What this review found
No material or immediate-danger item was identified.
Minor cautions
Dependency advisory GHSA-g7r4-m6w7-qqqr applies
Minor caution · low confidence
A security scanner found a low-severity issue in a development tool used only to build or test this extension, not in the code that actually runs for users. Because this tool is not part of what gets installed by end users, it is very unlikely to affect anyone using the extension.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-g7r4-m6w7-qqqr to a dependency declared by this repository.
Contextual assessment: A low-severity advisory matched by osv-scanner against a declared dependency in the lockfile. The project workspace declares only zod as a production runtime dependency; all other visible dependencies are devDependencies used for building, testing, and type-checking (tsup, vitest, typescript, fontsource, etc.). The lockfile source provided is truncated at line 161 and package names were stripped from the scanner candidate, so the exact affected package and version cannot be confirmed from the supplied evidence. Given the project is a Lumiverse browser extension that ships bundled code to end users, build-time dev dependency vulnerabilities have no runtime reachability in the shipped artifact. Concrete user harm is not established.
Impact: none · Exploitability: unlikely
Developer action: Update the affected development dependency to a patched version at the next maintenance cycle; no urgent action is required.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-g7r4-m6w7-qqqr
- File role
- production
- Source
- bun.lock
Dependency advisory GHSA-67mh-4wv8-2f99 applies
Minor caution · low confidence
A scanner flagged a medium-severity issue in a dependency. Based on the project structure, the flagged package appears to be a build or development tool rather than something that runs in the extension itself, so it is unlikely to impact users.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-67mh-4wv8-2f99 to a dependency declared by this repository.
Contextual assessment: A medium-severity advisory matched against a declared dependency in the lockfile. Package details were stripped from the candidate and the lockfile source is truncated, preventing exact identification. The workspace's sole production runtime dependency is zod; remaining visible dependencies are build-time devDependencies that do not ship in the extension bundle. Without confirmation that the advisory's vulnerable code path is reachable at runtime in the shipped artifact or that attacker-controlled input reaches it, advisory severity alone does not establish user harm.
Impact: none · Exploitability: unlikely
Developer action: Update the flagged dependency to a patched version during routine maintenance.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-67mh-4wv8-2f99
- File role
- production
- Source
- bun.lock
Dependency advisory GHSA-5xrq-8626-4rwp applies
Minor caution · low confidence
A scanner flagged a critical-severity issue in a dependency. While the word critical warrants attention, the affected package appears to be a development or build tool rather than code that runs inside the extension. There is no evidence that this issue can be reached by anyone using the finished extension.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-5xrq-8626-4rwp to a dependency declared by this repository.
Contextual assessment: A critical-severity advisory matched against a declared dependency. Package details were stripped and the provided lockfile source is truncated at line 161, so the exact affected package cannot be confirmed from the supplied evidence. The project's workspace declares only zod as a production runtime dependency; the rest are devDependencies for build, test, and type tooling. For a browser extension shipped as bundled code, vulnerabilities in build-time dev dependencies have no runtime reachability in the deployed artifact. Per policy, advisory severity alone is not an immediate-danger conclusion; there is no evidence of attacker-controlled input reaching vulnerable code in the shipped extension or concrete user harm.
Impact: low · Exploitability: unlikely
Developer action: Investigate which dependency is flagged, confirm whether it is development-only, and update it to a patched version. If it is a development dependency, prioritize is lower but should not be left unpatched indefinitely.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-5xrq-8626-4rwp
- File role
- production
- Source
- bun.lock
zizmor reported excessive-permissions
Minor caution · medium confidence
The automated test pipeline does not explicitly restrict what its built-in access token can do. Since the pipeline only runs tests and builds the project, it should declare the minimum access it needs. This is a minor hygiene issue, not a sign of any threat.
Technical evidence
Scanner reason: zizmor matched workflow-security rule excessive-permissions in this repository.
Contextual assessment: The workflow defines no explicit permissions block. The job only checks out source, installs dependencies, and runs typecheck, test, and build. It does not upload artifacts, push releases, or consume repository secrets. Absent an explicit permissions declaration, the token scope falls back to repository defaults, which is broader than the read-only access this job requires. Adding a top-level permissions block limiting to contents: read would align with least-privilege practice.
Impact: low · Exploitability: unlikely
Developer action: Add a top-level permissions block with contents: read to the workflow.
- Scanner
- zizmor 1.28.0
- Rule
- excessive-permissions
- File role
- tooling
- Source
- .github/workflows/ci.yml:8-19
zizmor reported artipacked
Minor caution · low confidence
The checkout step leaves a temporary access token on the build machine. Because this pipeline never saves or shares any build results, that token cannot realistically leak. It is a minor best-practice gap rather than a real danger.
Technical evidence
Scanner reason: zizmor matched workflow-security rule artipacked in this repository.
Contextual assessment: The artipacked concern relates to the checkout action persisting the GITHUB_TOKEN in local git configuration and that token later leaking through uploaded artifacts. This workflow performs no artifact upload, no release publishing, and no cross-job artifact passing. The token is scoped to the ephemeral runner and discarded with the job. The residual risk is negligible for this job shape, though using persist-credentials: false on checkout would eliminate the persistence entirely.
Impact: low · Exploitability: unlikely
Developer action: Consider setting persist-credentials: false on the checkout step to avoid leaving the token in runner git config.
- Scanner
- zizmor 1.28.0
- Rule
- artipacked
- File role
- tooling
- Source
- .github/workflows/ci.yml:11
zizmor reported unpinned-uses
Minor caution · high confidence
The pipeline uses a version label for a third-party build step instead of locking it to an exact version. If that step were ever tampered with, future builds could be affected. This is a standard hardening recommendation, not an active problem.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: The checkout action is referenced by major version tag rather than a pinned commit SHA. Tag-based references are mutable, so a compromise of the action repository could alter behavior for future runs. This is a common CI hygiene finding. For a workflow that only runs local typecheck, test, and build with no secrets or deployment, the practical impact is low. Pinning to a SHA would improve supply-chain integrity.
Impact: low · Exploitability: unlikely
Developer action: Pin actions/checkout to a specific commit SHA for reproducibility and supply-chain integrity.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/ci.yml:11
zizmor reported unpinned-uses
Minor caution · high confidence
The pipeline uses a version label for the Bun setup step instead of locking it to an exact version. This is a minor hardening recommendation with no practical danger for this test-only pipeline.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: The setup-bun action is referenced by major version tag rather than a pinned commit SHA. The same supply-chain consideration applies as with the checkout action. The job uses no secrets and performs no deployment, so the practical risk is low. Pinning to a SHA would improve integrity.
Impact: low · Exploitability: unlikely
Developer action: Pin oven-sh/setup-bun to a specific commit SHA for reproducibility and supply-chain integrity.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/ci.yml:12
Dependency advisory GHSA-v6wh-96g9-6wx3 applies
Minor caution · low confidence
A scanner flagged a medium-severity issue in a dependency that appears to be related to build or development tooling rather than the running extension. It is unlikely to affect end users.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-v6wh-96g9-6wx3 to a dependency declared by this repository.
Contextual assessment: A medium-severity advisory matched against a declared dependency. Package details were stripped from the candidate and the lockfile source is truncated, preventing exact package identification. The project workspace lists only zod as a runtime dependency; all other visible dependencies are build-time devDependencies. There is no evidence the vulnerable code path is reachable at runtime in the shipped extension artifact.
Impact: none · Exploitability: unlikely
Developer action: Update the flagged dependency to a patched version during routine maintenance.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-v6wh-96g9-6wx3
- File role
- production
- Source
- bun.lock
Dependency advisory GHSA-r28c-9q8g-f849 applies
Minor caution · low confidence
A scanner flagged a high-severity issue in a dependency. Based on the project structure, the flagged package appears to be a development or build tool. There is no evidence this issue can affect users of the finished extension.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-r28c-9q8g-f849 to a dependency declared by this repository.
Contextual assessment: A high-severity advisory matched against a declared dependency. Package details were stripped and the lockfile source is truncated at line 161, so the exact affected package cannot be confirmed. The project workspace declares only zod as a production runtime dependency; all other visible dependencies are devDependencies for build and test tooling. A high advisory severity is candidate-locating evidence, not a final conclusion. There is no evidence that the vulnerable code is reachable at runtime in the shipped extension or that attacker-controlled input reaches it.
Impact: none · Exploitability: unlikely
Developer action: Identify the flagged dependency and update it to a patched version; confirm whether it is development-only.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-r28c-9q8g-f849
- File role
- production
- Source
- bun.lock
Dependency advisory GHSA-4w7w-66w2-5vf9 applies
Minor caution · low confidence
A scanner flagged a medium-severity issue in a dependency that appears to be build or development tooling rather than the running extension. It is unlikely to affect end users.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-4w7w-66w2-5vf9 to a dependency declared by this repository.
Contextual assessment: A medium-severity advisory matched against a declared dependency. Package details were stripped and the lockfile source is truncated, preventing exact identification. The project workspace declares only zod as a runtime dependency; remaining visible dependencies are devDependencies. There is no evidence the vulnerable code path is reachable in the shipped extension artifact.
Impact: none · Exploitability: unlikely
Developer action: Update the flagged dependency to a patched version during routine maintenance.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-4w7w-66w2-5vf9
- File role
- production
- Source
- bun.lock
Dependency advisory GHSA-fx2h-pf6j-xcff applies
Minor caution · low confidence
A scanner flagged a high-severity issue in a dependency. Based on the project structure, the flagged package appears to be a development or build tool. There is no evidence this issue can affect users of the finished extension.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-fx2h-pf6j-xcff to a dependency declared by this repository.
Contextual assessment: A high-severity advisory matched against a declared dependency. Package details were stripped and the lockfile source is truncated at line 161, so the exact affected package cannot be confirmed. The project workspace declares only zod as a production runtime dependency; all other visible dependencies are devDependencies for build and test tooling. Advisory severity alone is not a final conclusion. There is no evidence the vulnerable code is reachable at runtime in the shipped extension or that attacker-controlled input reaches it.
Impact: none · Exploitability: unlikely
Developer action: Identify the flagged dependency and update it to a patched version; confirm whether it is development-only.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-fx2h-pf6j-xcff
- File role
- production
- Source
- bun.lock
Dependency advisory GHSA-fxqj-rqcc-2cmp applies
Minor caution · low confidence
A scanner flagged a medium-severity issue in a dependency that appears to be build or development tooling rather than the running extension. It is unlikely to affect end users.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-fxqj-rqcc-2cmp to a dependency declared by this repository.
Contextual assessment: A medium-severity advisory matched against a declared dependency. Package details were stripped and the lockfile source is truncated, preventing exact identification. The project workspace declares only zod as a runtime dependency; remaining visible dependencies are devDependencies. There is no evidence the vulnerable code path is reachable in the shipped extension artifact or that attacker-controlled input reaches it.
Impact: none · Exploitability: unlikely
Developer action: Update the flagged dependency to a patched version during routine maintenance.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-fxqj-rqcc-2cmp
- File role
- production
- Source
- bun.lock
Expected scanner matches (0)
None.