The shipped dependency version matches a published advisory, but the supplied evidence does not show that vulnerable behavior is reachable with attacker-controlled content in this application.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-55q2-fjhq-7xh7:pkg:2fd628b415ad04f802a2d1cc to a dependency declared by this repository.
Contextual assessment: The lockfile resolves dompurify 3.4.11 and the scanner reports an advisory. No application call sites, vulnerable feature details, input path, or runtime reachability are supplied, so concrete exposure is not demonstrated.
Impact: low · Exploitability: plausible
Developer action: Update dompurify to a non-vulnerable release and retest any HTML sanitization flows.
A build-related package is flagged, but the evidence does not show that users can trigger the vulnerable code during normal operation.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-fxqj-rqcc-2cmp:pkg:48f7fae3c8c125b98852d2a2 to a dependency declared by this repository.
Contextual assessment: The scanner identifies postcss 8.5.16 in the lockfile. The supplied material does not establish whether it is a production runtime dependency, which code path uses it, or whether attacker-controlled input reaches the advisory condition.
Impact: low · Exploitability: unlikely
Developer action: Update postcss to a non-vulnerable release and rebuild the frontend.
The same HTML-sanitizing dependency is associated with another advisory, but no exploitable application path is shown.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-c2j3-45gr-mqc4:pkg:3a617860720e33c3832a83a7 to a dependency declared by this repository.
Contextual assessment: The lockfile resolves dompurify 3.4.11 and the scanner reports a second advisory. Advisory matching alone does not establish reachable vulnerable behavior or a concrete attacker-controlled input path.
Impact: low · Exploitability: plausible
Developer action: Update dompurify to a non-vulnerable release and retest any HTML sanitization flows.
A vulnerable version is present in the dependency graph, but the evidence does not show that the affected function is used with unsafe input.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-2v37-7h3g-55p8:pkg:bcb01fa3f22fe943388f7142 to a dependency declared by this repository.
Contextual assessment: The scanner identifies nanoid 3.3.15. No dependency path, call site, advisory behavior, input source, or executable activation is supplied, so the reported match is not demonstrated exposure.
Impact: low · Exploitability: unlikely
Developer action: Update nanoid to a non-vulnerable release and regenerate the lockfile.
Another advisory matches the same dependency version, but no concrete application exposure is shown.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-28wg-ghj8-5hjv:pkg:590275f7f1e65a0bda08b540 to a dependency declared by this repository.
Contextual assessment: The scanner identifies nanoid 3.3.15 with a high scanner severity. The evidence does not establish reachable vulnerable code, attacker-controlled input, or a triggering execution path.
Impact: low · Exploitability: unlikely
Developer action: Update nanoid to a non-vulnerable release and regenerate the lockfile.
The supplied file appears to be tokenizer data, not startup code. The scan result does not show that it changes startup settings or runs commands.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification in this repository.
Contextual assessment: The production artifact is a JSON tokenizer vocabulary and configuration record. Supplied excerpts show serialized tokenizer metadata and vocabulary entries, with no executable startup logic, persistence API, filesystem modification, process launch, or activation path. The scanner match is reported without source excerpts, so the alleged persistence behavior is not demonstrated by this evidence.
This is a local development proxy that forwards the frontend's API requests to the locally running application server. It does not show an external destination or sensitive-data collection.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The supplied source shows a Vite development-server proxy for the /api path targeting loopback address 127.0.0.1 on port 8080. This matches the documented local frontend and backend workflow; no attacker-controlled destination, credential access, or persistence is shown.
The flagged setting makes the local development server listen only on the computer itself. It reduces network exposure rather than creating an external connection.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The supplied source configures the development server host as 127.0.0.1. This is loopback-only binding and is consistent with the documented local application usage; it does not demonstrate network exfiltration or unintended exposure.