�[0m�[1mbun audit �[0m�[2mv1.3.14 (0d9b296a)�[0m
dompurify <=3.4.11
(direct dependency)
workspace:@tinycode/ui › dompurify
low: DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements. - https://github.com/advisories/GHSA-c2j3-45gr-mqc4
moderate: DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS - https://github.com/advisories/GHSA-55q2-fjhq-7xh7
@hono/node-server <2.0.5
workspace:tinycode › @modelcontextprotocol/sdk
moderate: Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`) - https://github.com/advisories/GHSA-frvp-7c67-39w9
valibot <=1.4.1
workspace:@tinycode/desktop › @valibot/to-json-schema
workspace:@tinycode/desktop › drizzle-orm
moderate: Valibot: record() issue paths can make flatten() throw for inherited Object property names - https://github.com/advisories/GHSA-5qjj-4xww-7phc
brace-expansion <1.1.17
workspace:tinycode › minimatch
high: brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash - https://github.com/advisories/GHSA-mh99-v99m-4gvg
high: brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash - https://github.com/advisories/GHSA-mh99-v99m-4gvg
high: brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash - https://github.com/advisories/GHSA-mh99-v99m-4gvg
high: brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation - https://github.com/advisories/GHSA-rgw5-rvv9-x895
high: brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation - https://github.com/advisories/GHSA-rgw5-rvv9-x895
high: brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation - https://github.com/advisories/GHSA-rgw5-rvv9-x895
high: brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups - https://github.com/advisories/GHSA-3jxr-9vmj-r5cp
high: brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups - https://github.com/advisories/GHSA-3jxr-9vmj-r5cp
high: brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups - https://github.com/advisories/GHSA-3jxr-9vmj-r5cp
socket.io-parser >=4.0.0 <4.2.7
workspace:tinycode › gitlab-ai-provider
high: Socket.IO: Zero-attachment Memory Exhaustion - https://github.com/advisories/GHSA-2m8v-j782-fhvr
undici <6.23.0
workspace:tinycode › @actions/github
workspace:@tinycode/http-recorder › @effect/platform-node
workspace:@tinycode/desktop › @actions/artifact
workspace:tinycode › @actions/core
workspace:@tinycode/desktop › electron
workspace:@tinycode/desktop › electron-builder
workspace:tinycode › @npmcli/arborist
moderate: Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion - https://github.com/advisories/GHSA-g9mf-h72j-4rw9
moderate: Undici has an HTTP Request/Response Smuggling issue - https://github.com/advisories/GHSA-2mjp-6q6p-2qxm
high: Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression - https://github.com/advisories/GHSA-vrm6-8vpv-qv8q
high: Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation - https://github.com/advisories/GHSA-v9p9-hfj2-hcw8
moderate: Undici has CRLF Injection in undici via `upgrade` option - https://github.com/advisories/GHSA-4992-7rv2-5pvq
moderate: undici vulnerable to downstream response desynchronization via retry interceptor - https://github.com/advisories/GHSA-8xcm-r25x-g524
moderate: undici vulnerable to downstream response desynchronization via retry interceptor - https://github.com/advisories/GHSA-8xcm-r25x-g524
moderate: undici vulnerable to downstream response desynchronization via retry interceptor - https://github.com/advisories/GHSA-8xcm-r25x-g524
high: undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives - https://github.com/advisories/GHSA-4cwx-7wf7-3272
high: undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives - https://github.com/advisories/GHSA-4cwx-7wf7-3272
moderate: undici vulnerable to CRLF Injection via blob-like body 'type' property - https://github.com/advisories/GHSA-m8rv-5g2x-5cg5
moderate: undici vulnerable to CRLF Injection via blob-like body 'type' property - https://github.com/advisories/GHSA-m8rv-5g2x-5cg5
moderate: undici vulnerable to CRLF Injection via blob-like body 'type' property - https://github.com/advisories/GHSA-m8rv-5g2x-5cg5
moderate: undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives - https://github.com/advisories/GHSA-jr45-8vmc-qm54
moderate: undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives - https://github.com/advisories/GHSA-jr45-8vmc-qm54
moderate: undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields - https://github.com/advisories/GHSA-v3r7-h72x-cjcm
moderate: undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields - https://github.com/advisories/GHSA-v3r7-h72x-cjcm
moderate: undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields - https://github.com/advisories/GHSA-v3r7-h72x-cjcm
high: undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent - https://github.com/advisories/GHSA-vmh5-mc38-953g
high: undici WebSocket client vulnerable to denial of service via cumulative fragment bypass - https://github.com/advisories/GHSA-38rv-x7px-6hhq
moderate: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding - https://github.com/advisories/GHSA-p88m-4jfj-68fv
moderate: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding - https://github.com/advisories/GHSA-p88m-4jfj-68fv
high: undici WebSocket client vulnerable to denial of service via fragment count bypass - https://github.com/advisories/GHSA-vxpw-j846-p89q
high: undici WebSocket client vulnerable to denial of service via fragment count bypass - https://github.com/advisories/GHSA-vxpw-j846-p89q
low: undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching - https://github.com/advisories/GHSA-g8m3-5g58-fq7m
low: undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching - https://github.com/advisories/GHSA-g8m3-5g58-fq7m
moderate: undici vulnerable to cross-user information disclosure via shared cache whitespace bypass - https://github.com/advisories/GHSA-pr7r-676h-xcf6
low: undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse - https://github.com/advisories/GHSA-35p6-xmwp-9g52
low: undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse - https://github.com/advisories/GHSA-35p6-xmwp-9g52
minimatch >=10.0.0 <10.2.1
(direct dependency)
workspace:tinycode › minimatch
workspace:tinycode › @npmcli/arborist
workspace:tinycode › glob
workspace:tinycode › @npmcli/config
workspace:@tinycode/desktop › electron-builder
workspace:@tinycode/desktop › @actions/artifact
high: minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern - https://github.com/advisories/GHSA-3ppc-4f35-3m26
high: minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments - https://github.com/advisories/GHSA-7r86-cg39-jmmj
high: minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions - https://github.com/advisories/GHSA-23c5-xmqv-rm74
form-data >=4.0.0 <4.0.6
workspace:@tinycode/desktop › @actions/artifact
workspace:@tinycode/desktop › electron-builder
workspace:tinycode › @types/npmcli__arborist
high: form-data: CRLF injection in form-data via unescaped multipart field names and filenames - https://github.com/advisories/GHSA-hmw2-7cc7-3qxx
uuid <11.1.1
workspace:@tinycode/app › effect
workspace:@tinycode/desktop › @actions/artifact
moderate: uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided - https://github.com/advisories/GHSA-w5hq-g745-h8pq
diff >=6.0.0 <8.0.3
(direct dependency)
workspace:@tinycode/app › diff
workspace:tinycode › diff
workspace:@tinycode/ui › diff
workspace:@tinycode/plugin › @opentui/core
workspace:tinycode › @pierre/diffs
low: jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch - https://github.com/advisories/GHSA-73rr-hh4g-fpgx
@hey-api/openapi-ts <0.97.3
workspace:@tinycode/sdk › @hey-api/openapi-ts
moderate: @hey-api/openapi-ts's `buildClientParams` template: prototype chain substitution via unknown `$<slot>___proto__` key - https://github.com/advisories/GHSA-hhx9-57xq-r5rw
seroval <=1.4.0
workspace:@tinycode/app › solid-js
high: Seroval affected by Denial of Service via Array serialization - https://github.com/advisories/GHSA-66fc-rw6m-c2q6
high: seroval Affected by Remote Code Execution via JSON Deserialization - https://github.com/advisories/GHSA-3rxj-6cgf-8cfw
high: seroval Affected by Prototype Pollution via JSON Deserialization - https://github.com/advisories/GHSA-hj76-42vx-jwp4
high: Seroval affected by Denial of Service via Deeply Nested Objects - https://github.com/advisories/GHSA-3j22-8qj3-26mx
high: seroval affected by Denial of Service via RegExp serialization - https://github.com/advisories/GHSA-hx9m-jf43-8ffr
critical: seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization - https://github.com/advisories/GHSA-mv8w-475r-vwqw
@opentelemetry/core <2.8.0
workspace:tinycode › @opentelemetry/exporter-trace-otlp-http
workspace:tinycode › @opentelemetry/sdk-trace-base
workspace:tinycode › @opentelemetry/sdk-trace-node
workspace:tinycode › @effect/opentelemetry
moderate: OpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagation - https://github.com/advisories/GHSA-8988-4f7v-96qf
body-parser >=2.0.0 <2.3.0
workspace:tinycode › @modelcontextprotocol/sdk
low: body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement - https://github.com/advisories/GHSA-v422-hmwv-36x6
electron >=42.0.0-alpha.1 <42.5.1
workspace:@tinycode/desktop › electron
moderate: Electron: ProtocolResponse.url reuses the default session cache instead of the registering session - https://github.com/advisories/GHSA-r4w5-6pfg-jxp5
ip-address <=10.3.0
workspace:tinycode › @modelcontextprotocol/sdk
workspace:tinycode › @npmcli/arborist
workspace:@tinycode/desktop › electron-builder
high: ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass - https://github.com/advisories/GHSA-mwp4-54f8-5fhr
moderate: ip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checks - https://github.com/advisories/GHSA-4xrf-jv44-h6hh
moderate: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checks - https://github.com/advisories/GHSA-22jq-vg5j-6vgg
nanoid <3.3.16
workspace:@tinycode/app › vite
high: nanoid: non-secure generators can loop indefinitely with negative size - https://github.com/advisories/GHSA-28wg-ghj8-5hjv
high: nanoid: custom generators can loop indefinitely when size is zero - https://github.com/advisories/GHSA-2v37-7h3g-55p8
postcss <=8.5.22
workspace:@tinycode/app › vite
moderate: PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset - https://github.com/advisories/GHSA-fxqj-rqcc-2cmp
high: PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure - https://github.com/advisories/GHSA-r28c-9q8g-f849
@babel/core <=7.29.0
workspace:tinycode › @babel/core
workspace:@tinycode/plugin › @opentui/solid
workspace:@tinycode/desktop › electron-vite
workspace:@tinycode/app › vite-plugin-solid
workspace:tinycode › @babel/core
workspace:@tinycode/desktop › @sentry/vite-plugin
low: @babel/core: Arbitrary File Read via sourceMappingURL Comment - https://github.com/advisories/GHSA-4x5r-pxfx-6jf8
tar <=7.5.17
workspace:@tinycode/app › @tailwindcss/vite
workspace:@tinycode/desktop › electron-builder
workspace:tinycode › @npmcli/arborist
moderate: node-tar: Process crash via PAX numeric path type confusion - https://github.com/advisories/GHSA-w8wr-v893-vjvp
critical: node-tar: Decompression/parse DoS via unlimited input - https://github.com/advisories/GHSA-23hp-3jrh-7fpw
high: node-tar: Negative tar entry size causes infinite loop in archive replace - https://github.com/advisories/GHSA-8x88-c5mf-7j5w
moderate: node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records - https://github.com/advisories/GHSA-gvwx-54wh-qm9j
moderate: node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection - https://github.com/advisories/GHSA-r292-9mhp-454m
vite >=7.1.0 <=7.1.4
workspace:@tinycode/app › vite
workspace:@tinycode/desktop › vite
workspace:@tinycode/ui › vite
workspace:@tinycode/app › @tailwindcss/vite
workspace:@tinycode/desktop › electron-vite
workspace:@tinycode/app › vite-plugin-icons-spritesheet
workspace:@tinycode/app › vite-plugin-solid
low: Vite middleware may serve files starting with the same name with the public directory - https://github.com/advisories/GHSA-g4jq-h2w9-997c
low: Vite's `server.fs` settings were not applied to HTML files - https://github.com/advisories/GHSA-jqfw-vq24-v9c3
moderate: vite allows server.fs.deny bypass via backslash on Windows - https://github.com/advisories/GHSA-93m4-6634-74q7
moderate: launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows - https://github.com/advisories/GHSA-v6wh-96g9-6wx3
moderate: Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling - https://github.com/advisories/GHSA-4w7w-66w2-5vf9
high: Vite: `server.fs.deny` bypassed with queries - https://github.com/advisories/GHSA-v2wj-q39q-566r
high: Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket - https://github.com/advisories/GHSA-p9ff-h696-f583
high: vite: `server.fs.deny` bypass on Windows alternate paths - https://github.com/advisories/GHSA-fx2h-pf6j-xcff
find-my-way <=9.6.0
workspace:tinycode › opencode-gitlab-auth
high: find-my-way: DDoS with HTTP2 - https://github.com/advisories/GHSA-c96f-x56v-gq3h
hono <4.12.34
(direct dependency)
workspace:tinycode › @modelcontextprotocol/sdk
workspace:tinycode › @openauthjs/openauth
moderate: Hono: ReDoS in CORS middleware via Access-Control-Request-Headers - https://github.com/advisories/GHSA-8j4g-w8fx-2239
moderate: hono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length` - https://github.com/advisories/GHSA-rv63-4mwf-qqc2
moderate: hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest - https://github.com/advisories/GHSA-wgpf-jwqj-8h8p
high: hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard - https://github.com/advisories/GHSA-88fw-hqm2-52qc
moderate: hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`) - https://github.com/advisories/GHSA-wwfh-h76j-fc44
moderate: hono: AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and Lattice - https://github.com/advisories/GHSA-j6c9-x7qj-28xf
moderate: Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication - https://github.com/advisories/GHSA-xgm2-5f3f-mvvc
moderate: hono/jsx does not isolate context per request, leading to cross-request data disclosure - https://github.com/advisories/GHSA-hvrm-45r6-mjfj
moderate: Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility - https://github.com/advisories/GHSA-w62v-xxxg-mg59
moderate: Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure - https://github.com/advisories/GHSA-f23p-vx2j-j53r
low: Hono: Proxy Helper does not remove response headers listed in the `Connection` header - https://github.com/advisories/GHSA-79qm-7rj5-m7r9
moderate: Hono: Algorithmic Complexity DoS in Language Middleware - https://github.com/advisories/GHSA-54fx-42gc-7vw4
js-yaml <3.15.0
workspace:@tinycode/desktop › electron-updater
workspace:tinycode › gray-matter
workspace:@tinycode/sdk › @hey-api/openapi-ts
workspace:@tinycode/desktop › electron-builder
moderate: JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases - https://github.com/advisories/GHSA-h67p-54hq-rp68
high: js-yaml: YAML merge-key chains can force quadratic CPU consumption - https://github.com/advisories/GHSA-52cp-r559-cp3m
high: js-yaml: YAML merge-key chains can force quadratic CPU consumption - https://github.com/advisories/GHSA-52cp-r559-cp3m
high: JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported - https://github.com/advisories/GHSA-5p4m-2wfm-xmqj
high: JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported - https://github.com/advisories/GHSA-5p4m-2wfm-xmqj
protobufjs <=7.6.2
workspace:tinycode › @opentelemetry/exporter-trace-otlp-http
moderate: protobufjs : Schema-derived names can shadow runtime-significant properties - https://github.com/advisories/GHSA-f38q-mgvj-vph7
moderate: protobufjs: Denial of Service via infinite loop in .proto option parsing - https://github.com/advisories/GHSA-j3f2-48v5-ccww
fast-uri >=3.0.0 <3.1.5
workspace:tinycode › @modelcontextprotocol/sdk
workspace:tinycode › opencode-gitlab-auth
workspace:@tinycode/desktop › electron-builder
workspace:@tinycode/desktop › electron-store
high: fast-uri vulnerable to host confusion via backslash authority introducer - https://github.com/advisories/GHSA-7p8r-x3mc-p8w7
high: fast-uri vulnerable to host confusion via literal backslash authority delimiter - https://github.com/advisories/GHSA-v2hh-gcrm-f6hx
high: fast-uri vulnerable to host confusion via failed IDN canonicalization - https://github.com/advisories/GHSA-4c8g-83qw-93j6
103 vulnerabilities (2 critical, 44 high, 46 moderate, 11 low)
To update all dependencies to the latest compatible versions:
bun update
To update all dependencies to the latest versions (including breaking changes):
bun update --latest
Audit Results