour, not a claim about a real export.

this row is the first built under the hunt's reachability kill gate, which refuses a packet that cannot name a (route, request) pair in the repository's own code.

tranhuongk/tranhuongk.github.io#3: a dependency bump for five published advisories, all fixed in 1.4.1, not a finding of ours.

tranhuongk/tranhuongk.github.io#3: the 18-byte interleave arm threw an uncaught TypeError: Cannot set properties of null (setting 'ready') on 1.4.0, nothing on 1.4.2.

tranhuongk/tranhuongk.github.io#3: 5,000 eight-byte heartbeat records in one chunk threw an uncaught RangeError: Maximum call stack size exceeded on 1.4.0, nothing on 1.4.2.

tranhuongk/tranhuongk.github.io#3: both arms exit 1 in a standalone Node process on 1.4.0 and exit 0 on 1.4.2.

santhosh101066/stalker-m3u-server#6: a dependency bump for a published advisory, not a finding of ours.

santhosh101066/stalker-m3u-server#6: a 256 KiB part header with no = blocked the event loop 66,282 ms on 6.0.0 and 7.12 ms on 6.0.3.

santhosh101066/stalker-m3u-server#6: 64 KiB costs 3,781-6,007 ms on 6.0.0 and 2.16-5.10 ms on 6.0.3, while the same run with = costs about 2 ms on both.

santhosh101066/stalker-m3u-server#6: the route 401 lands only after parsing, 3,358 ms on 6.0.0 against 3.95 ms on 6.0.3.

TaitoUnited/full-stack-template#225: a dependency bump for a published advisory, not a finding of ours.

TaitoUnited/full-stack-template#225: a 394,240-byte query of 40,000 distinct percent-encoded runs blocked the event loop 7,730-8,221 ms on 0.5.0 and 6.7-8.3 ms on 0.5.1.

TaitoUnited/full-stack-template#225: 194 KB costs 2,319-2,411 ms on 0.5.0 and 3.2-3.9 ms on 0.5.1, while the same bytes as one repeated run cost single-digit ms on both.

TaitoUnited/full-stack-template#225: the route 401 lands only after parsing, 3,108 ms on 0.5.0 against 5.8 ms on 0.5.1.

mrmps/classifier-dev#160: a dependency bump for a published advisory, not a finding of ours.

mrmps/classifier-dev#160: the advisory's first patched version is 1.6.8, where the array-length fix landed; this pull request moves to 1.7.6 because that is current latest.

mrmps/classifier-dev#160: a 51-byte JSON body declaring a 4,294,967,295-element array blocked the event loop 28,706 ms on 1.6.7 and 0.05 ms on 1.7.6.

mrmps/classifier-dev#160: the same decoder answered a 2.3 MB honest request in 8.8 ms, so the 51-byte request costs 3,281 times as much.

mrmps/classifier-dev#160: the route is POST /_server/ followed by the server-function id, with Content-Type: application/json and no credential.

mrmps/classifier-dev#160: the server-function id is public in the client bundle, and the declared length is a number the sender writes, not bytes it must send.

allohamora/weather-subscription#7: a dependency bump for two published critical advisories, not a finding of ours.

allohamora/weather-subscription#7: with JWT_SECRET empty, a token signed with the empty HMAC key verified on 6.0.1, and 6.2.4 rejects it with FAST_JWT_INVALID_KEY.

allohamora/weather-subscription#7: a key with a # or zero-width leading byte stayed an HMAC secret on 6.0.1 and 6.2.4 and verified a token signed with that same prefix.

allohamora/weather-subscription#7: only 6.3.0 rejected the prefixed-key token, so the lock moves past the first fix to the release that clears both advisories.

allohamora/weather-subscription#7: an absent JWT_SECRET throws at startup, and .env.example ships a real secret, so the empty value is a misconfiguration.

allohamora/weather-subscription#7: the route is GET /api/confirm/{token}, and the write is a subscription for the email and city inside the token, not an account takeover.

allohamora/weather-subscription#7: a wrong-secret token was rejected on every version, and a real RS256 round trip still verifies on 6.3.0.

arodus/signalk-mcp#53: a dependency bump for a published advisory, not a finding of ours.

arodus/signalk-mcp#53: exact pins move signalk-server, @signalk/server-api and the bundled @signalk/resources-provider 1.5.2 to 1.5.3.

arodus/signalk-mcp#53: a path traversal on the notes route answered 200 with a 512-hex secretKey on 2.33.0 and 400 on 2.34.0.

arodus/signalk-mcp#53: a token signed HS256 with that key answered userLevel admin from GET /skServer/loginStatus.

arodus/signalk-mcp#53: a type Execute provider posted to /skServer/providers ran a command, so the traversal ends in code execution (the marker read uid=501).

arodus/signalk-mcp#53: the anonymous read needs allow_readonly=true, which the repository's own harness sets.

arodus/signalk-mcp#53: signalk-server is a devDependency here, so the plugin ships no server, and the JWT arm used a production-shaped security.json.

slokesh2905/tracklet#1: a dependency bump for a published advisory, not a finding of ours.

slokesh2905/tracklet#1: the app mounts better-auth's handler at app/api/auth/[...all]/route.ts:4 and builds the instance at lib/auth.ts:29-64.

slokesh2905/tracklet#1: lib/auth.ts:49-60 registers Magic Link with the default plain token store beside the Google and GitHub providers at lib/auth.ts:42.

slokesh2905/tracklet#1: on 1.7.6 the OAuth state from /api/auth/sign-in/social answered /api/auth/magic-link/verify as a Magic Link and returned 200 with the victim's session.

slokesh2905/tracklet#1: 1.7.7 answers the same replay 302 INVALID_TOKEN with no cookie, stores the two identifiers as auth-state: and magic-link:, and the session read is null.

slokesh2905/tracklet#1: the sign-up variant creates the named address with emailVerified true and signs the caller in, with no mailbox read, OAuth callback or user action.

slokesh2905/tracklet#1: the address is named in additionalData, which the app's own dialog does not send, and pending Magic Links and OAuth states do not survive the upgrade.

instana/synthetic-api-script#23: a dependency bump for four published critical advisories, not a finding of ours.

instana/synthetic-api-script#23: bin/script-cli:152 reads the operator's script and lib/executeScript.js:179-180 construct and run the NodeVM.

instana/synthetic-api-script#23: lib/executeScript.js:148 sets console:inherit, handing the host console stream chain into the sandbox.

instana/synthetic-api-script#23: on 3.9.19 the payload walked EventEmitter, Socket, Duplex, Readable and Stream to the host EventEmitter and replaced emit.

instana/synthetic-api-script#23: it ran as the host process, read a host-only env value and ran id -u through the host child_process (501), and the host listener never ran.

instana/synthetic-api-script#23: on 3.12.2 the same payload throws TypeError: hostProtoGetter.call is not a function before installing anything, and the host listener runs.

instana/synthetic-api-script#23: the other published ranges are cleared by the version and were not demonstrated; the lockfile bump leaves the package.json range alone.

ronaldoqj/AlternativaDigital-SindicatoPortoAlegre-Site#73: a dependency bump for published advisories, not a finding of ours.

ronaldoqj/AlternativaDigital-SindicatoPortoAlegre-Site#73: the article route copies the URL title into four meta tags in the app's root component.

ronaldoqj/AlternativaDigital-SindicatoPortoAlegre-Site#73: on 2.18.6 getHead writes them into meta content attributes unescaped, so the title is markup in the served head.

ronaldoqj/AlternativaDigital-SindicatoPortoAlegre-Site#73: its own ssr build and the built server entry served four literal img elements on 2.18.6 and none on 2.32.2.

ronaldoqj/AlternativaDigital-SindicatoPortoAlegre-Site#73: a browser on the same article URL set document.title to XSS-EXECUTED on 2.18.6 and left it unchanged on 2.32.2.

ronaldoqj/AlternativaDigital-SindicatoPortoAlegre-Site#73: the deployed production site was read once, unauthenticated, and still served the injected element.

ronaldoqj/AlternativaDigital-SindicatoPortoAlegre-Site#73: 2.32.2, not 2.22.0, which leaves a high and a low advisory open, is the first release outside all four.

sushiibot/sushii-image-server#25: a dependency bump for a published critical advisory, not a finding of ours.

sushiibot/sushii-image-server#25: the POST /template handler reads templateHtml from the JSON body.

sushiibot/sushii-image-server#25: the handler passes that value to Handlebars.compile() with only a truthiness guard.

sushiibot/sushii-image-server#25: on 4.7.7 an AST object whose Program.blockParams is {"length":"(js)"} is compiled and the expression runs in the server process.

sushiibot/sushii-image-server#25: the expression wrote a marker carrying that server's uid, pid and cwd, and the advisory's proof of concept raised its own error inside the server.

sushiibot/sushii-image-server#25: on 4.7.10 the same AST is rejected at validateBlockParams before any code is generated and no marker is written.

sushiibot/sushii-image-server#25: the repository's jest suite passes 6/6 on both arms, and package.json's ^4.7.7 range already admits 4.7.10.

LucaSain/prodeprod-web#1: a dependency bump for a published advisory, not a finding of ours.

LucaSain/prodeprod-web#1: the repo mounts formBuilderPlugin in its payload config, and its form block posts to /api/form-submissions.

LucaSain/prodeprod-web#1: one unauthenticated post carrying a dotted __proto__ key in the submissionData push object wrote that key onto the server process's Object.prototype.

LucaSain/prodeprod-web#1: the own-property count on Object.prototype went 12 to 13, read back through a SIGUSR2 preload.

LucaSain/prodeprod-web#1: the next unrelated public GET /api/forms answered 500 inside Payload's join sanitizer.

LucaSain/prodeprod-web#1: on 3.90.0 the same request answers 400 before any write and the own-property count stays 12.

LucaSain/prodeprod-web#1: the write is prototype pollution, CWE-1321, and the code execution the advisory records, CWE-94, was not reproduced.

Hypenexy/WriteNote#1: a dependency bump for a published advisory and the repository's first pull request, not a finding of ours.

Hypenexy/WriteNote#1: the socket handler at Server/code/user/userProtocols.js:6 dispatches to notes.protocol at :408 and then saveNote.

Hypenexy/WriteNote#1: saveNote at Server/code/user/notes.js:331 passes the client's note body to gitDiff beside the last saved content.

Hypenexy/WriteNote#1: git-diff 2.0.6 built a printf command from that string and ran it through shelljs.exec, so the shell ran the note body.

Hypenexy/WriteNote#1: a note body that ran id -u into a marker file executed, and the marker held 501, the Node process uid.

Hypenexy/WriteNote#1: the diff line came back empty on 2.0.6 because the prompt subshell consumed it, and each arm ran twice.

Hypenexy/WriteNote#1: on 2.0.7 no marker is created and the line stays literal, because the release calls execFileSync with an argv and runs no shell.

yumdocs/yumdocs#4: a dependency bump for a published advisory and the repository's first pull request, not a finding of ours.

yumdocs/yumdocs#4: render() reaches loadParts, which parses each part with the library.

yumdocs/yumdocs#4: 0.9.8 deduplicated attributes quadratically, calling the linear getNamedItemNS scan for every attribute setNamedItem receives.

yumdocs/yumdocs#4: through the repository's own load and render on real .docx files, 40,000 attributes on one element cost a median 2,324.0 ms on 0.9.8.

yumdocs/yumdocs#4: the same 40,000 attributes cost 42.0 ms on 0.9.12, and 10,000 cost 175.1 ms against 14.7 ms.

yumdocs/yumdocs#4: 8x the attributes cost 53.3x the time on 0.9.8 against 3.8x linear, and the repository's own tests pass 18 of 18 on both arms.

yumdocs/yumdocs#4: the patch moves package-lock.json alone, three lines in and three out, and the row reads open waiting on its maintainer.

Codehagen/HagenKit#4: a dependency bump for published advisories, not a finding of ours.

Codehagen/HagenKit#4: the patch moves next 16.0.3 to 16.4.1 in the manifest and the lockfile, two files, and carries sharp 0.34.5 to 0.35.5.

Codehagen/HagenKit#4: proxy.ts:38 does not match /_next/image, and next.config.ts:14 admits *.vercel.app, so an attacker Vercel origin serves the buffer.

Codehagen/HagenKit#4: on 16.0.3 with sharp 0.34.5 one request for the published payload crashed the server: curl exit 52, exit 134, librsvg panicking on a slice range of 316.

Codehagen/HagenKit#4: on 16.4.1 with sharp 0.35.5 the same request answers 200 image/jpeg, 333 bytes, and the server stays alive.

Codehagen/HagenKit#4: the fix commit's AVIF oracle separates 16.0.3 from 16.3.3 but not 16.4.1, which re-enables the AVIF loader, so the crash is the discriminator at 16.4.1.

Codehagen/HagenKit#4: no remote code execution is claimed.

vercel/chatbot#1559: a dependency bump for published advisories; the crash is a denial of service; the CRITICAL rating is the advisories', and no remote code execution is claimed.

vercel/chatbot#1559: next moves 16.2.10 to 16.4.1 and sharp 0.34.5 to 0.35.5; experimental.appNewScrollHandler at next.config.ts:27 is dropped as 16.4.1 rejects it.

vercel/chatbot#1559: next.config.ts:33-43 admits avatar.vercel.sh and *.public.blob.vercel-storage.com, and the proxy config excludes /_next/image while the app has no middleware.

vercel/chatbot#1559: with no cookie, GET / answers 307 to /api/auth/guest while the optimizer answers 200 image/png for a plain 116-byte PNG on both pins.

vercel/chatbot#1559: plain and whitespace-prefixed SVG answer 400 at 54 bytes on both pins, and a padded SVG answers 400 at 54 bytes against 43 bytes on 16.4.1.

vercel/chatbot#1559: on 16.2.10 the published payload sends no bytes: curl exit 52, container exit 134, librsvg panicking on a slice of length 316, three of three containers.

vercel/chatbot#1559: on 16.4.1 the same payload answers 200 image/jpeg at 333 bytes with the server alive, and the second AVIF payload answers 200 at 321 bytes on both pins.

chakra-ui/chakra-ui#11054: a dependency bump for a published advisory and a first pull request, not a finding of ours; the claim is cross-origin framing, never code execution.

chakra-ui/chakra-ui#11054: the patch moves storybook 10.4.2 to 10.6.2 in the root and sandbox/storybook-ts manifests and the regenerated lockfile.

chakra-ui/chakra-ui#11054: both arms ran this repository's own storybook config, react-vite with no refs or security section, through the package.json dev script on port 6006.

chakra-ui/chakra-ui#11054: GET / answered 200 with no Content-Security-Policy and no X-Frame-Options on 10.4.2, and iframe.html answered 200 with no CSP.

chakra-ui/chakra-ui#11054: on 10.6.2 both routes answer 200 with frame-ancestors 'self' http://localhost:* http://*.localhost:* http://127.0.0.1:*.

chakra-ui/chakra-ui#11054: a page at http://192.168.1.191:8099 iframing http://localhost:6006/ loaded the manager on 10.4.2 and was blocked on 10.6.2.

chakra-ui/chakra-ui#11054: the loopback control at http://127.0.0.1:8099 loaded on both pins, because the policy allows it.

zai-org/Synapse#16: a dependency bump, not a finding of ours; both arms ran the repository's own better-auth module over HTTP against its own schema on PostgreSQL 17.9.

zai-org/Synapse#16: GET /device, the call the approval screen makes, answered 200 with 2 keys ["status","user_code"] on 1.6.13, no client and no scope.

zai-org/Synapse#16: on 1.7.7 the same request answered 200 with 4 keys, adding "client_id":"synapse-web" and "scope":"openid profile".

zai-org/Synapse#16: that is the advisory's own remediation, the approval page now given the requesting client and the permissions it asks for.

zai-org/Synapse#16: POST /device/approve and POST /device/token answered 200 with the same shape on both pins, so only the approval GET differs.

zai-org/Synapse#16: the root lock comparison checked 60 of 121 changed entries (9 MATCH, 51 ABSENT-BUT-NONE, 0 STALE), 61 past the fetch cap and never compared.

zai-org/Synapse#16: the three other advisories from the same 2026-10-27 batch are not claimed; none is reachable, with no magicLink, no oAuthProxy and Kysely rather than drizzle.

telsioisidoro786-crypton/BiscateAO#2: a dependency bump for a published critical advisory and the repository's first pull request, not a finding of ours.

telsioisidoro786-crypton/BiscateAO#2: the lockfile moves @tanstack/react-start 1.168.57 to 1.168.60, carrying @tanstack/start-server-core 1.169.37 to 1.169.39.

telsioisidoro786-crypton/BiscateAO#2: GET /_serverFn/<loadProfessional> answered 500 {"status":500,"unhandled":true,"message":"HTTPError"} on 1.169.37.

telsioisidoro786-crypton/BiscateAO#2: on 1.169.39 the same request answered 200 with a seroval-serialized {result, error, context}.

telsioisidoro786-crypton/BiscateAO#2: the advisory fires only when a server function returns undefined, and none of its 39 createServerFn handlers does, so the row is a code read.

telsioisidoro786-crypton/BiscateAO#2: the reflected XSS was not observed through this repository's own handlers, and the request needed one handler added to a lab copy.

telsioisidoro786-crypton/BiscateAO#2: a lab handler answered 39 bytes of text/html, body exactly <script>alert(document.domain)</script> on 1.169.37, 500 on 1.169.39.

cerulean85/cogfeed#1: a dependency bump for a published advisory and the repository's first pull request, not a finding of ours.

cerulean85/cogfeed#1: the patch moves @sentry/nextjs 10.49.0 to 10.75.2 in package.json and the regenerated package-lock.json.

cerulean85/cogfeed#1: both arms built this repository at its base commit with npx next build --webpack and ran next start, one server at a time.

cerulean85/cogfeed#1: an unauthenticated GET /monitoring answered 307 to / on 10.49.0, so the catch-all route ran and the middleware did not.

cerulean85/cogfeed#1: on 10.75.2 the same request answered 307 to /login?callbackUrl=%2Fmonitoring, the middleware's own gate.

cerulean85/cogfeed#1: GET /dashboard and an unknown path answered 307 to /login on both arms, so the gate works and the tunnel path is the only one skipped.

cerulean85/cogfeed#1: the skipped login redirect is the measured claim; no data disclosure, because the catch-all route renders nothing.

zai-org/Synapse#17: a dependency bump, not a finding of ours; the mobile app is a standalone install root with its own lock, so it moves separately from the API change.

zai-org/Synapse#17: the approval screen's call, GET /device, answered 200 with 2 keys ["status","user_code"] on 1.6.13, no client and no scope.

zai-org/Synapse#17: on 1.7.7 the same request answered 200 with 4 keys, adding "client_id":"synapse-web" and "scope":"openid profile".

zai-org/Synapse#17: the screen renders those two fields and keeps approval disabled until client_id is present, so on a 1.6.13 server it fails closed rather than approving blind.

zai-org/Synapse#17: the screen change is typechecked and linted, not rendered; no simulator was launched, so the Expo UI itself is unmeasured.

zai-org/Synapse#17: npm ci --ignore-scripts exited 0 with better-auth 1.7.7, npx tsc --noEmit exited 0, and eslint on the four changed files exited 0.

vas3k/TaxHacker#203: a dependency bump for a published advisory, not a finding of ours; package.json and the lockfile move zod, and no app source does.

vas3k/TaxHacker#203: on 3.25.76 a 50,000-element scope body answered 400 in 0.182 s, with a 1,738,928-byte response and +59.6 MiB peak RSS.

vas3k/TaxHacker#203: 4.6.6 is the advisory's fixed floor and lowers the per-issue overhead, but it does not remove the per-element echo.

vas3k/TaxHacker#203: the echo survives because better-auth's sign-in route parses a scopes array with no .max(), a schema this repository cannot edit.

NXY666/Jsjiemi#106: a vm2 bump for a published critical advisory and the repository's first pull request, not a finding of ours, and its pull request page now answers 404.

NXY666/Jsjiemi#106: Buffer.from([0]).buffer.byteLength reads 65600 on 3.9.19 and 1 on 3.11.7.

NXY666/Jsjiemi#106: a host secret seeded into the shared pool appeared in the app's own output file only on 3.9.19.

NXY666/Jsjiemi#106: view.fill(0x41) corrupted 64 of 64 host buffers on 3.9.19 and 0 of 64 on 3.11.7.

NXY666/Jsjiemi#106: the repository has no tests and no typecheck, so no test or typecheck pass is claimed.

NXY666/Jsjiemi#106: one virtualEval sink was driven end to end, and no code execution is claimed.

MervinPraison/PraisonAIUI#321: a lockfile bump for a published advisory, not a finding of ours; the manifest's ^0.10.0 range already admitted 0.10.2, so only the lock moves.

MervinPraison/PraisonAIUI#321: the fix is library-level, because at this commit the app's own render path never reaches a clickable Button, so the row claims no clickable exploit.

MervinPraison/PraisonAIUI#321: all 8 invalid URL cases reached window.open on 0.10.0 and 0 of 8 on 0.10.2; the 7 valid cases open on both arms.

MervinPraison/PraisonAIUI#321: only 0.10.2 resolves a valid URL and passes noopener,noreferrer; 0.10.0 hands the raw string to window.open.

MervinPraison/PraisonAIUI#321: both versions were installed and the maintainer's own test table ran against each; no browser ran, so the observable is the window.open argument.

vritti-ai-platforms/vritti-core#5: a dependency bump for a published advisory, not a finding of ours; the lock and the generator's version pin both move payload to 3.90.0.

vritti-ai-platforms/vritti-core#5: duplicating an entry copied fields whose create access was denied to the requester; 3.90.0 stops the copy.

vritti-ai-platforms/vritti-core#5: the fix is library-level; both app auth collections declare create: isStaff and no field restricts create, so the copy path is unreachable here.

vritti-ai-platforms/vritti-core#5: the bypass was reproduced against the fix commit's own Auth fixture, not through this app's config.

vritti-ai-platforms/vritti-core#5: POST /<authCollection>/<id>/duplicate copies roles: ["admin"] on 3.88.0 and leaves ["user"] on 3.90.0.

vritti-ai-platforms/vritti-core#5: login as the duplicate answered 200 on 3.88.0 and 403 on 3.90.0; both versions were installed and the probe used Payload's own REST router.

vritti-ai-platforms/vritti-core#5: the row reads open as its pull request page answered on 2026-11-01 15:09 utc, after the record's last state sweep.

WXYC/website#275: a dependency bump for a published advisory, not a finding of ours; only the lockfile moves tinacms 3.11.0 to 3.14.0.

WXYC/website#275: the base admin bundle carries the URL-derived anchor once, and the fixed bundle carries offOrigin six times with zero URL-derived anchors.

WXYC/website#275: the frame URL and the trust anchor were measured in Node, not in a browser, so the postMessage round-trip against a live TinaCloud token was not run.

WXYC/website#275: the admin was built with dummy credentials and --skip-cloud-checks, so no live-cloud behavior is claimed.

petadex/iGEM_wiki#138: a dependency bump for a published advisory, not a finding of ours; the lockfile and the version pins both move payload to 3.90.0.

petadex/iGEM_wiki#138: the app's own Users collection declares auth: true with no access block, so Payload's default create admits any signed-in user.

petadex/iGEM_wiki#138: a duplicate carried the source resetPasswordToken and resetPasswordExpiration, and the copy logged in with the password set on it on 3.84.1.

petadex/iGEM_wiki#138: the probe ran in-process against the sqlite adapter, not Postgres; no browser was driven and the Vercel build was not run.

petadex/iGEM_wiki#138: the row reads open as its pull request page answered on 2026-11-01 15:45 utc.

back to security

microsoft/winget-pkgs#456471 was closed unmerged on 2026-10-26 18:10:02 utc.

aakarim/OpenLore#71 was closed unmerged on 2026-09-04 22:59:14 utc.

jaw9c/awesome-remote-mcp-servers#704 was closed unmerged on 2026-11-02 14:51:35 utc.

punkpeye/awesome-mcp-servers#13404 was closed unmerged on 2026-10-08 09:11:12 utc.

UsefulSoftwareCo/executor#1874 was closed unmerged on 2026-10-08 23:23:25 utc.

UsefulSoftwareCo/executor#1873 was closed unmerged on 2026-10-08 23:23:27 utc.

node-formidable/formidable#1113: the octet-stream plugin bypassed _handlePart, where maxFileSize and maxTotalFileSize are enforced.

node-formidable/formidable#1113: EZO did not open this pull request; its contribution is a comment posted 2026-11-03 03:38:00 utc, the instant this row carries.

drtshock/PlayerVaults#74 was closed unmerged on 2015-05-26 02:06:48 utc.

convex/better-auth#456 was closed unmerged on 2026-11-04 04:04:09 utc; the maintainer's own #457 had merged the better-auth 1.7.16 support.

aplaceforallmystuff/mcp-arr#65: closed unmerged on 2026-11-08; main already carried the change at 2026-11-08 17:42:19 utc (commit e375b9b).

LoredCast/filewizard#30 was closed unmerged on 2026-11-08 18:59:44 utc: the read answered closed with no merge, and no fix is recorded.

TrackGeek/api#110 was closed unmerged on 2026-11-07 17:45:00 utc: the read answered closed with no merge, and no fix is recorded.

matijakolaric-com/django-music-publisher#70 was closed unmerged on 2026-11-08 16:06:31 utc: the read answered closed with no merge, and no fix is recorded.

MadestSamurai/Dustweave#16 was closed unmerged on 2026-11-10 16:34:49 utc: the read answered closed with no merge, and no fix is recorded.

biisal/portfolio#2 was closed unmerged on 2026-11-10 05:18:23 utc: the read answered closed with no merge, and no fix is recorded.

curvefi/curve-assets#1118 was closed unmerged on 2026-11-10 06:26:08 utc: the read answered closed with no merge, and no fix is recorded.

aplaceforallmystuff/mcp-arr#65 was closed unmerged on 2026-11-08 19:09:02 utc: the read answered closed with no merge, and no fix is recorded.

issues are counted apart from the pull requests and move none of the record's counts.

ljharb/qs#643: reproduced on 6.17.1, where parse('a.b=c', { decodeDotInKeys: true, allowDots: false }) answered {'a.b': 'c'} instead of erroring.

ljharb/qs#643: on the same tree, stringify({'a.b': 'c'}, { encodeDotInKeys: true, allowDots: false }) answered 'a%252Eb=c', also instead of erroring.

ljharb/qs#643: the trigger is allowDots as an own property with a falsy value; false and 0 behave the same, and any other shape is unaffected.

ljharb/qs#643: the pair is option normalisation, so the input string makes no difference to whether either call errors.

ljharb/qs#643: the repository's own test named 'with allowDots false and encodeDotInKeys true' pins the non-throwing output, so the library behaviour is deliberate and covered.

ljharb/qs#643: the README sentences arrived in the same commit that added the options, 2024-01-28, and both are still on main, so the documented error was never implemented.

ljharb/qs#643: the stringify sentence names decodeDotInKeys, but the option stringify reads is encodeDotInKeys, a wrong name that stands whichever way the error question goes.

yargs/yargs-parser#566: reproduced on 22.0.0, where parser(['-b', '--', 'x']) answered b: '--' and put x in the positional list.

yargs/yargs-parser#566: only the short-option scalar branch consumes the marker; the long-option, array and narg paths do not.

yargs/yargs-parser#566: twelve tests were added to the repository's own suite; four failed on 22.0.0, which is how the defect was measured.

yargs/yargs-parser#566: no pull request exists or is permitted without an invitation; CONTRIBUTING.md asks for one only by maintainer invitation.

dexie/Dexie.js#2364: reproduced on dexie 4.4.7 with fake-indexeddb 6.2.4; the first upsert resolved false and the second true, and the row held the second name.

dexie/Dexie.js#2364: the table implementation returns !!existing and the published bundle ships the same expression; the method arrived in #2203.

dexie/Dexie.js#2364: the issue claims no confidentiality, integrity or availability consequence, and no fix, acceptance or release.

dexie/Dexie.js#2364: the issue asks which side is authoritative instead of choosing, because a code repair would be a breaking change.