Bump vm2 from 3.9.13 to 3.12.2 in /server by dependabot[bot] · Pull Request #112 · KOSASIH/pailot-for-pi

dependabot · 2026-10-08T14:51:40Z

Bumps vm2 from 3.9.13 to 3.12.2.

Release notes

v3.12.2

Three advisories closed, and vm2 can now be shipped by single-file bundlers. Patch release — no API changes, with observable behaviour changes for host buffers and host promises handed to the sandbox (see Upgrade Notes).

What's Changed

Security fixes

GHSA-5h3f-q97h-ccvc — a NodeVM with a custom require.resolve recorded each resolver answer as a raw string prefix, so resolving an allowlisted package authorized every prefix-sharing sibling beside it (.../node_modules/foo authorized .../node_modules/foo2/index.js), and the {module, path} return shape authorized the whole search directory; under the default context: 'host' the sibling's top-level code ran with host authority. Resolver answers are now recorded as boundary-matched base paths (plus exact extension spellings for extension-probed answers), the object shape authorizes only the resolved package's directory, and an authorization is withdrawn again when its load finds nothing.

GHSA-2v2p-6j97-cjg9 — a host promise reaching the sandbox through a constructor return (new HostFn()), a host getter or data property, or a callback argument carried no rejection reaction, so sandbox code that simply dropped it terminated the host process under Node's unhandledRejection policy; the GHSA-gjq8 fix had covered only apply returns. Every host promise is now marked handled once at the single host→sandbox delivery chokepoint (a cheap prototype brand check that never invokes .then on non-promises and recognises promises from a second host realm), and the construct trap carries the same unconditional mark as apply. The sandbox still observes rejections through its own sanitized .catch.

GHSA-489w-w794-jq94 — a host-allocated Buffer (a builtin's return value such as zlib.deflateSync, an embedder-supplied buffer, a callback argument) exposed Node's shared 64 KiB allocation pool through .buffer or its legacy twin .parent, letting the sandbox read and overwrite unrelated host buffers — host memory disclosure and corruption. The GHSA-fcqc backing-store ownership rule now applies at the bridge for every host view, keyed on the identity of the delivered value so every alias of the store is covered by one rule; the raw buffer / parent / offset getters are no longer deliverable, the gate fails closed if the bridge cannot resolve ArrayBuffer.isView, and a foreign store planted on a view is refused.

Fixed

Single-file bundlers (Bun compile, esbuild, pkg, ...) can now ship vm2. The sandbox bootstrap files had to be read from disk at runtime, so a compiled binary failed with ENOENT as soon as the package directory was not on disk. They are now embedded as string literals in the generated lib/sources.js, and the sandbox-compiled scripts use a fixed virtual filename so bootstrap frames stay redacted from sandbox-visible stack traces.

Maintenance

Dev dependency @humanfs/node bumped from 0.16.6 to 0.16.8.

Documentation

Categories 46 (custom-resolver sibling authorization, with two documented residuals), 22 (host promises on every delivery route) and 41 (host views and the shared pool, with the observable behaviour changes and two documented residuals) are extended in docs/attacks/, with matching rows in the "How The Bridge Defends" table.

Upgrade Notes

Host buffers that do not own their whole backing store are delivered bounded. For such a view, .buffer / .parent is an exact-size copy (not identity-stable, not write-through), and byteOffset / offset read as 0 so Buffer.from(v.buffer, v.byteOffset, v.length) keeps working. Sub-views the sandbox creates from a host-backed buffer lose .buffer aliasing with their parent (index writes still alias), and SharedArrayBuffer sub-views are delivered as copies — hand over a view spanning the whole store for live sharing. Buffers that own their store (Buffer.alloc(n), large buffers) are unchanged.

Ignored host promises are silent on every route. Embedders no longer see unhandledRejection for a host promise handed to the sandbox through a getter, callback argument or constructor return, exactly as for call returns since GHSA-gjq8; attach an explicit .catch() to debug rejections.

A custom resolver's {module, path} answer must name a package inside path. A module that is absolute, relative or contains .. is now refused and reports module-not-found; return the string shape to name a path directly.

Bundling: nothing to configure — lib/sources.js is part of the published package. If you patch a bootstrap file in a fork, run npm run build:sources (or npm test, which regenerates it) so the embedded copy does not go stale.

No other valid configurations are affected.

Full Changelog: patriksimek/vm2@v3.12.1...v3.12.2

v3.12.1

Four advisories closed. Patch release — no API changes, with one deliberate behaviour change for NodeVM embedders who granted child_process (see Upgrade Notes).

What's Changed

Security fixes

GHSA-6454-5x88-m6jw — an embedder-exposed host Promise could be turned into a sandbox escape. Sandbox code wrote constructor[Symbol.species] onto the raw host promise and then called .then / .catch / .finally with the settlement-direction handler omitted; V8 built the result capability through SpeciesConstructor off the raw object (no bridge trap on that read) and its internal Thrower/Identity reaction delivered the raw host settlement — e.g. process — to a sandbox-captured capability, with no callback slot for the rejection sanitizer to wrap. Host RCE. The bridge now shadows the host promise's constructor for the duration of every sandbox-initiated then / catch / finally call, so the result capability is always a genuine host %Promise%; the indirection peel also covers host Reflect.apply and .finally.

GHSA-j89j-5m6r-cr2q — any ordinary sloppy-mode host function exposed to the sandbox leaked the host realm's global object when called with a nullish receiver (greet(), .call(null), Reflect.apply(fn, undefined, []), bind(null)()): V8's OrdinaryCallBindThis substituted the host global for this, and the bridge wrapped and delivered it — greet().process.getBuiltinModule('child_process') was host RCE. The host global is now cached at bridge init and refused at every host→sandbox coercion chokepoint, delivered as undefined, which is exactly what a strict-mode function's this already looked like.

GHSA-x3v6-43hc-82mc — a NodeVM that allowlisted the crypto builtin let guest code call crypto.setFips, flipping the FIPS mode of the entire host process; the read-only wrap stops property writes but forwards host calls with full authority. Same process-wide-mutator class as crypto.setEngine (GHSA-46pr) and tls.setDefaultCACertificates (GHSA-98xx). setFips is now replaced with a throwing stub alongside setEngine; getFips() and the rest of crypto are unchanged. Configuration-integrity issue, not RCE.

GHSA-pq68-rvw4-xp4r — NodeVM's hard denylist blocked every other host-process launcher (cluster, worker_threads, node:test) but omitted child_process, so require: { builtin: ['*'] }, ['*', '-fs'], an explicit ['child_process'], and the node: spellings all handed the sandbox the real host module — one execSync call was host RCE. child_process now joins DANGEROUS_BUILTINS: filtered from the wildcard, refused on explicit request, and covered by the node: / family normalization.

Documentation

The attack catalog is now split by mechanism family: docs/ATTACKS.md is the index and common material, and each family lives under docs/attacks/. Category numbers are permanent and unchanged. test/docs-catalog.js fails the suite on a renumbering, a dead link, or a missing metadata line.

New Categories 53 (host-Promise @@species hijack with a missing handler) and 54 (host global leak via a sloppy function's nullish this), plus extensions to Categories 21 (child_process joins the denylist, with the upgrade path) and 40 (crypto.setFips), and matching rows in the "How The Bridge Defends" table.

... (truncated)

Changelog

Sourced from vm2's changelog.

[3.12.2]

Security fixes

GHSA-5h3f-q97h-ccvc — NodeVM custom-resolver authorization admitted prefix-sharing siblings: resolving an allowlisted package recorded a raw ^<path> prefix, so .../node_modules/foo authorized .../node_modules/foo2/index.js (and the {module, path} shape authorized the whole search directory), running the sibling's top-level code in the host realm under context: 'host'. Structural fix in lib/resolver-compat.js: resolver answers are recorded as boundary-matched base paths (plus exact extension spellings), the object shape authorizes only the resolved package directory, and a failed load withdraws its authorization. Behavior change: a {module, path} answer whose module is absolute, relative or contains .. is now refused. See ATTACKS.md Category 46 and test/ghsa/GHSA-5h3f-q97h-ccvc/.

GHSA-2v2p-6j97-cjg9 — a host promise delivered into the sandbox through a constructor return, a host getter or data property, or a callback argument carried no rejection reaction, so sandbox code that dropped it terminated the host process under Node's unhandledRejection policy (GHSA-gjq8-xm47-88rc covered only apply returns). Structural fix in lib/bridge.js: every host promise is marked handled once at the delivery chokepoint (prototype brand check, cross-realm aware), and the construct trap gains the same unconditional mark as apply. Behavior change: embedders no longer see unhandledRejection for host promises handed to the sandbox on any route; debug rejections need an explicit .catch(). See ATTACKS.md Category 22 and test/ghsa/GHSA-2v2p-6j97-cjg9/.

GHSA-489w-w794-jq94 — host memory disclosure and corruption: a host-allocated Buffer (a builtin's return value such as zlib.deflateSync, an embedder-supplied buffer, a callback argument) exposed Node's shared 64 KiB pool through .buffer / .parent, letting the sandbox read and overwrite unrelated host buffers. Structural fix in lib/bridge.js: the GHSA-fcqc backing-store ownership rule now applies at the bridge for every host view, keyed on the delivered value's identity (so every alias of the store is covered), with the raw buffer / parent / offset getters undeliverable and a fail-closed gate. Behavior change: for a host view that does not own its whole store, .buffer / .parent is a bounded copy (not identity-stable, not write-through), byteOffset / offset read as 0, sandbox-created sub-views lose .buffer aliasing with their parent, and SharedArrayBuffer sub-views are delivered as copies; owning buffers are unchanged. See ATTACKS.md Category 41 and test/ghsa/GHSA-489w-w794-jq94/.

Fixed

Single-file bundlers (Bun compile, esbuild, pkg, ...) can now ship vm2. The sandbox bootstrap files (bridge.js, setup-sandbox.js, setup-node-sandbox.js, events.js) must reach the sandbox realm as source text and were read from disk at runtime with fs.readFileSync(\${__dirname}/...`), which a bundler cannot follow — a compiled binary failed with ENOENTas soon as the package directory was not on disk. They are now embedded as string literals in the generatedlib/sources.js (npm run build:sources, regenerated by pretest/prepublishOnlyand guarded by a staleness test). The sandbox-compiled scripts use the fixed virtual filename/vm2/lib/` instead of the host install path, so bootstrap frames stay redacted from sandbox-visible stack traces.

Maintenance

Dev dependency @humanfs/node bumped from 0.16.6 to 0.16.8.

[3.12.1]

Security fixes

GHSA-6454-5x88-m6jw — sandbox-to-host RCE through an embedder-exposed host Promise. Writing constructor[Symbol.species] on the raw host promise and calling .then / .catch / .finally with the settlement-direction handler omitted made V8 deliver the raw host settlement (e.g. process) to a sandbox-captured capability, with no callback slot for the rejection sanitizer to wrap. Structural fix in lib/bridge.js: neutralizeHostPromiseSpeciesOn shadows the host promise's constructor across the call so the result capability is always a genuine host %Promise%, and the indirection peel now also covers host Reflect.apply and .finally. See ATTACKS.md Category 53 and test/ghsa/GHSA-6454-5x88-m6jw/.

GHSA-j89j-5m6r-cr2q — sandbox escape to host RCE through any embedder-exposed sloppy-mode host function. Calling it with a nullish receiver (greet(), .call(null), Reflect.apply(fn, undefined, []), bind(null)()) makes V8 bind this to the host realm's global object, which the bridge then wrapped and delivered to the sandbox (greet().process.getBuiltinModule('child_process')). Structural fix in lib/bridge.js: the host global is cached at bridge init and refused at the three host→sandbox coercion chokepoints, returning undefined so strict-function semantics are preserved. See ATTACKS.md Category 54 and test/ghsa/GHSA-j89j-5m6r-cr2q/.

GHSA-x3v6-43hc-82mc — a NodeVM that allowlists the crypto builtin let guest code call crypto.setFips, flipping the FIPS mode of the entire host process; the read-only wrap stops property writes but forwards host calls with full authority, the same process-wide-mutator class as crypto.setEngine and tls.setDefaultCACertificates. Fix in lib/builtin.js: sanitizeCryptoModule replaces setFips with a throwing stub alongside setEngine; getFips() and the rest of crypto are untouched. Configuration-integrity issue, not RCE. See ATTACKS.md Category 40 and test/ghsa/GHSA-x3v6-43hc-82mc/.

GHSA-pq68-rvw4-xp4r — NodeVM's hard denylist omitted child_process, so require: { builtin: ['*'] }, ['*', '-fs'], an explicit ['child_process'], and the node: spellings all handed the sandbox the real host module and one execSync call was host RCE. Fix in lib/builtin.js: child_process joins DANGEROUS_BUILTINS, denied under the wildcard and on explicit request like cluster / worker_threads / node:test. Behavior change: embedders running trusted scripts that need it re-expose it through require.mock (the real module or a narrower facade); a bare builtin: ['child_process'] no longer grants it. See ATTACKS.md Category 21 and test/ghsa/GHSA-pq68-rvw4-xp4r/.

[3.12.0]

Added

Experimental Bun support (test suite and CI only). The suite now runs under Bun, with engine-keyed assertion messages so patterns stay exactly as strict on Node, a central test/bun-skips.js listing every JavaScriptCore divergence, and a non-blocking CI job whose output is verified complete before it is believed. Bun is not a supported security boundary — vm2's threat model is derived from V8 internals and JavaScriptCore has not been audited against the bridge. See the README Runtimes section.

Maintenance

global.Proxy install guarded for JavaScriptCore, and the sealed-slot attributes left implicit — lib/setup-sandbox.js installs the handler-sanitising Proxy with a bare assignment to a slot the Object.defineProperties(global, ...) block above declares as undefined. What that write does is engine-specific: on Node >= 10 the slot is genuinely sealed and the write is a silent no-op, so the sandbox has no Proxy at all; on Node 8 the old V8 global proxy leaves the slot writable and the write is live, which is what gives that sandbox its Proxy; and JavaScriptCore (Bun) implements the strict-mode write correctly and throws, aborting sandbox setup before the first run(). The write is now wrapped in try/catch — the failure outcome is "no Proxy in the sandbox", which is strictly more restrictive, never less. test/vm.js gains an AST-based guard (via acorn, already a runtime dependency) that fails if any write to Error, Promise or Proxy is left outside a try block, including through a local alias, and pins the sealed-slot descriptors on Node >= 10 where the seal actually takes. Correction to 3.11.8's entry: that release described the assignment as dead code and removed it, and separately spelled out writable: false, configurable: false on the three sealed slots for readability, claiming no behaviour change. The second change was the damaging one — those attributes are the spec defaults, so the forms are equivalent on a current V8 but not on the Node 8 global proxy, where only the explicit form actually seals the slot. That silently removed Proxy from Node 8 sandboxes and broke six tests. The attributes are omitted again, with a comment saying why they must stay that way, and the assignment is restored.

[3.11.8]

Security fixes

GHSA-3vgf-8m4q-q4qr (dup: GHSA-59g5-pmg6-5gr4) — default VM host intrinsic prototype pollution of the binary-data and iterator families. The protected inventory omitted ArrayBuffer / SharedArrayBuffer / DataView / every TypedArray / the abstract %TypedArray%.prototype, and the array/string/map/set/regexp-string iterator prototypes plus the shared %IteratorPrototype%. Because Buffer extends Uint8Array, the Category 20 proto-walk from a host Buffer reached those unprotected host prototypes and Reflect.defineProperty polluted them globally, corrupting every host-realm typed array and iterator. lib/bridge.js now lists the binary-data globals in globalsList and resolves the abstract intrinsic prototypes structurally into thisGlobalPrototypes, routing all of them into protectedHostObjects, the proto-mapping table, and the identity map so the write traps refuse sandbox set/defineProperty. See ATTACKS.md Category 20 (extended) and test/ghsa/GHSA-3vgf-8m4q-q4qr/.

GHSA-88hf-g992-jg85 — NodeVM default-config (console: 'inherit') sandbox escape. The sandbox extracted the raw host Object.prototype.__proto__ getter (via Buffer.call.call(__lookupGetter__, …, '__proto__'), the GHSA-v6mx/cfcw primitive) and, because that getter was never classified dangerous like the setter, climbed console._stdout's host prototype chain to the non-intrinsic EventEmitter.prototype, overwrote emit, and had the host invoke it with this === process → RCE. Closed with two independent layers in lib/bridge.js: (1) the raw host proto-readers (__proto__ getter, Object.getPrototypeOf, Reflect.getPrototypeOf) are denied delivery at thisFromOtherWithFactory/thisEnsureThis/thisFromOtherForThrow and the apply trap, so the sandbox can no longer climb host chains; (2) host [[Prototype]] objects are marked at delivery and sandbox function/accessor writes to them are diverted off the raw host object in BaseHandler.set/defineProperty. Legitimate Object.getPrototypeOf on host proxies and data/leaf writes are unchanged. See ATTACKS.md Category 50 and test/ghsa/GHSA-88hf-g992-jg85/.

GHSA-f8gf-w286-fmq2 — allowAsync: false async-execution boundary bypassed via Promise thenable assimilation. Blocking Promise.prototype.then left every native resolve capability open: Promise.resolve/all/race/any/allSettled/try, new Promise(r => r(thenable)), withResolvers().resolve, Array.fromAsync, and the realm-intrinsic base reached via Object.getPrototypeOf(Promise) all let V8's PromiseResolveThenableJob run an attacker .then in a microtask after run() returned, outside the configured timeout. Structural fix in lib/setup-sandbox.js, gated entirely to allowAsync: false: a TOCTOU-safe resolve-capability guard (refuses object/function values without ever reading .then), synchronous throws on the assimilating static methods, a non-configurable throwing Array.fromAsync stub, and a construct-guard Proxy on localPromise's prototype that makes the native base un-constructable from the sandbox. allowAsync: true is untouched. See ATTACKS.md Category 51 and test/ghsa/GHSA-f8gf-w286-fmq2/.

GHSA-gjq8-xm47-88rc — an embedder-exposed host function (or a host builtin such as events.once) that returns a rejected host Promise crashed the entire host process when sandbox code called it and ignored the result. The bridge handed the sandbox a wrapped promise but left the underlying host promise without a rejection reaction of its own, so Node's default unhandledRejection policy (Node 15+) tore the process down — a sandbox-triggered host DoS from a single line of untrusted code. Sibling of the parent advisory GHSA-hw58-p9xv-2mjh, which hardened the opposite (sandbox→host) direction. lib/bridge.js now attaches a benign no-op reaction to the underlying host promise on the host side, at the apply-trap boundary (markHostPromiseHandled). Promises multicast, so the sandbox's own GHSA-55hx-sanitized .then/.catch still fires and still observes the sanitized rejection; the no-op onRejected returns undefined, so it never creates a new unhandled rejection; fulfilled promises are untouched. See ATTACKS.md Category 22 (extended) and test/ghsa/GHSA-gjq8-xm47-88rc/.

GHSA-r273-hxvj-fxhp — NodeVM exposed host util to the sandbox as an unfiltered Object.assign({}, util), so util.getCallSites() (Node >= 22.9) handed sandboxed code the host process call stack — absolute paths including vm2's own lib/ and the embedder entrypoint — bypassing the GHSA-v27g host-frame redaction, which only covers sandbox-realm Error stacks. getCallSite / setTraceSigInt / private internals rode the same wholesale copy, and the sys alias leaked identically via the generic loader. lib/builtin.js now builds the exposed util from a vetted, forward-safe allowlist (SAFE_UTIL_MEMBERS, presence-gated Node 8→26) routed through the BUILTIN_MEMBER_SANITIZERS chokepoint for both util and sys, so no unreviewed host member reaches the sandbox. Information disclosure only. See ATTACKS.md Category 52 and test/ghsa/GHSA-r273-hxvj-fxhp/.

... (truncated)

Commits

a0139cf test: quarantine the five pool-dependent GHSA-489w cases under Bun
1649f45 chore: bump to 3.12.2 and cut the release section
0913368 docs: trim the 3.12.2 changelog entries to release-notes length
9596bf5 fix(GHSA-489w-w794-jq94): bound a host view's backing store at the bridge
6e487df fix(GHSA-2v2p-6j97-cjg9): mark every host promise handled at the delivery cho...
fb4977f fix(GHSA-5h3f-q97h-ccvc): boundary-match custom-resolver authorizations
a9a4943 chore(deps-dev): bump @humanfs/node from 0.16.6 to 0.16.8 (#577)
e1868c4 feat: embed sandbox bootstrap sources so bundlers can ship vm2 (#579)
45e32a6 chore: bump to 3.12.1 and cut the release section
d53e1c4 fix(GHSA-pq68-rvw4-xp4r): add child_process to DANGEROUS_BUILTINS
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for vm2 since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [vm2](https://github.com/patriksimek/vm2) from 3.9.13 to 3.12.2. - [Release notes](https://github.com/patriksimek/vm2/releases) - [Changelog](https://github.com/patriksimek/vm2/blob/main/CHANGELOG.md) - [Commits](patriksimek/vm2@3.9.13...v3.12.2) --- updated-dependencies: - dependency-name: vm2 dependency-version: 3.12.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

xhawk-ai

📋 Review Summary — Ready to merge

Summary

The change updates the transitive vm2 dependency used by Cloudinary's optional PAC proxy stack from 3.9.13 to 3.12.2 and refreshes its Acorn dependencies. The lockfile resolution is internally consistent, and no application compatibility defect was found in the repository; automated install/build verification could not run because Yarn is unavailable in the review environment.

Findings

js-yaml 4.1.0 has 5 known advisories ↗
minimatch 3.1.2 has 3 known advisories ↗
@faker-js/faker 7.6.0 has 1 known advisory ↗
@tootallnate/once 1.1.2 has 1 known advisory ↗
serve-static 1.15.0 has 1 known advisory ↗
ajv 6.12.6 has 1 known advisory ↗
axios 0.25.0 has 23 known advisories ↗
axios 1.2.3 has 9 known advisories ↗
form-data 4.0.0 has 2 known advisories ↗
body-parser 1.20.1 has 2 known advisories ↗
qs 6.11.0 has 3 known advisories ↗
brace-expansion 1.1.11 has 8 known advisories ↗
braces 3.0.2 has 2 known advisories ↗
cloudinary 1.33.0 has 1 known advisory ↗
lodash 4.17.21 has 2 known advisories ↗
cookie 0.5.0 has 1 known advisory ↗
diff 4.0.2 has 1 known advisory ↗
express 4.18.2 has 2 known advisories ↗
path-to-regexp 0.1.7 has 2 known advisories ↗
proxy-addr 2.0.7 has 1 known advisory ↗
send 0.18.0 has 1 known advisory ↗
flatted 3.2.7 has 2 known advisories ↗
follow-redirects 1.15.2 has 3 known advisories ↗
ip 1.1.8 has 2 known advisories ↗
jws 3.2.2 has 1 known advisory ↗
micromatch 4.0.5 has 1 known advisory ↗
picomatch 2.3.1 has 2 known advisories ↗
morgan 1.10.0 has 3 known advisories ↗
on-headers 1.0.2 has 1 known advisory ↗
multer 1.4.5-lts.1 has 11 known advisories ↗
semver 5.7.1 has 1 known advisory ↗
word-wrap 1.2.3 has 1 known advisory ↗
sha.js 2.4.11 has 1 known advisory ↗
shell-quote 1.7.4 has 2 known advisories ↗
toml 2.3.6 has 2 known advisories ↗
typeorm 0.3.11 has 3 known advisories ↗
uuid 8.3.2 has 1 known advisory ↗
xml2js 0.4.23 has 1 known advisory ↗

Commands

Re-review the latest changes:

@xhawk-ai review again

Resolve all review threads and post a summary:

@xhawk-ai resolve all

Fix with agent prompt

These are the findings from a code review of this pull request.

## 1. @faker-js/faker 7.6.0 has 1 known advisory
Path: server/yarn.lock
Line: 27
This file is not part of the pull request's diff.

Bug: [CVE-2026-73231](https://osv.dev/vulnerability/CVE-2026-73231). Faker: helpers.fake exploitable into arbritary code execution
Cause: `server/yarn.lock` resolves `@faker-js/faker` to 7.6.0, which OSV lists as affected by 1 advisory. Highest CVSS 7.8. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `@faker-js/faker` to 10.5.0 or later in `server/yarn.lock`.

## 2. @tootallnate/once 1.1.2 has 1 known advisory
Path: server/yarn.lock
Line: 97
This file is not part of the pull request's diff.

Bug: [CVE-2026-3449](https://osv.dev/vulnerability/CVE-2026-3449). @tootallnate/once vulnerable to Incorrect Control Flow Scoping
Cause: `server/yarn.lock` resolves `@tootallnate/once` to 1.1.2, which OSV lists as affected by 1 advisory. Highest CVSS 3.3. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `@tootallnate/once` to 3.0.1 or later in `server/yarn.lock`.

## 3. ajv 6.12.6 has 1 known advisory
Path: server/yarn.lock
Line: 369
This file is not part of the pull request's diff.

Bug: [CVE-2025-69873](https://osv.dev/vulnerability/CVE-2025-69873). ajv has ReDoS when using `$data` option
Cause: `server/yarn.lock` resolves `ajv` to 6.12.6, which OSV lists as affected by 1 advisory. Highest CVSS 5.5. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `ajv` to 8.18.0 or later in `server/yarn.lock`.

## 4. axios 0.25.0 has 23 known advisories
Path: server/yarn.lock
Line: 444
This file is not part of the pull request's diff.

Bug: [CVE-2023-45857](https://osv.dev/vulnerability/CVE-2023-45857), [CVE-2025-27152](https://osv.dev/vulnerability/CVE-2025-27152), [CVE-2025-62718](https://osv.dev/vulnerability/CVE-2025-62718), [CVE-2026-25639](https://osv.dev/vulnerability/CVE-2026-25639), and 19 more. axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
Cause: `server/yarn.lock` resolves `axios` to 0.25.0, which OSV lists as affected by 23 advisories. Highest CVSS 8.6. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `axios` to 1.18.0 or later in `server/yarn.lock`.

## 5. axios 1.2.3 has 9 known advisories
Path: server/yarn.lock
Line: 451
This file is not part of the pull request's diff.

Bug: [CVE-2025-58754](https://osv.dev/vulnerability/CVE-2025-58754), [CVE-2026-101902](https://osv.dev/vulnerability/CVE-2026-101902), [CVE-2026-101904](https://osv.dev/vulnerability/CVE-2026-101904), [CVE-2026-42037](https://osv.dev/vulnerability/CVE-2026-42037), and 5 more. axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
Cause: `server/yarn.lock` resolves `axios` to 1.2.3, which OSV lists as affected by 9 advisories. Highest CVSS 8.7. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `axios` to 1.20.0 or later in `server/yarn.lock`.

## 6. body-parser 1.20.1 has 2 known advisories
Path: server/yarn.lock
Line: 492
This file is not part of the pull request's diff.

Bug: [CVE-2024-45590](https://osv.dev/vulnerability/CVE-2024-45590), [CVE-2026-12590](https://osv.dev/vulnerability/CVE-2026-12590). body-parser vulnerable to denial of service when url encoding is enabled
Cause: `server/yarn.lock` resolves `body-parser` to 1.20.1, which OSV lists as affected by 2 advisories. Highest CVSS 8.7. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `body-parser` to 1.20.6 or later in `server/yarn.lock`.

## 7. brace-expansion 1.1.11 has 8 known advisories
Path: server/yarn.lock
Line: 512
This file is not part of the pull request's diff.

Bug: [CVE-2025-5889](https://osv.dev/vulnerability/CVE-2025-5889), [CVE-2026-102276](https://osv.dev/vulnerability/CVE-2026-102276), [CVE-2026-102277](https://osv.dev/vulnerability/CVE-2026-102277), [CVE-2026-102278](https://osv.dev/vulnerability/CVE-2026-102278), and 4 more. brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups
Cause: `server/yarn.lock` resolves `brace-expansion` to 1.1.11, which OSV lists as affected by 8 advisories. Highest CVSS 7.7. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `brace-expansion` to 5.0.12 or later in `server/yarn.lock`.

## 8. braces 3.0.2 has 2 known advisories
Path: server/yarn.lock
Line: 525
This file is not part of the pull request's diff.

Bug: [CVE-2024-4068](https://osv.dev/vulnerability/CVE-2024-4068), [CVE-2026-93687](https://osv.dev/vulnerability/CVE-2026-93687). Uncontrolled resource consumption in braces
Cause: `server/yarn.lock` resolves `braces` to 3.0.2, which OSV lists as affected by 2 advisories. Highest CVSS 8.7. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `braces` to 3.0.3 or later in `server/yarn.lock`.

## 9. cloudinary 1.33.0 has 1 known advisory
Path: server/yarn.lock
Line: 646
This file is not part of the pull request's diff.

Bug: [CVE-2025-12613](https://osv.dev/vulnerability/CVE-2025-12613). Cloudinary Node SDK is vulnerable to Arbitrary Argument Injection through parameters that include an ampersand
Cause: `server/yarn.lock` resolves `cloudinary` to 1.33.0, which OSV lists as affected by 1 advisory. Highest CVSS 8.8. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `cloudinary` to 2.7.0 or later in `server/yarn.lock`.

## 10. cookie 0.5.0 has 1 known advisory
Path: server/yarn.lock
Line: 724
This file is not part of the pull request's diff.

Bug: [CVE-2024-47764](https://osv.dev/vulnerability/CVE-2024-47764). cookie accepts cookie name, path, and domain with out of bounds characters
Cause: `server/yarn.lock` resolves `cookie` to 0.5.0, which OSV lists as affected by 1 advisory. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `cookie` to 0.7.0 or later in `server/yarn.lock`.

## 11. diff 4.0.2 has 1 known advisory
Path: server/yarn.lock
Line: 843
This file is not part of the pull request's diff.

Bug: [CVE-2026-24001](https://osv.dev/vulnerability/CVE-2026-24001). jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch
Cause: `server/yarn.lock` resolves `diff` to 4.0.2, which OSV lists as affected by 1 advisory. Highest CVSS 2.7. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `diff` to 8.0.3 or later in `server/yarn.lock`.

## 12. express 4.18.2 has 2 known advisories
Path: server/yarn.lock
Line: 1069
This file is not part of the pull request's diff.

Bug: [CVE-2024-29041](https://osv.dev/vulnerability/CVE-2024-29041), [CVE-2024-43796](https://osv.dev/vulnerability/CVE-2024-43796). express vulnerable to XSS via response.redirect()
Cause: `server/yarn.lock` resolves `express` to 4.18.2, which OSV lists as affected by 2 advisories. Highest CVSS 6.1. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `express` to 4.20.0 or later in `server/yarn.lock`.

## 13. flatted 3.2.7 has 2 known advisories
Path: server/yarn.lock
Line: 1194
This file is not part of the pull request's diff.

Bug: [CVE-2026-32141](https://osv.dev/vulnerability/CVE-2026-32141), [CVE-2026-33228](https://osv.dev/vulnerability/CVE-2026-33228). flatted vulnerable to unbounded recursion DoS in parse() revive phase
Cause: `server/yarn.lock` resolves `flatted` to 3.2.7, which OSV lists as affected by 2 advisories. Highest CVSS 8.9. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `flatted` to 3.4.2 or later in `server/yarn.lock`.

## 14. follow-redirects 1.15.2 has 3 known advisories
Path: server/yarn.lock
Line: 1199
This file is not part of the pull request's diff.

Bug: [CVE-2023-26159](https://osv.dev/vulnerability/CVE-2023-26159), [CVE-2024-28849](https://osv.dev/vulnerability/CVE-2024-28849), [CVE-2026-40895](https://osv.dev/vulnerability/CVE-2026-40895). follow-redirects' Proxy-Authorization header kept across hosts
Cause: `server/yarn.lock` resolves `follow-redirects` to 1.15.2, which OSV lists as affected by 3 advisories. Highest CVSS 6.9. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `follow-redirects` to 1.16.0 or later in `server/yarn.lock`.

## 15. form-data 4.0.0 has 2 known advisories
Path: server/yarn.lock
Line: 457
This file is not part of the pull request's diff.

Bug: [CVE-2025-7783](https://osv.dev/vulnerability/CVE-2025-7783), [CVE-2026-12143](https://osv.dev/vulnerability/CVE-2026-12143). form-data uses unsafe random function in form-data for choosing boundary
Cause: `server/yarn.lock` resolves `form-data` to 4.0.0, which OSV lists as affected by 2 advisories. Highest CVSS 9.4. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `form-data` to 2.5.6 or later in `server/yarn.lock`.

## 16. ip 1.1.8 has 2 known advisories
Path: server/yarn.lock
Line: 1450
This file is not part of the pull request's diff.

Bug: [CVE-2023-42282](https://osv.dev/vulnerability/CVE-2023-42282), [CVE-2024-29415](https://osv.dev/vulnerability/CVE-2024-29415). ip SSRF improper categorization in isPublic
Cause: `server/yarn.lock` resolves `ip` to 1.1.8, which OSV lists as affected by 2 advisories. Highest CVSS 8.1. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `ip` to 2.0.1 or later in `server/yarn.lock`.

## 17. js-yaml 4.1.0 has 5 known advisories
Path: server/yarn.lock
Line: 23
This file is not part of the pull request's diff.

Bug: [CVE-2025-64718](https://osv.dev/vulnerability/CVE-2025-64718), [CVE-2026-53550](https://osv.dev/vulnerability/CVE-2026-53550), [CVE-2026-59869](https://osv.dev/vulnerability/CVE-2026-59869), [CVE-2026-84375](https://osv.dev/vulnerability/CVE-2026-84375), and 1 more. js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources
Cause: `server/yarn.lock` resolves `js-yaml` to 4.1.0, which OSV lists as affected by 5 advisories. Highest CVSS 7.5. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `js-yaml` to 4.3.2 or later in `server/yarn.lock`.

## 18. jws 3.2.2 has 1 known advisory
Path: server/yarn.lock
Line: 1554
This file is not part of the pull request's diff.

Bug: [CVE-2025-65945](https://osv.dev/vulnerability/CVE-2025-65945). auth0/node-jws Improperly Verifies HMAC Signature
Cause: `server/yarn.lock` resolves `jws` to 3.2.2, which OSV lists as affected by 1 advisory. Highest CVSS 7.5. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `jws` to 3.2.3 or later in `server/yarn.lock`.

## 19. lodash 4.17.21 has 2 known advisories
Path: server/yarn.lock
Line: 653
This file is not part of the pull request's diff.

Bug: [CVE-2021-23337](https://osv.dev/vulnerability/CVE-2021-23337), [CVE-2025-13465](https://osv.dev/vulnerability/CVE-2025-13465). lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`
Cause: `server/yarn.lock` resolves `lodash` to 4.17.21, which OSV lists as affected by 2 advisories. Highest CVSS 8.1. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `lodash` to 4.18.0 or later in `server/yarn.lock`.

## 20. micromatch 4.0.5 has 1 known advisory
Path: server/yarn.lock
Line: 1663
This file is not part of the pull request's diff.

Bug: [CVE-2024-4067](https://osv.dev/vulnerability/CVE-2024-4067). Regular Expression Denial of Service (ReDoS) in micromatch
Cause: `server/yarn.lock` resolves `micromatch` to 4.0.5, which OSV lists as affected by 1 advisory. Highest CVSS 5.3. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `micromatch` to 4.0.8 or later in `server/yarn.lock`.

## 21. minimatch 3.1.2 has 3 known advisories
Path: server/yarn.lock
Line: 24
This file is not part of the pull request's diff.

Bug: [CVE-2026-26996](https://osv.dev/vulnerability/CVE-2026-26996), [CVE-2026-27903](https://osv.dev/vulnerability/CVE-2026-27903), [CVE-2026-27904](https://osv.dev/vulnerability/CVE-2026-27904). minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions
Cause: `server/yarn.lock` resolves `minimatch` to 3.1.2, which OSV lists as affected by 3 advisories. Highest CVSS 8.7. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `minimatch` to 10.2.3 or later in `server/yarn.lock`.

## 22. morgan 1.10.0 has 3 known advisories
Path: server/yarn.lock
Line: 1717
This file is not part of the pull request's diff.

Bug: [CVE-2026-15603](https://osv.dev/vulnerability/CVE-2026-15603), [CVE-2026-5078](https://osv.dev/vulnerability/CVE-2026-5078), [CVE-2026-87859](https://osv.dev/vulnerability/CVE-2026-87859). morgan vulnerable to Log Forging via unneutralized control characters in :remote-user
Cause: `server/yarn.lock` resolves `morgan` to 1.10.0, which OSV lists as affected by 3 advisories. Highest CVSS 5.3. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `morgan` to 1.12.1 or later in `server/yarn.lock`.

## 23. multer 1.4.5-lts.1 has 11 known advisories
Path: server/yarn.lock
Line: 1743
This file is not part of the pull request's diff.

Bug: [CVE-2025-47935](https://osv.dev/vulnerability/CVE-2025-47935), [CVE-2025-47944](https://osv.dev/vulnerability/CVE-2025-47944), [CVE-2025-48997](https://osv.dev/vulnerability/CVE-2025-48997), [CVE-2025-7338](https://osv.dev/vulnerability/CVE-2025-7338), and 7 more. Multer vulnerable to Denial of Service via memory leaks from unclosed streams
Cause: `server/yarn.lock` resolves `multer` to 1.4.5-lts.1, which OSV lists as affected by 11 advisories. Highest CVSS 8.7. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `multer` to 2.3.0 or later in `server/yarn.lock`.

## 24. on-headers 1.0.2 has 1 known advisory
Path: server/yarn.lock
Line: 1726
This file is not part of the pull request's diff.

Bug: [CVE-2025-7339](https://osv.dev/vulnerability/CVE-2025-7339). on-headers is vulnerable to http response header manipulation
Cause: `server/yarn.lock` resolves `on-headers` to 1.0.2, which OSV lists as affected by 1 advisory. Highest CVSS 3.4. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `on-headers` to 1.1.0 or later in `server/yarn.lock`.

## 25. path-to-regexp 0.1.7 has 2 known advisories
Path: server/yarn.lock
Line: 1093
This file is not part of the pull request's diff.

Bug: [CVE-2024-45296](https://osv.dev/vulnerability/CVE-2024-45296), [CVE-2024-52798](https://osv.dev/vulnerability/CVE-2024-52798). path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters
Cause: `server/yarn.lock` resolves `path-to-regexp` to 0.1.7, which OSV lists as affected by 2 advisories. Highest CVSS 7.7. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `path-to-regexp` to 0.1.13 or later in `server/yarn.lock`.

## 26. picomatch 2.3.1 has 2 known advisories
Path: server/yarn.lock
Line: 1667
This file is not part of the pull request's diff.

Bug: [CVE-2026-33671](https://osv.dev/vulnerability/CVE-2026-33671), [CVE-2026-33672](https://osv.dev/vulnerability/CVE-2026-33672). Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching
Cause: `server/yarn.lock` resolves `picomatch` to 2.3.1, which OSV lists as affected by 2 advisories. Highest CVSS 7.5. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `picomatch` to 4.0.4 or later in `server/yarn.lock`.

## 27. proxy-addr 2.0.7 has 1 known advisory
Path: server/yarn.lock
Line: 1094
This file is not part of the pull request's diff.

Bug: [CVE-2026-90711](https://osv.dev/vulnerability/CVE-2026-90711). proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet
Cause: `server/yarn.lock` resolves `proxy-addr` to 2.0.7, which OSV lists as affected by 1 advisory. Highest CVSS 9.1. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `proxy-addr` to 2.0.8 or later in `server/yarn.lock`.

## 28. qs 6.11.0 has 3 known advisories
Path: server/yarn.lock
Line: 505
This file is not part of the pull request's diff.

Bug: [CVE-2025-15284](https://osv.dev/vulnerability/CVE-2025-15284), [CVE-2026-2391](https://osv.dev/vulnerability/CVE-2026-2391), [CVE-2026-82417](https://osv.dev/vulnerability/CVE-2026-82417). qs: Denial of Service via Attacker Controlled isBuffer
Cause: `server/yarn.lock` resolves `qs` to 6.11.0, which OSV lists as affected by 3 advisories. Highest CVSS 6.3. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `qs` to 6.16.0 or later in `server/yarn.lock`.

## 29. semver 5.7.1 has 1 known advisory
Path: server/yarn.lock
Line: 1800
This file is not part of the pull request's diff.

Bug: [CVE-2022-25883](https://osv.dev/vulnerability/CVE-2022-25883). semver vulnerable to Regular Expression Denial of Service
Cause: `server/yarn.lock` resolves `semver` to 5.7.1, which OSV lists as affected by 1 advisory. Highest CVSS 7.5. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `semver` to 7.5.2 or later in `server/yarn.lock`.

## 30. send 0.18.0 has 1 known advisory
Path: server/yarn.lock
Line: 1098
This file is not part of the pull request's diff.

Bug: [CVE-2024-43799](https://osv.dev/vulnerability/CVE-2024-43799). send vulnerable to template injection that can lead to XSS
Cause: `server/yarn.lock` resolves `send` to 0.18.0, which OSV lists as affected by 1 advisory. Highest CVSS 5.0. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `send` to 0.19.0 or later in `server/yarn.lock`.

## 31. serve-static 1.15.0 has 1 known advisory
Path: server/yarn.lock
Line: 226
This file is not part of the pull request's diff.

Bug: [CVE-2024-43800](https://osv.dev/vulnerability/CVE-2024-43800). serve-static vulnerable to template injection that can lead to XSS
Cause: `server/yarn.lock` resolves `serve-static` to 1.15.0, which OSV lists as affected by 1 advisory. Highest CVSS 5.0. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `serve-static` to 1.16.0 or later in `server/yarn.lock`.

## 32. sha.js 2.4.11 has 1 known advisory
Path: server/yarn.lock
Line: 2323
This file is not part of the pull request's diff.

Bug: [CVE-2025-9288](https://osv.dev/vulnerability/CVE-2025-9288). sha.js is missing type checks leading to hash rewind and passing on crafted data
Cause: `server/yarn.lock` resolves `sha.js` to 2.4.11, which OSV lists as affected by 1 advisory. Highest CVSS 9.1. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `sha.js` to 2.4.12 or later in `server/yarn.lock`.

## 33. shell-quote 1.7.4 has 2 known advisories
Path: server/yarn.lock
Line: 2345
This file is not part of the pull request's diff.

Bug: [CVE-2026-13311](https://osv.dev/vulnerability/CVE-2026-13311), [CVE-2026-9277](https://osv.dev/vulnerability/CVE-2026-9277). shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)
Cause: `server/yarn.lock` resolves `shell-quote` to 1.7.4, which OSV lists as affected by 2 advisories. Highest CVSS 9.2. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `shell-quote` to 1.9.0 or later in `server/yarn.lock`.

## 34. toml 2.3.6 has 2 known advisories
Path: server/yarn.lock
Line: 2557
This file is not part of the pull request's diff.

Bug: [CVE-2026-63376](https://osv.dev/vulnerability/CVE-2026-63376), [CVE-2026-77465](https://osv.dev/vulnerability/CVE-2026-77465). toml-node: Uncontrolled Recursion
Cause: `server/yarn.lock` resolves `toml` to 2.3.6, which OSV lists as affected by 2 advisories. Highest CVSS 8.2. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `toml` to 4.2.0 or later in `server/yarn.lock`.

## 35. typeorm 0.3.11 has 3 known advisories
Path: server/yarn.lock
Line: 2661
This file is not part of the pull request's diff.

Bug: [CVE-2025-60542](https://osv.dev/vulnerability/CVE-2025-60542), [CVE-2026-73651](https://osv.dev/vulnerability/CVE-2026-73651), [GHSA-9ggv-8w38-r7pm](https://osv.dev/vulnerability/GHSA-9ggv-8w38-r7pm). TypeORM: migration:generate template-literal code injection
Cause: `server/yarn.lock` resolves `typeorm` to 0.3.11, which OSV lists as affected by 3 advisories. Highest CVSS 8.9. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `typeorm` to 0.3.31 or later in `server/yarn.lock`.

## 36. uuid 8.3.2 has 1 known advisory
Path: server/yarn.lock
Line: 2680
This file is not part of the pull request's diff.

Bug: [CVE-2026-41907](https://osv.dev/vulnerability/CVE-2026-41907). uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided
Cause: `server/yarn.lock` resolves `uuid` to 8.3.2, which OSV lists as affected by 1 advisory. Highest CVSS 7.5. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `uuid` to 11.1.1 or later in `server/yarn.lock`.

## 37. word-wrap 1.2.3 has 1 known advisory
Path: server/yarn.lock
Line: 1864
This file is not part of the pull request's diff.

Bug: [CVE-2023-26115](https://osv.dev/vulnerability/CVE-2023-26115). word-wrap vulnerable to Regular Expression Denial of Service
Cause: `server/yarn.lock` resolves `word-wrap` to 1.2.3, which OSV lists as affected by 1 advisory. Highest CVSS 5.3. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `word-wrap` to 1.2.4 or later in `server/yarn.lock`.

## 38. xml2js 0.4.23 has 1 known advisory
Path: server/yarn.lock
Line: 2681
This file is not part of the pull request's diff.

Bug: [CVE-2023-0842](https://osv.dev/vulnerability/CVE-2023-0842). xml2js is vulnerable to prototype pollution
Cause: `server/yarn.lock` resolves `xml2js` to 0.4.23, which OSV lists as affected by 1 advisory. Highest CVSS 5.3. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `xml2js` to 0.5.0 or later in `server/yarn.lock`.

---

For each finding above, determine whether it is valid and should be fixed. If so, fix it directly. Where a finding offers several remedies, pick one and say why. Leave the pull request's own changed files alone unless a fix requires touching them.

xhawk-ai · 2026-10-08T14:53:16Z

Findings Outside the Diff

Note

The change causes these, but the lines that exhibit them are not in the diff, so GitHub cannot host them inline. A finding drops off this list as soon as the file it names is part of the diff.

@faker-js/faker 7.6.0 has 1 known advisory — server/yarn.lock:27

Bug: CVE-2026-73231. Faker: helpers.fake exploitable into arbritary code execution

Cause: server/yarn.lock resolves @faker-js/faker to 7.6.0, which OSV lists as affected by 1 advisory. Highest CVSS 7.8. It predates this pull request, so it is not blocking.

Impact here: No runtime import was found; it is pulled in by typeorm-extension, which this repository exposes only through the db:create CLI script.

Fix: Upgrade @faker-js/faker to 10.5.0 or later in server/yarn.lock.

@tootallnate/once 1.1.2 has 1 known advisory — server/yarn.lock:97

Bug: CVE-2026-3449. @tootallnate/once vulnerable to Incorrect Control Flow Scoping

Cause: server/yarn.lock resolves @tootallnate/once to 1.1.2, which OSV lists as affected by 1 advisory. Highest CVSS 3.3. It predates this pull request, so it is not blocking.

Fix: Upgrade @tootallnate/once to 3.0.1 or later in server/yarn.lock.

ajv 6.12.6 has 1 known advisory — server/yarn.lock:369

Bug: CVE-2025-69873. ajv has ReDoS when using $data option

Cause: server/yarn.lock resolves ajv to 6.12.6, which OSV lists as affected by 1 advisory. Highest CVSS 5.5. It predates this pull request, so it is not blocking.

Fix: Upgrade ajv to 8.18.0 or later in server/yarn.lock.

axios 0.25.0 has 23 known advisories — server/yarn.lock:444

Bug: CVE-2023-45857, CVE-2025-27152, CVE-2025-62718, CVE-2026-25639, and 19 more. axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

Cause: server/yarn.lock resolves axios to 0.25.0, which OSV lists as affected by 23 advisories. Highest CVSS 8.6. It predates this pull request, so it is not blocking.

Fix: Upgrade axios to 1.18.0 or later in server/yarn.lock.

axios 1.2.3 has 9 known advisories — server/yarn.lock:451

Bug: CVE-2025-58754, CVE-2026-101902, CVE-2026-101904, CVE-2026-42037, and 5 more. axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in config.proxy

Cause: server/yarn.lock resolves axios to 1.2.3, which OSV lists as affected by 9 advisories. Highest CVSS 8.7. It predates this pull request, so it is not blocking.

Impact here: This version is directly reachable through outbound HTTP calls in server/src/modules/payment/services/payment.services.ts and the shared client in server/src/utils/platformAPIClient.ts.

Fix: Upgrade axios to 1.20.0 or later in server/yarn.lock.

body-parser 1.20.1 has 2 known advisories — server/yarn.lock:492

Bug: CVE-2024-45590, CVE-2026-12590. body-parser vulnerable to denial of service when url encoding is enabled

Cause: server/yarn.lock resolves body-parser to 1.20.1, which OSV lists as affected by 2 advisories. Highest CVSS 8.7. It predates this pull request, so it is not blocking.

Fix: Upgrade body-parser to 1.20.6 or later in server/yarn.lock.

brace-expansion 1.1.11 has 8 known advisories — server/yarn.lock:512

Bug: CVE-2025-5889, CVE-2026-102276, CVE-2026-102277, CVE-2026-102278, and 4 more. brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups

Cause: server/yarn.lock resolves brace-expansion to 1.1.11, which OSV lists as affected by 8 advisories. Highest CVSS 7.7. It predates this pull request, so it is not blocking.

Fix: Upgrade brace-expansion to 5.0.12 or later in server/yarn.lock.

braces 3.0.2 has 2 known advisories — server/yarn.lock:525

Bug: CVE-2024-4068, CVE-2026-93687. Uncontrolled resource consumption in braces

Cause: server/yarn.lock resolves braces to 3.0.2, which OSV lists as affected by 2 advisories. Highest CVSS 8.7. It predates this pull request, so it is not blocking.

Fix: Upgrade braces to 3.0.3 or later in server/yarn.lock.

cloudinary 1.33.0 has 1 known advisory — server/yarn.lock:646

Bug: CVE-2025-12613. Cloudinary Node SDK is vulnerable to Arbitrary Argument Injection through parameters that include an ampersand

Cause: server/yarn.lock resolves cloudinary to 1.33.0, which OSV lists as affected by 1 advisory. Highest CVSS 8.8. It predates this pull request, so it is not blocking.

Impact here: This package is directly reachable when user or transaction images are uploaded through server/src/middlewares/cloudinary.ts.

Fix: Upgrade cloudinary to 2.7.0 or later in server/yarn.lock.

cookie 0.5.0 has 1 known advisory — server/yarn.lock:724

Bug: CVE-2024-47764. cookie accepts cookie name, path, and domain with out of bounds characters

Cause: server/yarn.lock resolves cookie to 0.5.0, which OSV lists as affected by 1 advisory. It predates this pull request, so it is not blocking.

Fix: Upgrade cookie to 0.7.0 or later in server/yarn.lock.

diff 4.0.2 has 1 known advisory — server/yarn.lock:843

Bug: CVE-2026-24001. jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch

Cause: server/yarn.lock resolves diff to 4.0.2, which OSV lists as affected by 1 advisory. Highest CVSS 2.7. It predates this pull request, so it is not blocking.

Fix: Upgrade diff to 8.0.3 or later in server/yarn.lock.

express 4.18.2 has 2 known advisories — server/yarn.lock:1069

Bug: CVE-2024-29041, CVE-2024-43796. express vulnerable to XSS via response.redirect()

Cause: server/yarn.lock resolves express to 4.18.2, which OSV lists as affected by 2 advisories. Highest CVSS 6.1. It predates this pull request, so it is not blocking.

Impact here: This package is directly reachable as the server's HTTP request-handling framework in server/src/index.ts.

Fix: Upgrade express to 4.20.0 or later in server/yarn.lock.

flatted 3.2.7 has 2 known advisories — server/yarn.lock:1194

Bug: CVE-2026-32141, CVE-2026-33228. flatted vulnerable to unbounded recursion DoS in parse() revive phase

Cause: server/yarn.lock resolves flatted to 3.2.7, which OSV lists as affected by 2 advisories. Highest CVSS 8.9. It predates this pull request, so it is not blocking.

Fix: Upgrade flatted to 3.4.2 or later in server/yarn.lock.

follow-redirects 1.15.2 has 3 known advisories — server/yarn.lock:1199

Bug: CVE-2023-26159, CVE-2024-28849, CVE-2026-40895. follow-redirects' Proxy-Authorization header kept across hosts

Cause: server/yarn.lock resolves follow-redirects to 1.15.2, which OSV lists as affected by 3 advisories. Highest CVSS 6.9. It predates this pull request, so it is not blocking.

Fix: Upgrade follow-redirects to 1.16.0 or later in server/yarn.lock.

form-data 4.0.0 has 2 known advisories — server/yarn.lock:457

Bug: CVE-2025-7783, CVE-2026-12143. form-data uses unsafe random function in form-data for choosing boundary

Cause: server/yarn.lock resolves form-data to 4.0.0, which OSV lists as affected by 2 advisories. Highest CVSS 9.4. It predates this pull request, so it is not blocking.

Fix: Upgrade form-data to 2.5.6 or later in server/yarn.lock.

ip 1.1.8 has 2 known advisories — server/yarn.lock:1450

Bug: CVE-2023-42282, CVE-2024-29415. ip SSRF improper categorization in isPublic

Cause: server/yarn.lock resolves ip to 1.1.8, which OSV lists as affected by 2 advisories. Highest CVSS 8.1. It predates this pull request, so it is not blocking.

Fix: Upgrade ip to 2.0.1 or later in server/yarn.lock.

js-yaml 4.1.0 has 5 known advisories — server/yarn.lock:23

Bug: CVE-2025-64718, CVE-2026-53550, CVE-2026-59869, CVE-2026-84375, and 1 more. js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources

Cause: server/yarn.lock resolves js-yaml to 4.1.0, which OSV lists as affected by 5 advisories. Highest CVSS 7.5. It predates this pull request, so it is not blocking.

Fix: Upgrade js-yaml to 4.3.2 or later in server/yarn.lock.

jws 3.2.2 has 1 known advisory — server/yarn.lock:1554

Bug: CVE-2025-65945. auth0/node-jws Improperly Verifies HMAC Signature

Cause: server/yarn.lock resolves jws to 3.2.2, which OSV lists as affected by 1 advisory. Highest CVSS 7.5. It predates this pull request, so it is not blocking.

Fix: Upgrade jws to 3.2.3 or later in server/yarn.lock.

lodash 4.17.21 has 2 known advisories — server/yarn.lock:653

Bug: CVE-2021-23337, CVE-2025-13465. lodash vulnerable to Prototype Pollution via array path bypass in _.unset and _.omit

Cause: server/yarn.lock resolves lodash to 4.17.21, which OSV lists as affected by 2 advisories. Highest CVSS 8.1. It predates this pull request, so it is not blocking.

Fix: Upgrade lodash to 4.18.0 or later in server/yarn.lock.

micromatch 4.0.5 has 1 known advisory — server/yarn.lock:1663

Bug: CVE-2024-4067. Regular Expression Denial of Service (ReDoS) in micromatch

Cause: server/yarn.lock resolves micromatch to 4.0.5, which OSV lists as affected by 1 advisory. Highest CVSS 5.3. It predates this pull request, so it is not blocking.

Fix: Upgrade micromatch to 4.0.8 or later in server/yarn.lock.

minimatch 3.1.2 has 3 known advisories — server/yarn.lock:24

Bug: CVE-2026-26996, CVE-2026-27903, CVE-2026-27904. minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions

Cause: server/yarn.lock resolves minimatch to 3.1.2, which OSV lists as affected by 3 advisories. Highest CVSS 8.7. It predates this pull request, so it is not blocking.

Fix: Upgrade minimatch to 10.2.3 or later in server/yarn.lock.

morgan 1.10.0 has 3 known advisories — server/yarn.lock:1717

Bug: CVE-2026-15603, CVE-2026-5078, CVE-2026-87859. morgan vulnerable to Log Forging via unneutralized control characters in :remote-user

Cause: server/yarn.lock resolves morgan to 1.10.0, which OSV lists as affected by 3 advisories. Highest CVSS 5.3. It predates this pull request, so it is not blocking.

Impact here: This package processes every incoming request through both configured logging middleware instances in server/src/index.ts.

Fix: Upgrade morgan to 1.12.1 or later in server/yarn.lock.

multer 1.4.5-lts.1 has 11 known advisories — server/yarn.lock:1743

Bug: CVE-2025-47935, CVE-2025-47944, CVE-2025-48997, CVE-2025-7338, and 7 more. Multer vulnerable to Denial of Service via memory leaks from unclosed streams

Cause: server/yarn.lock resolves multer to 1.4.5-lts.1, which OSV lists as affected by 11 advisories. Highest CVSS 8.7. It predates this pull request, so it is not blocking.

Impact here: This package is directly reachable on the user and transaction image-upload routes through server/src/middlewares/multer.ts.

Fix: Upgrade multer to 2.3.0 or later in server/yarn.lock.

on-headers 1.0.2 has 1 known advisory — server/yarn.lock:1726

Bug: CVE-2025-7339. on-headers is vulnerable to http response header manipulation

Cause: server/yarn.lock resolves on-headers to 1.0.2, which OSV lists as affected by 1 advisory. Highest CVSS 3.4. It predates this pull request, so it is not blocking.

Fix: Upgrade on-headers to 1.1.0 or later in server/yarn.lock.

path-to-regexp 0.1.7 has 2 known advisories — server/yarn.lock:1093

Bug: CVE-2024-45296, CVE-2024-52798. path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters

Cause: server/yarn.lock resolves path-to-regexp to 0.1.7, which OSV lists as affected by 2 advisories. Highest CVSS 7.7. It predates this pull request, so it is not blocking.

Fix: Upgrade path-to-regexp to 0.1.13 or later in server/yarn.lock.

picomatch 2.3.1 has 2 known advisories — server/yarn.lock:1667

Bug: CVE-2026-33671, CVE-2026-33672. Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching

Cause: server/yarn.lock resolves picomatch to 2.3.1, which OSV lists as affected by 2 advisories. Highest CVSS 7.5. It predates this pull request, so it is not blocking.

Fix: Upgrade picomatch to 4.0.4 or later in server/yarn.lock.

proxy-addr 2.0.7 has 1 known advisory — server/yarn.lock:1094

Bug: CVE-2026-90711. proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

Cause: server/yarn.lock resolves proxy-addr to 2.0.7, which OSV lists as affected by 1 advisory. Highest CVSS 9.1. It predates this pull request, so it is not blocking.

Fix: Upgrade proxy-addr to 2.0.8 or later in server/yarn.lock.

qs 6.11.0 has 3 known advisories — server/yarn.lock:505

Bug: CVE-2025-15284, CVE-2026-2391, CVE-2026-82417. qs: Denial of Service via Attacker Controlled isBuffer

Cause: server/yarn.lock resolves qs to 6.11.0, which OSV lists as affected by 3 advisories. Highest CVSS 6.3. It predates this pull request, so it is not blocking.

Fix: Upgrade qs to 6.16.0 or later in server/yarn.lock.

semver 5.7.1 has 1 known advisory — server/yarn.lock:1800

Bug: CVE-2022-25883. semver vulnerable to Regular Expression Denial of Service

Cause: server/yarn.lock resolves semver to 5.7.1, which OSV lists as affected by 1 advisory. Highest CVSS 7.5. It predates this pull request, so it is not blocking.

Fix: Upgrade semver to 7.5.2 or later in server/yarn.lock.

send 0.18.0 has 1 known advisory — server/yarn.lock:1098

Bug: CVE-2024-43799. send vulnerable to template injection that can lead to XSS

Cause: server/yarn.lock resolves send to 0.18.0, which OSV lists as affected by 1 advisory. Highest CVSS 5.0. It predates this pull request, so it is not blocking.

Fix: Upgrade send to 0.19.0 or later in server/yarn.lock.

serve-static 1.15.0 has 1 known advisory — server/yarn.lock:226

Bug: CVE-2024-43800. serve-static vulnerable to template injection that can lead to XSS

Cause: server/yarn.lock resolves serve-static to 1.15.0, which OSV lists as affected by 1 advisory. Highest CVSS 5.0. It predates this pull request, so it is not blocking.

Fix: Upgrade serve-static to 1.16.0 or later in server/yarn.lock.

sha.js 2.4.11 has 1 known advisory — server/yarn.lock:2323

Bug: CVE-2025-9288. sha.js is missing type checks leading to hash rewind and passing on crafted data

Cause: server/yarn.lock resolves sha.js to 2.4.11, which OSV lists as affected by 1 advisory. Highest CVSS 9.1. It predates this pull request, so it is not blocking.

Fix: Upgrade sha.js to 2.4.12 or later in server/yarn.lock.

shell-quote 1.7.4 has 2 known advisories — server/yarn.lock:2345

Bug: CVE-2026-13311, CVE-2026-9277. shell-quote: Quadratic-complexity Denial of Service in parse() (CWE-407)

Cause: server/yarn.lock resolves shell-quote to 1.7.4, which OSV lists as affected by 2 advisories. Highest CVSS 9.2. It predates this pull request, so it is not blocking.

Fix: Upgrade shell-quote to 1.9.0 or later in server/yarn.lock.

toml 2.3.6 has 2 known advisories — server/yarn.lock:2557

Bug: CVE-2026-63376, CVE-2026-77465. toml-node: Uncontrolled Recursion

Cause: server/yarn.lock resolves toml to 2.3.6, which OSV lists as affected by 2 advisories. Highest CVSS 8.2. It predates this pull request, so it is not blocking.

Fix: Upgrade toml to 4.2.0 or later in server/yarn.lock.

typeorm 0.3.11 has 3 known advisories — server/yarn.lock:2661

Bug: CVE-2025-60542, CVE-2026-73651, GHSA-9ggv-8w38-r7pm. TypeORM: migration:generate template-literal code injection

Cause: server/yarn.lock resolves typeorm to 0.3.11, which OSV lists as affected by 3 advisories. Highest CVSS 8.9. It predates this pull request, so it is not blocking.

Impact here: This package is directly reachable during application startup and all database operations through the exported AppDataSource in server/src/db/dataSource.ts.

Fix: Upgrade typeorm to 0.3.31 or later in server/yarn.lock.

uuid 8.3.2 has 1 known advisory — server/yarn.lock:2680

Bug: CVE-2026-41907. uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided

Cause: server/yarn.lock resolves uuid to 8.3.2, which OSV lists as affected by 1 advisory. Highest CVSS 7.5. It predates this pull request, so it is not blocking.

Fix: Upgrade uuid to 11.1.1 or later in server/yarn.lock.

word-wrap 1.2.3 has 1 known advisory — server/yarn.lock:1864

Bug: CVE-2023-26115. word-wrap vulnerable to Regular Expression Denial of Service

Cause: server/yarn.lock resolves word-wrap to 1.2.3, which OSV lists as affected by 1 advisory. Highest CVSS 5.3. It predates this pull request, so it is not blocking.

Fix: Upgrade word-wrap to 1.2.4 or later in server/yarn.lock.

xml2js 0.4.23 has 1 known advisory — server/yarn.lock:2681

Bug: CVE-2023-0842. xml2js is vulnerable to prototype pollution

Cause: server/yarn.lock resolves xml2js to 0.4.23, which OSV lists as affected by 1 advisory. Highest CVSS 5.3. It predates this pull request, so it is not blocking.

Fix: Upgrade xml2js to 0.5.0 or later in server/yarn.lock.

Fix with agent prompt

These are findings from a code review of this pull request. They sit in files the pull request does not change, so they could not be left as inline comments.

## 1. @faker-js/faker 7.6.0 has 1 known advisory
Path: server/yarn.lock
Line: 27
This file is not part of the pull request's diff.

Bug: [CVE-2026-73231](https://osv.dev/vulnerability/CVE-2026-73231). Faker: helpers.fake exploitable into arbritary code execution
Cause: `server/yarn.lock` resolves `@faker-js/faker` to 7.6.0, which OSV lists as affected by 1 advisory. Highest CVSS 7.8. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `@faker-js/faker` to 10.5.0 or later in `server/yarn.lock`.

## 2. @tootallnate/once 1.1.2 has 1 known advisory
Path: server/yarn.lock
Line: 97
This file is not part of the pull request's diff.

Bug: [CVE-2026-3449](https://osv.dev/vulnerability/CVE-2026-3449). @tootallnate/once vulnerable to Incorrect Control Flow Scoping
Cause: `server/yarn.lock` resolves `@tootallnate/once` to 1.1.2, which OSV lists as affected by 1 advisory. Highest CVSS 3.3. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `@tootallnate/once` to 3.0.1 or later in `server/yarn.lock`.

## 3. ajv 6.12.6 has 1 known advisory
Path: server/yarn.lock
Line: 369
This file is not part of the pull request's diff.

Bug: [CVE-2025-69873](https://osv.dev/vulnerability/CVE-2025-69873). ajv has ReDoS when using `$data` option
Cause: `server/yarn.lock` resolves `ajv` to 6.12.6, which OSV lists as affected by 1 advisory. Highest CVSS 5.5. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `ajv` to 8.18.0 or later in `server/yarn.lock`.

## 4. axios 0.25.0 has 23 known advisories
Path: server/yarn.lock
Line: 444
This file is not part of the pull request's diff.

Bug: [CVE-2023-45857](https://osv.dev/vulnerability/CVE-2023-45857), [CVE-2025-27152](https://osv.dev/vulnerability/CVE-2025-27152), [CVE-2025-62718](https://osv.dev/vulnerability/CVE-2025-62718), [CVE-2026-25639](https://osv.dev/vulnerability/CVE-2026-25639), and 19 more. axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
Cause: `server/yarn.lock` resolves `axios` to 0.25.0, which OSV lists as affected by 23 advisories. Highest CVSS 8.6. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `axios` to 1.18.0 or later in `server/yarn.lock`.

## 5. axios 1.2.3 has 9 known advisories
Path: server/yarn.lock
Line: 451
This file is not part of the pull request's diff.

Bug: [CVE-2025-58754](https://osv.dev/vulnerability/CVE-2025-58754), [CVE-2026-101902](https://osv.dev/vulnerability/CVE-2026-101902), [CVE-2026-101904](https://osv.dev/vulnerability/CVE-2026-101904), [CVE-2026-42037](https://osv.dev/vulnerability/CVE-2026-42037), and 5 more. axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
Cause: `server/yarn.lock` resolves `axios` to 1.2.3, which OSV lists as affected by 9 advisories. Highest CVSS 8.7. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `axios` to 1.20.0 or later in `server/yarn.lock`.

## 6. body-parser 1.20.1 has 2 known advisories
Path: server/yarn.lock
Line: 492
This file is not part of the pull request's diff.

Bug: [CVE-2024-45590](https://osv.dev/vulnerability/CVE-2024-45590), [CVE-2026-12590](https://osv.dev/vulnerability/CVE-2026-12590). body-parser vulnerable to denial of service when url encoding is enabled
Cause: `server/yarn.lock` resolves `body-parser` to 1.20.1, which OSV lists as affected by 2 advisories. Highest CVSS 8.7. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `body-parser` to 1.20.6 or later in `server/yarn.lock`.

## 7. brace-expansion 1.1.11 has 8 known advisories
Path: server/yarn.lock
Line: 512
This file is not part of the pull request's diff.

Bug: [CVE-2025-5889](https://osv.dev/vulnerability/CVE-2025-5889), [CVE-2026-102276](https://osv.dev/vulnerability/CVE-2026-102276), [CVE-2026-102277](https://osv.dev/vulnerability/CVE-2026-102277), [CVE-2026-102278](https://osv.dev/vulnerability/CVE-2026-102278), and 4 more. brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups
Cause: `server/yarn.lock` resolves `brace-expansion` to 1.1.11, which OSV lists as affected by 8 advisories. Highest CVSS 7.7. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `brace-expansion` to 5.0.12 or later in `server/yarn.lock`.

## 8. braces 3.0.2 has 2 known advisories
Path: server/yarn.lock
Line: 525
This file is not part of the pull request's diff.

Bug: [CVE-2024-4068](https://osv.dev/vulnerability/CVE-2024-4068), [CVE-2026-93687](https://osv.dev/vulnerability/CVE-2026-93687). Uncontrolled resource consumption in braces
Cause: `server/yarn.lock` resolves `braces` to 3.0.2, which OSV lists as affected by 2 advisories. Highest CVSS 8.7. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `braces` to 3.0.3 or later in `server/yarn.lock`.

## 9. cloudinary 1.33.0 has 1 known advisory
Path: server/yarn.lock
Line: 646
This file is not part of the pull request's diff.

Bug: [CVE-2025-12613](https://osv.dev/vulnerability/CVE-2025-12613). Cloudinary Node SDK is vulnerable to Arbitrary Argument Injection through parameters that include an ampersand
Cause: `server/yarn.lock` resolves `cloudinary` to 1.33.0, which OSV lists as affected by 1 advisory. Highest CVSS 8.8. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `cloudinary` to 2.7.0 or later in `server/yarn.lock`.

## 10. cookie 0.5.0 has 1 known advisory
Path: server/yarn.lock
Line: 724
This file is not part of the pull request's diff.

Bug: [CVE-2024-47764](https://osv.dev/vulnerability/CVE-2024-47764). cookie accepts cookie name, path, and domain with out of bounds characters
Cause: `server/yarn.lock` resolves `cookie` to 0.5.0, which OSV lists as affected by 1 advisory. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `cookie` to 0.7.0 or later in `server/yarn.lock`.

## 11. diff 4.0.2 has 1 known advisory
Path: server/yarn.lock
Line: 843
This file is not part of the pull request's diff.

Bug: [CVE-2026-24001](https://osv.dev/vulnerability/CVE-2026-24001). jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch
Cause: `server/yarn.lock` resolves `diff` to 4.0.2, which OSV lists as affected by 1 advisory. Highest CVSS 2.7. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `diff` to 8.0.3 or later in `server/yarn.lock`.

## 12. express 4.18.2 has 2 known advisories
Path: server/yarn.lock
Line: 1069
This file is not part of the pull request's diff.

Bug: [CVE-2024-29041](https://osv.dev/vulnerability/CVE-2024-29041), [CVE-2024-43796](https://osv.dev/vulnerability/CVE-2024-43796). express vulnerable to XSS via response.redirect()
Cause: `server/yarn.lock` resolves `express` to 4.18.2, which OSV lists as affected by 2 advisories. Highest CVSS 6.1. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `express` to 4.20.0 or later in `server/yarn.lock`.

## 13. flatted 3.2.7 has 2 known advisories
Path: server/yarn.lock
Line: 1194
This file is not part of the pull request's diff.

Bug: [CVE-2026-32141](https://osv.dev/vulnerability/CVE-2026-32141), [CVE-2026-33228](https://osv.dev/vulnerability/CVE-2026-33228). flatted vulnerable to unbounded recursion DoS in parse() revive phase
Cause: `server/yarn.lock` resolves `flatted` to 3.2.7, which OSV lists as affected by 2 advisories. Highest CVSS 8.9. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `flatted` to 3.4.2 or later in `server/yarn.lock`.

## 14. follow-redirects 1.15.2 has 3 known advisories
Path: server/yarn.lock
Line: 1199
This file is not part of the pull request's diff.

Bug: [CVE-2023-26159](https://osv.dev/vulnerability/CVE-2023-26159), [CVE-2024-28849](https://osv.dev/vulnerability/CVE-2024-28849), [CVE-2026-40895](https://osv.dev/vulnerability/CVE-2026-40895). follow-redirects' Proxy-Authorization header kept across hosts
Cause: `server/yarn.lock` resolves `follow-redirects` to 1.15.2, which OSV lists as affected by 3 advisories. Highest CVSS 6.9. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `follow-redirects` to 1.16.0 or later in `server/yarn.lock`.

## 15. form-data 4.0.0 has 2 known advisories
Path: server/yarn.lock
Line: 457
This file is not part of the pull request's diff.

Bug: [CVE-2025-7783](https://osv.dev/vulnerability/CVE-2025-7783), [CVE-2026-12143](https://osv.dev/vulnerability/CVE-2026-12143). form-data uses unsafe random function in form-data for choosing boundary
Cause: `server/yarn.lock` resolves `form-data` to 4.0.0, which OSV lists as affected by 2 advisories. Highest CVSS 9.4. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `form-data` to 2.5.6 or later in `server/yarn.lock`.

## 16. ip 1.1.8 has 2 known advisories
Path: server/yarn.lock
Line: 1450
This file is not part of the pull request's diff.

Bug: [CVE-2023-42282](https://osv.dev/vulnerability/CVE-2023-42282), [CVE-2024-29415](https://osv.dev/vulnerability/CVE-2024-29415). ip SSRF improper categorization in isPublic
Cause: `server/yarn.lock` resolves `ip` to 1.1.8, which OSV lists as affected by 2 advisories. Highest CVSS 8.1. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `ip` to 2.0.1 or later in `server/yarn.lock`.

## 17. js-yaml 4.1.0 has 5 known advisories
Path: server/yarn.lock
Line: 23
This file is not part of the pull request's diff.

Bug: [CVE-2025-64718](https://osv.dev/vulnerability/CVE-2025-64718), [CVE-2026-53550](https://osv.dev/vulnerability/CVE-2026-53550), [CVE-2026-59869](https://osv.dev/vulnerability/CVE-2026-59869), [CVE-2026-84375](https://osv.dev/vulnerability/CVE-2026-84375), and 1 more. js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources
Cause: `server/yarn.lock` resolves `js-yaml` to 4.1.0, which OSV lists as affected by 5 advisories. Highest CVSS 7.5. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `js-yaml` to 4.3.2 or later in `server/yarn.lock`.

## 18. jws 3.2.2 has 1 known advisory
Path: server/yarn.lock
Line: 1554
This file is not part of the pull request's diff.

Bug: [CVE-2025-65945](https://osv.dev/vulnerability/CVE-2025-65945). auth0/node-jws Improperly Verifies HMAC Signature
Cause: `server/yarn.lock` resolves `jws` to 3.2.2, which OSV lists as affected by 1 advisory. Highest CVSS 7.5. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `jws` to 3.2.3 or later in `server/yarn.lock`.

## 19. lodash 4.17.21 has 2 known advisories
Path: server/yarn.lock
Line: 653
This file is not part of the pull request's diff.

Bug: [CVE-2021-23337](https://osv.dev/vulnerability/CVE-2021-23337), [CVE-2025-13465](https://osv.dev/vulnerability/CVE-2025-13465). lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`
Cause: `server/yarn.lock` resolves `lodash` to 4.17.21, which OSV lists as affected by 2 advisories. Highest CVSS 8.1. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `lodash` to 4.18.0 or later in `server/yarn.lock`.

## 20. micromatch 4.0.5 has 1 known advisory
Path: server/yarn.lock
Line: 1663
This file is not part of the pull request's diff.

Bug: [CVE-2024-4067](https://osv.dev/vulnerability/CVE-2024-4067). Regular Expression Denial of Service (ReDoS) in micromatch
Cause: `server/yarn.lock` resolves `micromatch` to 4.0.5, which OSV lists as affected by 1 advisory. Highest CVSS 5.3. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `micromatch` to 4.0.8 or later in `server/yarn.lock`.

## 21. minimatch 3.1.2 has 3 known advisories
Path: server/yarn.lock
Line: 24
This file is not part of the pull request's diff.

Bug: [CVE-2026-26996](https://osv.dev/vulnerability/CVE-2026-26996), [CVE-2026-27903](https://osv.dev/vulnerability/CVE-2026-27903), [CVE-2026-27904](https://osv.dev/vulnerability/CVE-2026-27904). minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions
Cause: `server/yarn.lock` resolves `minimatch` to 3.1.2, which OSV lists as affected by 3 advisories. Highest CVSS 8.7. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `minimatch` to 10.2.3 or later in `server/yarn.lock`.

## 22. morgan 1.10.0 has 3 known advisories
Path: server/yarn.lock
Line: 1717
This file is not part of the pull request's diff.

Bug: [CVE-2026-15603](https://osv.dev/vulnerability/CVE-2026-15603), [CVE-2026-5078](https://osv.dev/vulnerability/CVE-2026-5078), [CVE-2026-87859](https://osv.dev/vulnerability/CVE-2026-87859). morgan vulnerable to Log Forging via unneutralized control characters in :remote-user
Cause: `server/yarn.lock` resolves `morgan` to 1.10.0, which OSV lists as affected by 3 advisories. Highest CVSS 5.3. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `morgan` to 1.12.1 or later in `server/yarn.lock`.

## 23. multer 1.4.5-lts.1 has 11 known advisories
Path: server/yarn.lock
Line: 1743
This file is not part of the pull request's diff.

Bug: [CVE-2025-47935](https://osv.dev/vulnerability/CVE-2025-47935), [CVE-2025-47944](https://osv.dev/vulnerability/CVE-2025-47944), [CVE-2025-48997](https://osv.dev/vulnerability/CVE-2025-48997), [CVE-2025-7338](https://osv.dev/vulnerability/CVE-2025-7338), and 7 more. Multer vulnerable to Denial of Service via memory leaks from unclosed streams
Cause: `server/yarn.lock` resolves `multer` to 1.4.5-lts.1, which OSV lists as affected by 11 advisories. Highest CVSS 8.7. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `multer` to 2.3.0 or later in `server/yarn.lock`.

## 24. on-headers 1.0.2 has 1 known advisory
Path: server/yarn.lock
Line: 1726
This file is not part of the pull request's diff.

Bug: [CVE-2025-7339](https://osv.dev/vulnerability/CVE-2025-7339). on-headers is vulnerable to http response header manipulation
Cause: `server/yarn.lock` resolves `on-headers` to 1.0.2, which OSV lists as affected by 1 advisory. Highest CVSS 3.4. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `on-headers` to 1.1.0 or later in `server/yarn.lock`.

## 25. path-to-regexp 0.1.7 has 2 known advisories
Path: server/yarn.lock
Line: 1093
This file is not part of the pull request's diff.

Bug: [CVE-2024-45296](https://osv.dev/vulnerability/CVE-2024-45296), [CVE-2024-52798](https://osv.dev/vulnerability/CVE-2024-52798). path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters
Cause: `server/yarn.lock` resolves `path-to-regexp` to 0.1.7, which OSV lists as affected by 2 advisories. Highest CVSS 7.7. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `path-to-regexp` to 0.1.13 or later in `server/yarn.lock`.

## 26. picomatch 2.3.1 has 2 known advisories
Path: server/yarn.lock
Line: 1667
This file is not part of the pull request's diff.

Bug: [CVE-2026-33671](https://osv.dev/vulnerability/CVE-2026-33671), [CVE-2026-33672](https://osv.dev/vulnerability/CVE-2026-33672). Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching
Cause: `server/yarn.lock` resolves `picomatch` to 2.3.1, which OSV lists as affected by 2 advisories. Highest CVSS 7.5. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `picomatch` to 4.0.4 or later in `server/yarn.lock`.

## 27. proxy-addr 2.0.7 has 1 known advisory
Path: server/yarn.lock
Line: 1094
This file is not part of the pull request's diff.

Bug: [CVE-2026-90711](https://osv.dev/vulnerability/CVE-2026-90711). proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet
Cause: `server/yarn.lock` resolves `proxy-addr` to 2.0.7, which OSV lists as affected by 1 advisory. Highest CVSS 9.1. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `proxy-addr` to 2.0.8 or later in `server/yarn.lock`.

## 28. qs 6.11.0 has 3 known advisories
Path: server/yarn.lock
Line: 505
This file is not part of the pull request's diff.

Bug: [CVE-2025-15284](https://osv.dev/vulnerability/CVE-2025-15284), [CVE-2026-2391](https://osv.dev/vulnerability/CVE-2026-2391), [CVE-2026-82417](https://osv.dev/vulnerability/CVE-2026-82417). qs: Denial of Service via Attacker Controlled isBuffer
Cause: `server/yarn.lock` resolves `qs` to 6.11.0, which OSV lists as affected by 3 advisories. Highest CVSS 6.3. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `qs` to 6.16.0 or later in `server/yarn.lock`.

## 29. semver 5.7.1 has 1 known advisory
Path: server/yarn.lock
Line: 1800
This file is not part of the pull request's diff.

Bug: [CVE-2022-25883](https://osv.dev/vulnerability/CVE-2022-25883). semver vulnerable to Regular Expression Denial of Service
Cause: `server/yarn.lock` resolves `semver` to 5.7.1, which OSV lists as affected by 1 advisory. Highest CVSS 7.5. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `semver` to 7.5.2 or later in `server/yarn.lock`.

## 30. send 0.18.0 has 1 known advisory
Path: server/yarn.lock
Line: 1098
This file is not part of the pull request's diff.

Bug: [CVE-2024-43799](https://osv.dev/vulnerability/CVE-2024-43799). send vulnerable to template injection that can lead to XSS
Cause: `server/yarn.lock` resolves `send` to 0.18.0, which OSV lists as affected by 1 advisory. Highest CVSS 5.0. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `send` to 0.19.0 or later in `server/yarn.lock`.

## 31. serve-static 1.15.0 has 1 known advisory
Path: server/yarn.lock
Line: 226
This file is not part of the pull request's diff.

Bug: [CVE-2024-43800](https://osv.dev/vulnerability/CVE-2024-43800). serve-static vulnerable to template injection that can lead to XSS
Cause: `server/yarn.lock` resolves `serve-static` to 1.15.0, which OSV lists as affected by 1 advisory. Highest CVSS 5.0. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `serve-static` to 1.16.0 or later in `server/yarn.lock`.

## 32. sha.js 2.4.11 has 1 known advisory
Path: server/yarn.lock
Line: 2323
This file is not part of the pull request's diff.

Bug: [CVE-2025-9288](https://osv.dev/vulnerability/CVE-2025-9288). sha.js is missing type checks leading to hash rewind and passing on crafted data
Cause: `server/yarn.lock` resolves `sha.js` to 2.4.11, which OSV lists as affected by 1 advisory. Highest CVSS 9.1. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `sha.js` to 2.4.12 or later in `server/yarn.lock`.

## 33. shell-quote 1.7.4 has 2 known advisories
Path: server/yarn.lock
Line: 2345
This file is not part of the pull request's diff.

Bug: [CVE-2026-13311](https://osv.dev/vulnerability/CVE-2026-13311), [CVE-2026-9277](https://osv.dev/vulnerability/CVE-2026-9277). shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)
Cause: `server/yarn.lock` resolves `shell-quote` to 1.7.4, which OSV lists as affected by 2 advisories. Highest CVSS 9.2. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `shell-quote` to 1.9.0 or later in `server/yarn.lock`.

## 34. toml 2.3.6 has 2 known advisories
Path: server/yarn.lock
Line: 2557
This file is not part of the pull request's diff.

Bug: [CVE-2026-63376](https://osv.dev/vulnerability/CVE-2026-63376), [CVE-2026-77465](https://osv.dev/vulnerability/CVE-2026-77465). toml-node: Uncontrolled Recursion
Cause: `server/yarn.lock` resolves `toml` to 2.3.6, which OSV lists as affected by 2 advisories. Highest CVSS 8.2. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `toml` to 4.2.0 or later in `server/yarn.lock`.

## 35. typeorm 0.3.11 has 3 known advisories
Path: server/yarn.lock
Line: 2661
This file is not part of the pull request's diff.

Bug: [CVE-2025-60542](https://osv.dev/vulnerability/CVE-2025-60542), [CVE-2026-73651](https://osv.dev/vulnerability/CVE-2026-73651), [GHSA-9ggv-8w38-r7pm](https://osv.dev/vulnerability/GHSA-9ggv-8w38-r7pm). TypeORM: migration:generate template-literal code injection
Cause: `server/yarn.lock` resolves `typeorm` to 0.3.11, which OSV lists as affected by 3 advisories. Highest CVSS 8.9. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `typeorm` to 0.3.31 or later in `server/yarn.lock`.

## 36. uuid 8.3.2 has 1 known advisory
Path: server/yarn.lock
Line: 2680
This file is not part of the pull request's diff.

Bug: [CVE-2026-41907](https://osv.dev/vulnerability/CVE-2026-41907). uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided
Cause: `server/yarn.lock` resolves `uuid` to 8.3.2, which OSV lists as affected by 1 advisory. Highest CVSS 7.5. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `uuid` to 11.1.1 or later in `server/yarn.lock`.

## 37. word-wrap 1.2.3 has 1 known advisory
Path: server/yarn.lock
Line: 1864
This file is not part of the pull request's diff.

Bug: [CVE-2023-26115](https://osv.dev/vulnerability/CVE-2023-26115). word-wrap vulnerable to Regular Expression Denial of Service
Cause: `server/yarn.lock` resolves `word-wrap` to 1.2.3, which OSV lists as affected by 1 advisory. Highest CVSS 5.3. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `word-wrap` to 1.2.4 or later in `server/yarn.lock`.

## 38. xml2js 0.4.23 has 1 known advisory
Path: server/yarn.lock
Line: 2681
This file is not part of the pull request's diff.

Bug: [CVE-2023-0842](https://osv.dev/vulnerability/CVE-2023-0842). xml2js is vulnerable to prototype pollution
Cause: `server/yarn.lock` resolves `xml2js` to 0.4.23, which OSV lists as affected by 1 advisory. Highest CVSS 5.3. It predates this pull request, so it is not blocking.
Suggested fix:
- Upgrade `xml2js` to 0.5.0 or later in `server/yarn.lock`.

---

For each finding above, determine whether it is valid and should be fixed. If so, fix it directly. Where a finding offers several remedies, pick one and say why. Leave the pull request's own changed files alone unless a fix requires touching them.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Oct 8, 2026

dependabot Bot mentioned this pull request Oct 8, 2026

Bump vm2 from 3.9.13 to 3.11.6 in /server #104

Closed

xhawk-ai Bot reviewed Oct 8, 2026

View reviewed changes

Navigation Menu

Repository navigation

Bump vm2 from 3.9.13 to 3.12.2 in /server - #112

Bump vm2 from 3.9.13 to 3.12.2 in /server#112
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/npm_and_yarn/server/vm2-3.12.2

dependabot Bot commented on behalf of github Oct 8, 2026

Uh oh!

xhawk-ai Bot left a comment •

edited

Loading

Uh oh!

xhawk-ai Bot commented Oct 8, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 8, 2026

v3.12.2

What's Changed

Security fixes

Fixed

Maintenance

Documentation

Upgrade Notes

v3.12.1

What's Changed

Security fixes

Documentation

[3.12.2]

Security fixes

Fixed

Maintenance

[3.12.1]

Security fixes

[3.12.0]

Added

Maintenance

[3.11.8]

Security fixes

Uh oh!

xhawk-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

📋 Review Summary — Ready to merge

Summary

Findings

Uh oh!

xhawk-ai Bot commented Oct 8, 2026

Findings Outside the Diff

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

xhawk-ai Bot left a comment •

edited

Loading