What this review found
No material or immediate-danger item was identified.
Minor cautions
Dependency advisory GHSA-5xrq-8626-4rwp applies
Minor caution · medium confidence
The flagged library is part of the project's testing tools, not the actual extension that users install. The security issue is real but only matters when running tests, not when using VectFox in SillyTavern.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-5xrq-8626-4rwp to a dependency declared by this repository.
Contextual assessment: This advisory matches a dependency declared in a file whose root project (vectfox-tests) lists only devDependencies. The visible lockfile entries are all marked dev: true, indicating test-scope tooling such as Playwright, Vitest, and jsdom. The vulnerable package is not part of the production extension runtime; it is used only during local development and CI testing. Runtime reachability into end-user-facing code is therefore absent.
Impact: low · Exploitability: unlikely
Developer action: Update the affected dev dependency to a patched version when convenient; no urgent action required.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-5xrq-8626-4rwp
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-v6wh-96g9-6wx3 applies
Minor caution · medium confidence
The flagged library is used by the project's test suite, not the extension itself. The vulnerability does not affect users who install VectFox.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-v6wh-96g9-6wx3 to a dependency declared by this repository.
Contextual assessment: This medium-severity advisory applies to a package within a test-only lockfile (vectfox-tests) where the root project declares exclusively devDependencies. The dependency is consumed by test infrastructure and is not bundled into or executed by the production extension. Attacker-controlled input reaching the vulnerable code path during testing would require a compromised development environment.
Impact: low · Exploitability: unlikely
Developer action: Bump the dev dependency to a non-vulnerable version when convenient; no urgent action required.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-v6wh-96g9-6wx3
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-25h7-pfq9-p65f applies
Minor caution · medium confidence
The affected library is part of the testing toolchain, not the VectFox extension. Even though the advisory is rated high, it does not impact end users.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-25h7-pfq9-p65f to a dependency declared by this repository.
Contextual assessment: This high-severity advisory matches a transitive dependency of the test toolchain declared in the vectfox-tests lockfile. The root project has only devDependencies, and visible packages carry the dev: true flag. The vulnerable package does not ship with the extension and has no runtime execution path in production. Exploitation would require an attacker to control inputs processed by the test harness itself.
Impact: low · Exploitability: unlikely
Developer action: Update the dev dependency tree to resolve the advisory when convenient; no urgent action required.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-25h7-pfq9-p65f
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-4w7w-66w2-5vf9 applies
Minor caution · medium confidence
The flagged library is used only for testing, not in the extension itself. The vulnerability does not affect users of VectFox.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-4w7w-66w2-5vf9 to a dependency declared by this repository.
Contextual assessment: This medium-severity advisory targets a package in a lockfile whose root project lists only devDependencies. The dependency supports test infrastructure (Playwright, Vitest, jsdom ecosystem) and does not execute in the production extension. No end-user-facing data flow reaches the vulnerable code.
Impact: low · Exploitability: unlikely
Developer action: Update the dev dependency when convenient; no urgent action required.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-4w7w-66w2-5vf9
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-23c5-xmqv-rm74 applies
Minor caution · medium confidence
The affected library is part of the testing setup, not the extension. The vulnerability does not reach users who install VectFox.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-23c5-xmqv-rm74 to a dependency declared by this repository.
Contextual assessment: This high-severity advisory matches a transitive dependency pulled in by test tooling in the vectfox-tests lockfile. All root-level packages are devDependencies and visible entries are marked dev: true. The vulnerable code runs only during development or CI and is absent from the shipped extension bundle.
Impact: low · Exploitability: unlikely
Developer action: Resolve the advisory by updating dev dependencies when convenient; no urgent action required.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-23c5-xmqv-rm74
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-3jxr-9vmj-r5cp applies
Minor caution · medium confidence
The flagged library is part of the project's test tools. It does not ship with VectFox and does not affect users.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-3jxr-9vmj-r5cp to a dependency declared by this repository.
Contextual assessment: This high-severity advisory applies to a dependency within the test-only lockfile. The root project declares exclusively devDependencies and visible packages are flagged dev: true. The package is consumed by test or build tooling and has no production runtime path in the extension.
Impact: low · Exploitability: unlikely
Developer action: Update dev dependencies to patch the advisory when convenient; no urgent action required.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-3jxr-9vmj-r5cp
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-7r86-cg39-jmmj applies
Minor caution · medium confidence
The affected library is used for testing, not in the extension. The vulnerability does not impact VectFox users.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-7r86-cg39-jmmj to a dependency declared by this repository.
Contextual assessment: This high-severity advisory matches a transitive dependency in a test-scope lockfile (vectfox-tests) whose root project contains only devDependencies. The vulnerable code executes during testing only and is not part of the production extension runtime. No user-facing data flow reaches the affected package.
Impact: low · Exploitability: unlikely
Developer action: Bump the dev dependency to a patched version when convenient; no urgent action required.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-7r86-cg39-jmmj
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-6g55-p6wh-862q applies
Minor caution · medium confidence
The flagged library is part of the testing toolchain. It is not included in the VectFox extension and does not affect users.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-6g55-p6wh-862q to a dependency declared by this repository.
Contextual assessment: This high-severity advisory targets a dependency in the vectfox-tests lockfile, which has only devDependencies at the root. The package is part of the test toolchain and is not bundled into or executed by the production extension. Exploitation requires control over inputs processed by the development or CI environment, not the extension runtime.
Impact: low · Exploitability: unlikely
Developer action: Update the dev dependency tree when convenient; no urgent action required.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-6g55-p6wh-862q
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-67mh-4wv8-2f99 applies
Minor caution · medium confidence
The flagged tool is only used by developers for running tests and is not included in the extension that users install, so it does not affect end users.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-67mh-4wv8-2f99 to a dependency declared by this repository.
Contextual assessment: This advisory matches a dependency in a lockfile for a package named vectfox-tests whose root declares only devDependencies. All resolved packages in the visible portion are marked dev true. Test tooling dependencies are not shipped to end users of the SillyTavern extension and have no runtime reachability in production. The advisory severity reflects the library in isolation, not the extension's threat surface.
Impact: low · Exploitability: unlikely
Developer action: Update the affected dev dependency to a patched version when convenient.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-67mh-4wv8-2f99
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-rf6f-7fwh-wjgh applies
Minor caution · medium confidence
The flagged tool is only used by developers for running tests and is not included in the extension that users install, so it does not affect end users.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-rf6f-7fwh-wjgh to a dependency declared by this repository.
Contextual assessment: This advisory matches a dependency in a lockfile for a package named vectfox-tests whose root declares only devDependencies. All resolved packages in the visible portion are marked dev true. Test tooling dependencies are not shipped to end users of the SillyTavern extension and have no runtime reachability in production. The advisory severity reflects the library in isolation, not the extension's threat surface.
Impact: low · Exploitability: unlikely
Developer action: Update the affected dev dependency to a patched version when convenient.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-rf6f-7fwh-wjgh
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-r28c-9q8g-f849 applies
Minor caution · medium confidence
The flagged tool is only used by developers for running tests and is not included in the extension that users install, so it does not affect end users.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-r28c-9q8g-f849 to a dependency declared by this repository.
Contextual assessment: This advisory matches a dependency in a lockfile for a package named vectfox-tests whose root declares only devDependencies. All resolved packages in the visible portion are marked dev true. Test tooling dependencies are not shipped to end users of the SillyTavern extension and have no runtime reachability in production. The advisory severity reflects the library in isolation, not the extension's threat surface.
Impact: low · Exploitability: unlikely
Developer action: Update the affected dev dependency to a patched version when convenient.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-r28c-9q8g-f849
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-3v7f-55p6-f55p applies
Minor caution · medium confidence
The flagged tool is only used by developers for running tests and is not included in the extension that users install, so it does not affect end users.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-3v7f-55p6-f55p to a dependency declared by this repository.
Contextual assessment: This advisory matches a dependency in a lockfile for a package named vectfox-tests whose root declares only devDependencies. All resolved packages in the visible portion are marked dev true. Test tooling dependencies are not shipped to end users of the SillyTavern extension and have no runtime reachability in production. The advisory severity reflects the library in isolation, not the extension's threat surface.
Impact: low · Exploitability: unlikely
Developer action: Update the affected dev dependency to a patched version when convenient.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-3v7f-55p6-f55p
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-mw96-cpmx-2vgc applies
Minor caution · medium confidence
The flagged tool is only used by developers for running tests and is not included in the extension that users install, so it does not affect end users.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-mw96-cpmx-2vgc to a dependency declared by this repository.
Contextual assessment: This advisory matches a dependency in a lockfile for a package named vectfox-tests whose root declares only devDependencies. All resolved packages in the visible portion are marked dev true. Test tooling dependencies are not shipped to end users of the SillyTavern extension and have no runtime reachability in production. The advisory severity reflects the library in isolation, not the extension's threat surface.
Impact: low · Exploitability: unlikely
Developer action: Update the affected dev dependency to a patched version when convenient.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-mw96-cpmx-2vgc
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-f886-m6hf-6m8v applies
Minor caution · medium confidence
The flagged tool is only used by developers for running tests and is not included in the extension that users install, so it does not affect end users.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-f886-m6hf-6m8v to a dependency declared by this repository.
Contextual assessment: This advisory matches a dependency in a lockfile for a package named vectfox-tests whose root declares only devDependencies. All resolved packages in the visible portion are marked dev true. Test tooling dependencies are not shipped to end users of the SillyTavern extension and have no runtime reachability in production. The advisory severity reflects the library in isolation, not the extension's threat surface.
Impact: low · Exploitability: unlikely
Developer action: Update the affected dev dependency to a patched version when convenient.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-f886-m6hf-6m8v
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-qx2v-qp2m-jg93 applies
Minor caution · medium confidence
The flagged tool is only used by developers for running tests and is not included in the extension that users install, so it does not affect end users.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-qx2v-qp2m-jg93 to a dependency declared by this repository.
Contextual assessment: This advisory matches a dependency in a lockfile for a package named vectfox-tests whose root declares only devDependencies. All resolved packages in the visible portion are marked dev true. Test tooling dependencies are not shipped to end users of the SillyTavern extension and have no runtime reachability in production. The advisory severity reflects the library in isolation, not the extension's threat surface.
Impact: low · Exploitability: unlikely
Developer action: Update the affected dev dependency to a patched version when convenient.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-qx2v-qp2m-jg93
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-fxqj-rqcc-2cmp applies
Minor caution · medium confidence
The flagged tool is only used by developers for running tests and is not included in the extension that users install, so it does not affect end users.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-fxqj-rqcc-2cmp to a dependency declared by this repository.
Contextual assessment: This advisory matches a dependency in a lockfile for a package named vectfox-tests whose root declares only devDependencies. All resolved packages in the visible portion are marked dev true. Test tooling dependencies are not shipped to end users of the SillyTavern extension and have no runtime reachability in production. The advisory severity reflects the library in isolation, not the extension's threat surface.
Impact: low · Exploitability: unlikely
Developer action: Update the affected dev dependency to a patched version when convenient.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-fxqj-rqcc-2cmp
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-96hv-2xvq-fx4p applies
Minor caution · high confidence
This is a security warning for a software tool used only during development and testing. It does not affect the final extension that users install and run.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-96hv-2xvq-fx4p to a dependency declared by this repository.
Contextual assessment: The advisory matches a package resolved in the lockfile for the vectfox-tests project. The root project manifest declares only development dependencies for testing frameworks. These packages are not included in the shipped extension and have no runtime reachability for end users. The advisory represents a development environment hygiene issue rather than a production vulnerability.
Impact: none · Exploitability: unlikely
Developer action: Update the affected development dependency to a patched version to keep the development environment secure.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-96hv-2xvq-fx4p
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-3ppc-4f35-3m26 applies
Minor caution · high confidence
This is a security warning for a software tool used only during development and testing. It does not affect the final extension that users install and run.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-3ppc-4f35-3m26 to a dependency declared by this repository.
Contextual assessment: The advisory matches a package resolved in the lockfile for the vectfox-tests project. The root project manifest declares only development dependencies for testing frameworks. These packages are not included in the shipped extension and have no runtime reachability for end users. The advisory represents a development environment hygiene issue rather than a production vulnerability.
Impact: none · Exploitability: unlikely
Developer action: Update the affected development dependency to a patched version to keep the development environment secure.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-3ppc-4f35-3m26
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-mh99-v99m-4gvg applies
Minor caution · high confidence
This is a security warning for a software tool used only during development and testing. It does not affect the final extension that users install and run.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-mh99-v99m-4gvg to a dependency declared by this repository.
Contextual assessment: The advisory matches a package resolved in the lockfile for the vectfox-tests project. The root project manifest declares only development dependencies for testing frameworks. These packages are not included in the shipped extension and have no runtime reachability for end users. The advisory represents a development environment hygiene issue rather than a production vulnerability.
Impact: none · Exploitability: unlikely
Developer action: Update the affected development dependency to a patched version to keep the development environment secure.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-mh99-v99m-4gvg
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-58qx-3vcg-4xpx applies
Minor caution · high confidence
This is a security warning for a software tool used only during development and testing. It does not affect the final extension that users install and run.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-58qx-3vcg-4xpx to a dependency declared by this repository.
Contextual assessment: The advisory matches a package resolved in the lockfile for the vectfox-tests project. The root project manifest declares only development dependencies for testing frameworks. These packages are not included in the shipped extension and have no runtime reachability for end users. The advisory represents a development environment hygiene issue rather than a production vulnerability.
Impact: none · Exploitability: unlikely
Developer action: Update the affected development dependency to a patched version to keep the development environment secure.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-58qx-3vcg-4xpx
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-c2c7-rcm5-vvqj applies
Minor caution · high confidence
This is a security warning for a software tool used only during development and testing. It does not affect the final extension that users install and run.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-c2c7-rcm5-vvqj to a dependency declared by this repository.
Contextual assessment: The advisory matches a package resolved in the lockfile for the vectfox-tests project. The root project manifest declares only development dependencies for testing frameworks. These packages are not included in the shipped extension and have no runtime reachability for end users. The advisory represents a development environment hygiene issue rather than a production vulnerability.
Impact: none · Exploitability: unlikely
Developer action: Update the affected development dependency to a patched version to keep the development environment secure.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-c2c7-rcm5-vvqj
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-rgw5-rvv9-x895 applies
Minor caution · high confidence
This is a security warning for a software tool used only during development and testing. It does not affect the final extension that users install and run.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-rgw5-rvv9-x895 to a dependency declared by this repository.
Contextual assessment: The advisory matches a package resolved in the lockfile for the vectfox-tests project. The root project manifest declares only development dependencies for testing frameworks. These packages are not included in the shipped extension and have no runtime reachability for end users. The advisory represents a development environment hygiene issue rather than a production vulnerability.
Impact: none · Exploitability: unlikely
Developer action: Update the affected development dependency to a patched version to keep the development environment secure.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-rgw5-rvv9-x895
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-fx2h-pf6j-xcff applies
Minor caution · high confidence
This is a security warning for a software tool used only during development and testing. It does not affect the final extension that users install and run.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-fx2h-pf6j-xcff to a dependency declared by this repository.
Contextual assessment: The advisory matches a package resolved in the lockfile for the vectfox-tests project. The root project manifest declares only development dependencies for testing frameworks. These packages are not included in the shipped extension and have no runtime reachability for end users. The advisory represents a development environment hygiene issue rather than a production vulnerability.
Impact: none · Exploitability: unlikely
Developer action: Update the affected development dependency to a patched version to keep the development environment secure.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-fx2h-pf6j-xcff
- File role
- production
- Source
- package-lock.json
Expected scanner matches (0)
None.