{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T14:52:03.107635Z","repo":{"ref":{"host":"github.com","owner":"blaxel-templates","name":"cookbook"},"default_branch":"main","clone_url":"https://github.com/blaxel-templates/cookbook.git","html_url":"https://github.com/blaxel-templates/cookbook","description":null,"stars":1,"forks":0,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":1213,"primary_language":"TypeScript","license_spdx":"MIT","created_at":"2025-07-16T21:08:30Z","pushed_at":"2026-10-29T22:33:21Z","security_policy_url":null,"distribution":{"owner_created_at":"2025-05-10T18:15:24Z","owner_type":"Organization","release_assets":[]}},"commit_sha":"c95d2e92368c6727e6398d292104e8f423393c3c","profile":{"lines_by_language":{"TypeScript":3447,"JavaScript":104,"Shell":98},"files_by_category":{"source":32,"config":18,"other":12,"docs":6,"binary":3,"test":1},"source_lines":3586,"test_lines":63},"pillars":{"ai_provenance":{"score":0.1,"confidence":0.5,"coverage":1.0,"label":"possible","breakdown":{"attributed_share":0.0009,"suspected_share":0.0,"estimated_share":0.0009,"ai_artifacts":0.0,"flagged_work_units":0.0,"flagged_releases":null,"style_index":5.996},"summary":"Weak signals consistent with AI-assisted development. 1 commit(s) carry explicit AI attribution, too few to characterize the codebase. Comments and strings use phrasing typical of LLM-written code (see the coding style evidence)."},"quality":{"score":48.5,"confidence":0.9,"coverage":1.0,"label":"poor","breakdown":{"complexity":26.4,"duplication":86.9,"lint":68.2,"testing":22.3,"docs":65.0,"type_safety":60.0,"process":null},"summary":"Code quality is poor: test-to-source ratio 0.02, no CI test run detected; 44% of function code in complex or long functions; 2% duplicated lines. Weakest area: testing."},"security":{"score":52.1,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":100.0,"sast":70.4,"dependencies":0.0,"ci_actions":null,"posture":0.0,"scorecard":null},"summary":"Security posture is weak: 392 known vulnerabilities in 76 dependencies; 2 high-severity SAST findings. Weakest area: dependencies."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":33.0,"checked":33.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":41.0,"attributed_commits":1.0,"attributed_commit_share":0.024390243902439025,"effective_loc":5648.0,"attributed_loc":5.0,"attributed_loc_share":0.0008852691218130312,"tools_detected":1.0},"findings":[],"evidence":[{"kind":"attribution-summary","description":"Claude Code: 1 attributed commits, 5 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"f165963119dbf31e4c41687dc57245078c8d9df5","url":"https://github.com/blaxel-templates/cookbook/commit/f165963119dbf31e4c41687dc57245078c8d9df5","weight":0.9}],"data":{"attributed_loc_by_commit":{"f165963119dbf31e4c41687dc57245078c8d9df5":5},"tools":{"claude-code":{"name":"Claude Code","commits":1,"loc":5,"first_seen":1793245072,"last_seen":1793245072}},"monthly":{"2025-07":{"loc":949,"attributed_loc":0},"2025-08":{"loc":107,"attributed_loc":0},"2025-10":{"loc":1967,"attributed_loc":0},"2025-11":{"loc":254,"attributed_loc":0},"2025-12":{"loc":8,"attributed_loc":0},"2026-01":{"loc":184,"attributed_loc":0},"2026-02":{"loc":1910,"attributed_loc":0},"2026-04":{"loc":170,"attributed_loc":0},"2026-08":{"loc":0,"attributed_loc":0},"2026-10":{"loc":99,"attributed_loc":5}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":22.0,"flagged_units":0.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":5648.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":365.75,"median_loc_per_hour":118.625,"pr_timed_units":3.0,"excluded_import_loc":0.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":[]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":3586.0,"index":5.996,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":43.0,"per_kloc:emoji_in_code":11.991,"files:emoji_in_code":5.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":2.0,"findings_high":2.0,"findings_medium":0.0,"findings_low":0.0,"weighted_findings":3.6,"scanned_lines":3586.0,"parse_errors":0.0},"findings":[{"rule_id":"opengrep/dockerfile.security.missing-user-entrypoint","severity":"high","message":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium]","path":"coval/codegen-sandbox/Dockerfile","line":24,"fingerprint":"dockerfile.security.missing-user-entrypoint:coval/codegen-sandbox/Dockerfile:24"},{"rule_id":"opengrep/dockerfile.security.missing-user-entrypoint","severity":"high","message":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium]","path":"pr-review-agent/pr-review-sandbox/Dockerfile","line":24,"fingerprint":"dockerfile.security.missing-user-entrypoint:pr-review-agent/pr-review-sandbox/Dockerfile:24"}],"evidence":[],"data":{"rulesets":["typescript","javascript","bash","dockerfile"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":76.0,"vulnerabilities":392.0,"vulns_critical":12.0,"vulns_high":164.0,"vulns_medium":191.0,"vulns_low":22.0,"vulns_unknown":3.0,"penalty":516.0},"findings":[{"rule_id":"osv/GHSA-5rq4-664w-9x2c","severity":"critical","message":"basic-ftp@5.1.0 (npm) is affected by GHSA-5rq4-664w-9x2c","path":"coval/bun.lock","line":null,"fingerprint":"basic-ftp@5.1.0 (npm):GHSA-5rq4-664w-9x2c"},{"rule_id":"osv/GHSA-2w6w-674q-4c4q","severity":"critical","message":"handlebars@4.7.8 (npm) is affected by GHSA-2w6w-674q-4c4q","path":"coval/bun.lock","line":null,"fingerprint":"handlebars@4.7.8 (npm):GHSA-2w6w-674q-4c4q"},{"rule_id":"osv/GHSA-8r5x-fm3f-whwj","severity":"critical","message":"handlebars@4.7.8 (npm) is affected by GHSA-8r5x-fm3f-whwj","path":"coval/bun.lock","line":null,"fingerprint":"handlebars@4.7.8 (npm):GHSA-8r5x-fm3f-whwj"},{"rule_id":"osv/GHSA-p8wg-vrv2-v86f","severity":"critical","message":"handlebars@4.7.8 (npm) is affected by GHSA-p8wg-vrv2-v86f","path":"coval/bun.lock","line":null,"fingerprint":"handlebars@4.7.8 (npm):GHSA-p8wg-vrv2-v86f"},{"rule_id":"osv/GHSA-2464-fhr4-w9xw","severity":"critical","message":"next@16.2.4 (npm) is affected by GHSA-2464-fhr4-w9xw","path":"coval/bun.lock","line":null,"fingerprint":"next@16.2.4 (npm):GHSA-2464-fhr4-w9xw"},{"rule_id":"osv/GHSA-2xp9-vwfh-vxw4","severity":"critical","message":"next@16.2.4 (npm) is affected by GHSA-2xp9-vwfh-vxw4","path":"coval/bun.lock","line":null,"fingerprint":"next@16.2.4 (npm):GHSA-2xp9-vwfh-vxw4"},{"rule_id":"osv/GHSA-673q-mjm6-r5xr","severity":"critical","message":"next@16.2.4 (npm) is affected by GHSA-673q-mjm6-r5xr","path":"coval/bun.lock","line":null,"fingerprint":"next@16.2.4 (npm):GHSA-673q-mjm6-r5xr"},{"rule_id":"osv/GHSA-p293-qw3h-jr36","severity":"critical","message":"next@16.2.4 (npm) is affected by GHSA-p293-qw3h-jr36","path":"coval/bun.lock","line":null,"fingerprint":"next@16.2.4 (npm):GHSA-p293-qw3h-jr36"},{"rule_id":"osv/GHSA-vcvr-r3jv-pc5j","severity":"critical","message":"next@16.2.4 (npm) is affected by GHSA-vcvr-r3jv-pc5j","path":"coval/bun.lock","line":null,"fingerprint":"next@16.2.4 (npm):GHSA-vcvr-r3jv-pc5j"},{"rule_id":"osv/GHSA-jqcg-44mw-7w3h","severity":"critical","message":"proxy-addr@2.0.7 (npm) is affected by GHSA-jqcg-44mw-7w3h; also in pr-review-agent/bun.lock","path":"coval/bun.lock","line":null,"fingerprint":"proxy-addr@2.0.7 (npm):GHSA-jqcg-44mw-7w3h"},{"rule_id":"osv/GHSA-23hp-3jrh-7fpw","severity":"critical","message":"tar@6.2.1 (npm) is affected by GHSA-23hp-3jrh-7fpw","path":"coval/bun.lock","line":null,"fingerprint":"tar@6.2.1 (npm):GHSA-23hp-3jrh-7fpw"},{"rule_id":"osv/GHSA-xq3m-2v4x-88gg","severity":"critical","message":"protobufjs@7.5.4 (npm) is affected by GHSA-xq3m-2v4x-88gg","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"protobufjs@7.5.4 (npm):GHSA-xq3m-2v4x-88gg"},{"rule_id":"osv/GHSA-345p-7cg4-v4c7","severity":"high","message":"@modelcontextprotocol/sdk@1.20.2 (npm) is affected by GHSA-345p-7cg4-v4c7","path":"coval/bun.lock","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.20.2 (npm):GHSA-345p-7cg4-v4c7"},{"rule_id":"osv/GHSA-46jr-4wx8-v453","severity":"high","message":"@modelcontextprotocol/sdk@1.20.2 (npm) is affected by GHSA-46jr-4wx8-v453","path":"coval/bun.lock","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.20.2 (npm):GHSA-46jr-4wx8-v453"},{"rule_id":"osv/GHSA-6qxp-vccf-f47h","severity":"high","message":"@modelcontextprotocol/sdk@1.20.2 (npm) is affected by GHSA-6qxp-vccf-f47h","path":"coval/bun.lock","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.20.2 (npm):GHSA-6qxp-vccf-f47h"},{"rule_id":"osv/GHSA-8r9q-7v3j-jr4g","severity":"high","message":"@modelcontextprotocol/sdk@1.20.2 (npm) is affected by GHSA-8r9q-7v3j-jr4g","path":"coval/bun.lock","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.20.2 (npm):GHSA-8r9q-7v3j-jr4g"},{"rule_id":"osv/GHSA-f897-62hf-6gxq","severity":"high","message":"@modelcontextprotocol/sdk@1.20.2 (npm) is affected by GHSA-f897-62hf-6gxq","path":"coval/bun.lock","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.20.2 (npm):GHSA-f897-62hf-6gxq"},{"rule_id":"osv/GHSA-w48q-cv73-mx4w","severity":"high","message":"@modelcontextprotocol/sdk@1.20.2 (npm) is affected by GHSA-w48q-cv73-mx4w","path":"coval/bun.lock","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.20.2 (npm):GHSA-w48q-cv73-mx4w"},{"rule_id":"osv/GHSA-35jp-ww65-95wh","severity":"high","message":"axios@1.11.0 (npm) is affected by GHSA-35jp-ww65-95wh","path":"coval/bun.lock","line":null,"fingerprint":"axios@1.11.0 (npm):GHSA-35jp-ww65-95wh"},{"rule_id":"osv/GHSA-3g43-6gmg-66jw","severity":"high","message":"axios@1.11.0 (npm) is affected by GHSA-3g43-6gmg-66jw","path":"coval/bun.lock","line":null,"fingerprint":"axios@1.11.0 (npm):GHSA-3g43-6gmg-66jw"},{"rule_id":"osv/GHSA-43fc-jf86-j433","severity":"high","message":"axios@1.11.0 (npm) is affected by GHSA-43fc-jf86-j433","path":"coval/bun.lock","line":null,"fingerprint":"axios@1.11.0 (npm):GHSA-43fc-jf86-j433"},{"rule_id":"osv/GHSA-4hjh-wcwx-xvwj","severity":"high","message":"axios@1.11.0 (npm) is affected by GHSA-4hjh-wcwx-xvwj","path":"coval/bun.lock","line":null,"fingerprint":"axios@1.11.0 (npm):GHSA-4hjh-wcwx-xvwj"},{"rule_id":"osv/GHSA-62hf-57xw-28j9","severity":"high","message":"axios@1.11.0 (npm) is affected by GHSA-62hf-57xw-28j9","path":"coval/bun.lock","line":null,"fingerprint":"axios@1.11.0 (npm):GHSA-62hf-57xw-28j9"},{"rule_id":"osv/GHSA-6chq-wfr3-2hj9","severity":"high","message":"axios@1.11.0 (npm) is affected by GHSA-6chq-wfr3-2hj9","path":"coval/bun.lock","line":null,"fingerprint":"axios@1.11.0 (npm):GHSA-6chq-wfr3-2hj9"},{"rule_id":"osv/GHSA-777c-7fjr-54vf","severity":"high","message":"axios@1.11.0 (npm) is affected by GHSA-777c-7fjr-54vf","path":"coval/bun.lock","line":null,"fingerprint":"axios@1.11.0 (npm):GHSA-777c-7fjr-54vf"},{"rule_id":"osv/GHSA-hfxv-24rg-xrqf","severity":"high","message":"axios@1.11.0 (npm) is affected by GHSA-hfxv-24rg-xrqf","path":"coval/bun.lock","line":null,"fingerprint":"axios@1.11.0 (npm):GHSA-hfxv-24rg-xrqf"},{"rule_id":"osv/GHSA-j5f8-grm9-p9fc","severity":"high","message":"axios@1.11.0 (npm) is affected by GHSA-j5f8-grm9-p9fc","path":"coval/bun.lock","line":null,"fingerprint":"axios@1.11.0 (npm):GHSA-j5f8-grm9-p9fc"},{"rule_id":"osv/GHSA-p92q-9vqr-4j8v","severity":"high","message":"axios@1.11.0 (npm) is affected by GHSA-p92q-9vqr-4j8v","path":"coval/bun.lock","line":null,"fingerprint":"axios@1.11.0 (npm):GHSA-p92q-9vqr-4j8v"},{"rule_id":"osv/GHSA-pf86-5x62-jrwf","severity":"high","message":"axios@1.11.0 (npm) is affected by GHSA-pf86-5x62-jrwf","path":"coval/bun.lock","line":null,"fingerprint":"axios@1.11.0 (npm):GHSA-pf86-5x62-jrwf"},{"rule_id":"osv/GHSA-pmwg-cvhr-8vh7","severity":"high","message":"axios@1.11.0 (npm) is affected by GHSA-pmwg-cvhr-8vh7","path":"coval/bun.lock","line":null,"fingerprint":"axios@1.11.0 (npm):GHSA-pmwg-cvhr-8vh7"},{"rule_id":"osv/GHSA-q8qp-cvcw-x6jj","severity":"high","message":"axios@1.11.0 (npm) is affected by GHSA-q8qp-cvcw-x6jj","path":"coval/bun.lock","line":null,"fingerprint":"axios@1.11.0 (npm):GHSA-q8qp-cvcw-x6jj"},{"rule_id":"osv/GHSA-6v7q-wjvx-w8wg","severity":"high","message":"basic-ftp@5.1.0 (npm) is affected by GHSA-6v7q-wjvx-w8wg","path":"coval/bun.lock","line":null,"fingerprint":"basic-ftp@5.1.0 (npm):GHSA-6v7q-wjvx-w8wg"},{"rule_id":"osv/GHSA-c475-qrg2-pj4r","severity":"high","message":"basic-ftp@5.1.0 (npm) is affected by GHSA-c475-qrg2-pj4r","path":"coval/bun.lock","line":null,"fingerprint":"basic-ftp@5.1.0 (npm):GHSA-c475-qrg2-pj4r"},{"rule_id":"osv/GHSA-rp42-5vxx-qpwr","severity":"high","message":"basic-ftp@5.1.0 (npm) is affected by GHSA-rp42-5vxx-qpwr","path":"coval/bun.lock","line":null,"fingerprint":"basic-ftp@5.1.0 (npm):GHSA-rp42-5vxx-qpwr"},{"rule_id":"osv/GHSA-rpmf-866q-6p89","severity":"high","message":"basic-ftp@5.1.0 (npm) is affected by GHSA-rpmf-866q-6p89","path":"coval/bun.lock","line":null,"fingerprint":"basic-ftp@5.1.0 (npm):GHSA-rpmf-866q-6p89"},{"rule_id":"osv/GHSA-27r3-jxmh-p828","severity":"high","message":"body-parser@2.2.0 (npm) is affected by GHSA-27r3-jxmh-p828","path":"coval/bun.lock","line":null,"fingerprint":"body-parser@2.2.0 (npm):GHSA-27r3-jxmh-p828"},{"rule_id":"osv/GHSA-3jxr-9vmj-r5cp","severity":"high","message":"brace-expansion@1.1.12 (npm) is affected by GHSA-3jxr-9vmj-r5cp","path":"coval/bun.lock","line":null,"fingerprint":"brace-expansion@1.1.12 (npm):GHSA-3jxr-9vmj-r5cp"},{"rule_id":"osv/GHSA-6j4f-fj2g-mc7p","severity":"high","message":"brace-expansion@1.1.12 (npm) is affected by GHSA-6j4f-fj2g-mc7p","path":"coval/bun.lock","line":null,"fingerprint":"brace-expansion@1.1.12 (npm):GHSA-6j4f-fj2g-mc7p"},{"rule_id":"osv/GHSA-mh99-v99m-4gvg","severity":"high","message":"brace-expansion@1.1.12 (npm) is affected by GHSA-mh99-v99m-4gvg","path":"coval/bun.lock","line":null,"fingerprint":"brace-expansion@1.1.12 (npm):GHSA-mh99-v99m-4gvg"},{"rule_id":"osv/GHSA-qhr7-859c-m2p7","severity":"high","message":"brace-expansion@1.1.12 (npm) is affected by GHSA-qhr7-859c-m2p7","path":"coval/bun.lock","line":null,"fingerprint":"brace-expansion@1.1.12 (npm):GHSA-qhr7-859c-m2p7"},{"rule_id":"osv/GHSA-rgw5-rvv9-x895","severity":"high","message":"brace-expansion@1.1.12 (npm) is affected by GHSA-rgw5-rvv9-x895","path":"coval/bun.lock","line":null,"fingerprint":"brace-expansion@1.1.12 (npm):GHSA-rgw5-rvv9-x895"},{"rule_id":"osv/GHSA-3jxr-9vmj-r5cp","severity":"high","message":"brace-expansion@2.0.2 (npm) is affected by GHSA-3jxr-9vmj-r5cp","path":"coval/bun.lock","line":null,"fingerprint":"brace-expansion@2.0.2 (npm):GHSA-3jxr-9vmj-r5cp"},{"rule_id":"osv/GHSA-6j4f-fj2g-mc7p","severity":"high","message":"brace-expansion@2.0.2 (npm) is affected by GHSA-6j4f-fj2g-mc7p","path":"coval/bun.lock","line":null,"fingerprint":"brace-expansion@2.0.2 (npm):GHSA-6j4f-fj2g-mc7p"},{"rule_id":"osv/GHSA-mh99-v99m-4gvg","severity":"high","message":"brace-expansion@2.0.2 (npm) is affected by GHSA-mh99-v99m-4gvg","path":"coval/bun.lock","line":null,"fingerprint":"brace-expansion@2.0.2 (npm):GHSA-mh99-v99m-4gvg"},{"rule_id":"osv/GHSA-qhr7-859c-m2p7","severity":"high","message":"brace-expansion@2.0.2 (npm) is affected by GHSA-qhr7-859c-m2p7","path":"coval/bun.lock","line":null,"fingerprint":"brace-expansion@2.0.2 (npm):GHSA-qhr7-859c-m2p7"},{"rule_id":"osv/GHSA-rgw5-rvv9-x895","severity":"high","message":"brace-expansion@2.0.2 (npm) is affected by GHSA-rgw5-rvv9-x895","path":"coval/bun.lock","line":null,"fingerprint":"brace-expansion@2.0.2 (npm):GHSA-rgw5-rvv9-x895"},{"rule_id":"osv/GHSA-3jxr-9vmj-r5cp","severity":"high","message":"brace-expansion@5.0.5 (npm) is affected by GHSA-3jxr-9vmj-r5cp","path":"coval/bun.lock","line":null,"fingerprint":"brace-expansion@5.0.5 (npm):GHSA-3jxr-9vmj-r5cp"},{"rule_id":"osv/GHSA-6j4f-fj2g-mc7p","severity":"high","message":"brace-expansion@5.0.5 (npm) is affected by GHSA-6j4f-fj2g-mc7p","path":"coval/bun.lock","line":null,"fingerprint":"brace-expansion@5.0.5 (npm):GHSA-6j4f-fj2g-mc7p"},{"rule_id":"osv/GHSA-mh99-v99m-4gvg","severity":"high","message":"brace-expansion@5.0.5 (npm) is affected by GHSA-mh99-v99m-4gvg","path":"coval/bun.lock","line":null,"fingerprint":"brace-expansion@5.0.5 (npm):GHSA-mh99-v99m-4gvg"},{"rule_id":"osv/GHSA-qhr7-859c-m2p7","severity":"high","message":"brace-expansion@5.0.5 (npm) is affected by GHSA-qhr7-859c-m2p7","path":"coval/bun.lock","line":null,"fingerprint":"brace-expansion@5.0.5 (npm):GHSA-qhr7-859c-m2p7"},{"rule_id":"osv/GHSA-rgw5-rvv9-x895","severity":"high","message":"brace-expansion@5.0.5 (npm) is affected by GHSA-rgw5-rvv9-x895","path":"coval/bun.lock","line":null,"fingerprint":"brace-expansion@5.0.5 (npm):GHSA-rgw5-rvv9-x895"},{"rule_id":"osv/GHSA-73wf-gq98-2v4g","severity":"high","message":"browserslist@4.28.1 (npm) is affected by GHSA-73wf-gq98-2v4g","path":"coval/bun.lock","line":null,"fingerprint":"browserslist@4.28.1 (npm):GHSA-73wf-gq98-2v4g"},{"rule_id":"osv/GHSA-c83g-rgw3-j3cx","severity":"high","message":"browserslist@4.28.1 (npm) is affected by GHSA-c83g-rgw3-j3cx","path":"coval/bun.lock","line":null,"fingerprint":"browserslist@4.28.1 (npm):GHSA-c83g-rgw3-j3cx"},{"rule_id":"osv/GHSA-73wf-gq98-2v4g","severity":"high","message":"browserslist@4.28.2 (npm) is affected by GHSA-73wf-gq98-2v4g","path":"coval/bun.lock","line":null,"fingerprint":"browserslist@4.28.2 (npm):GHSA-73wf-gq98-2v4g"},{"rule_id":"osv/GHSA-c83g-rgw3-j3cx","severity":"high","message":"browserslist@4.28.2 (npm) is affected by GHSA-c83g-rgw3-j3cx","path":"coval/bun.lock","line":null,"fingerprint":"browserslist@4.28.2 (npm):GHSA-c83g-rgw3-j3cx"},{"rule_id":"osv/GHSA-737v-mqg7-c878","severity":"high","message":"defu@6.1.4 (npm) is affected by GHSA-737v-mqg7-c878; also in pr-review-agent/bun.lock","path":"coval/bun.lock","line":null,"fingerprint":"defu@6.1.4 (npm):GHSA-737v-mqg7-c878"},{"rule_id":"osv/GHSA-mrv2-3pqr-j5jr","severity":"high","message":"dompurify@3.1.7 (npm) is affected by GHSA-mrv2-3pqr-j5jr","path":"coval/bun.lock","line":null,"fingerprint":"dompurify@3.1.7 (npm):GHSA-mrv2-3pqr-j5jr"},{"rule_id":"osv/GHSA-7pqw-9j4j-h8q3","severity":"high","message":"extract-zip@2.0.1 (npm) is affected by GHSA-7pqw-9j4j-h8q3","path":"coval/bun.lock","line":null,"fingerprint":"extract-zip@2.0.1 (npm):GHSA-7pqw-9j4j-h8q3"},{"rule_id":"osv/GHSA-jmr9-qjv8-65gv","severity":"high","message":"extract-zip@2.0.1 (npm) is affected by GHSA-jmr9-qjv8-65gv","path":"coval/bun.lock","line":null,"fingerprint":"extract-zip@2.0.1 (npm):GHSA-jmr9-qjv8-65gv"},{"rule_id":"osv/GHSA-25h7-pfq9-p65f","severity":"high","message":"flatted@3.3.3 (npm) is affected by GHSA-25h7-pfq9-p65f","path":"coval/bun.lock","line":null,"fingerprint":"flatted@3.3.3 (npm):GHSA-25h7-pfq9-p65f"},{"rule_id":"osv/GHSA-rf6f-7fwh-wjgh","severity":"high","message":"flatted@3.3.3 (npm) is affected by GHSA-rf6f-7fwh-wjgh","path":"coval/bun.lock","line":null,"fingerprint":"flatted@3.3.3 (npm):GHSA-rf6f-7fwh-wjgh"},{"rule_id":"osv/GHSA-hmw2-7cc7-3qxx","severity":"high","message":"form-data@4.0.4 (npm) is affected by GHSA-hmw2-7cc7-3qxx","path":"coval/bun.lock","line":null,"fingerprint":"form-data@4.0.4 (npm):GHSA-hmw2-7cc7-3qxx"},{"rule_id":"osv/GHSA-3mfm-83xf-c92r","severity":"high","message":"handlebars@4.7.8 (npm) is affected by GHSA-3mfm-83xf-c92r","path":"coval/bun.lock","line":null,"fingerprint":"handlebars@4.7.8 (npm):GHSA-3mfm-83xf-c92r"},{"rule_id":"osv/GHSA-9cx6-37pm-9jff","severity":"high","message":"handlebars@4.7.8 (npm) is affected by GHSA-9cx6-37pm-9jff","path":"coval/bun.lock","line":null,"fingerprint":"handlebars@4.7.8 (npm):GHSA-9cx6-37pm-9jff"},{"rule_id":"osv/GHSA-xhpv-hc6g-r9c6","severity":"high","message":"handlebars@4.7.8 (npm) is affected by GHSA-xhpv-hc6g-r9c6","path":"coval/bun.lock","line":null,"fingerprint":"handlebars@4.7.8 (npm):GHSA-xhpv-hc6g-r9c6"},{"rule_id":"osv/GHSA-xjpj-3mr7-gcpf","severity":"high","message":"handlebars@4.7.8 (npm) is affected by GHSA-xjpj-3mr7-gcpf","path":"coval/bun.lock","line":null,"fingerprint":"handlebars@4.7.8 (npm):GHSA-xjpj-3mr7-gcpf"},{"rule_id":"osv/GHSA-mwp4-54f8-5fhr","severity":"high","message":"ip-address@10.1.0 (npm) is affected by GHSA-mwp4-54f8-5fhr","path":"coval/bun.lock","line":null,"fingerprint":"ip-address@10.1.0 (npm):GHSA-mwp4-54f8-5fhr"},{"rule_id":"osv/GHSA-2883-xcg3-v3hh","severity":"high","message":"js-yaml@4.1.0 (npm) is affected by GHSA-2883-xcg3-v3hh","path":"coval/bun.lock","line":null,"fingerprint":"js-yaml@4.1.0 (npm):GHSA-2883-xcg3-v3hh"},{"rule_id":"osv/GHSA-52cp-r559-cp3m","severity":"high","message":"js-yaml@4.1.0 (npm) is affected by GHSA-52cp-r559-cp3m","path":"coval/bun.lock","line":null,"fingerprint":"js-yaml@4.1.0 (npm):GHSA-52cp-r559-cp3m"},{"rule_id":"osv/GHSA-5p4m-2wfm-xmqj","severity":"high","message":"js-yaml@4.1.0 (npm) is affected by GHSA-5p4m-2wfm-xmqj","path":"coval/bun.lock","line":null,"fingerprint":"js-yaml@4.1.0 (npm):GHSA-5p4m-2wfm-xmqj"},{"rule_id":"osv/GHSA-r5fr-rjxr-66jc","severity":"high","message":"lodash@4.17.21 (npm) is affected by GHSA-r5fr-rjxr-66jc; also in pr-review-agent/bun.lock","path":"coval/bun.lock","line":null,"fingerprint":"lodash@4.17.21 (npm):GHSA-r5fr-rjxr-66jc"},{"rule_id":"osv/GHSA-23c5-xmqv-rm74","severity":"high","message":"minimatch@3.1.2 (npm) is affected by GHSA-23c5-xmqv-rm74","path":"coval/bun.lock","line":null,"fingerprint":"minimatch@3.1.2 (npm):GHSA-23c5-xmqv-rm74"},{"rule_id":"osv/GHSA-3ppc-4f35-3m26","severity":"high","message":"minimatch@3.1.2 (npm) is affected by GHSA-3ppc-4f35-3m26","path":"coval/bun.lock","line":null,"fingerprint":"minimatch@3.1.2 (npm):GHSA-3ppc-4f35-3m26"},{"rule_id":"osv/GHSA-7r86-cg39-jmmj","severity":"high","message":"minimatch@3.1.2 (npm) is affected by GHSA-7r86-cg39-jmmj","path":"coval/bun.lock","line":null,"fingerprint":"minimatch@3.1.2 (npm):GHSA-7r86-cg39-jmmj"},{"rule_id":"osv/GHSA-23c5-xmqv-rm74","severity":"high","message":"minimatch@9.0.5 (npm) is affected by GHSA-23c5-xmqv-rm74","path":"coval/bun.lock","line":null,"fingerprint":"minimatch@9.0.5 (npm):GHSA-23c5-xmqv-rm74"},{"rule_id":"osv/GHSA-3ppc-4f35-3m26","severity":"high","message":"minimatch@9.0.5 (npm) is affected by GHSA-3ppc-4f35-3m26","path":"coval/bun.lock","line":null,"fingerprint":"minimatch@9.0.5 (npm):GHSA-3ppc-4f35-3m26"},{"rule_id":"osv/GHSA-7r86-cg39-jmmj","severity":"high","message":"minimatch@9.0.5 (npm) is affected by GHSA-7r86-cg39-jmmj","path":"coval/bun.lock","line":null,"fingerprint":"minimatch@9.0.5 (npm):GHSA-7r86-cg39-jmmj"},{"rule_id":"osv/GHSA-28wg-ghj8-5hjv","severity":"high","message":"nanoid@3.3.11 (npm) is affected by GHSA-28wg-ghj8-5hjv; also in coval/codegen-sandbox/app/bun.lock","path":"coval/bun.lock","line":null,"fingerprint":"nanoid@3.3.11 (npm):GHSA-28wg-ghj8-5hjv"},{"rule_id":"osv/GHSA-2v37-7h3g-55p8","severity":"high","message":"nanoid@3.3.11 (npm) is affected by GHSA-2v37-7h3g-55p8; also in coval/codegen-sandbox/app/bun.lock","path":"coval/bun.lock","line":null,"fingerprint":"nanoid@3.3.11 (npm):GHSA-2v37-7h3g-55p8"},{"rule_id":"osv/GHSA-xwg4-73v4-xw9w","severity":"high","message":"nanoid@3.3.11 (npm) is affected by GHSA-xwg4-73v4-xw9w; also in coval/codegen-sandbox/app/bun.lock","path":"coval/bun.lock","line":null,"fingerprint":"nanoid@3.3.11 (npm):GHSA-xwg4-73v4-xw9w"},{"rule_id":"osv/GHSA-267c-6grr-h53f","severity":"high","message":"next@16.2.4 (npm) is affected by GHSA-267c-6grr-h53f","path":"coval/bun.lock","line":null,"fingerprint":"next@16.2.4 (npm):GHSA-267c-6grr-h53f"},{"rule_id":"osv/GHSA-26hh-7cqf-hhc6","severity":"high","message":"next@16.2.4 (npm) is affected by GHSA-26hh-7cqf-hhc6","path":"coval/bun.lock","line":null,"fingerprint":"next@16.2.4 (npm):GHSA-26hh-7cqf-hhc6"},{"rule_id":"osv/GHSA-36qx-fr4f-26g5","severity":"high","message":"next@16.2.4 (npm) is affected by GHSA-36qx-fr4f-26g5","path":"coval/bun.lock","line":null,"fingerprint":"next@16.2.4 (npm):GHSA-36qx-fr4f-26g5"},{"rule_id":"osv/GHSA-492v-c6pp-mqqv","severity":"high","message":"next@16.2.4 (npm) is affected by GHSA-492v-c6pp-mqqv","path":"coval/bun.lock","line":null,"fingerprint":"next@16.2.4 (npm):GHSA-492v-c6pp-mqqv"},{"rule_id":"osv/GHSA-6gpp-xcg3-4w24","severity":"high","message":"next@16.2.4 (npm) is affected by GHSA-6gpp-xcg3-4w24","path":"coval/bun.lock","line":null,"fingerprint":"next@16.2.4 (npm):GHSA-6gpp-xcg3-4w24"},{"rule_id":"osv/GHSA-89xv-2m56-2m9x","severity":"high","message":"next@16.2.4 (npm) is affected by GHSA-89xv-2m56-2m9x","path":"coval/bun.lock","line":null,"fingerprint":"next@16.2.4 (npm):GHSA-89xv-2m56-2m9x"},{"rule_id":"osv/GHSA-8h8q-6873-q5fj","severity":"high","message":"next@16.2.4 (npm) is affected by GHSA-8h8q-6873-q5fj","path":"coval/bun.lock","line":null,"fingerprint":"next@16.2.4 (npm):GHSA-8h8q-6873-q5fj"},{"rule_id":"osv/GHSA-c4j6-fc7j-m34r","severity":"high","message":"next@16.2.4 (npm) is affected by GHSA-c4j6-fc7j-m34r","path":"coval/bun.lock","line":null,"fingerprint":"next@16.2.4 (npm):GHSA-c4j6-fc7j-m34r"},{"rule_id":"osv/GHSA-cjq9-62q9-8jv4","severity":"high","message":"next@16.2.4 (npm) is affected by GHSA-cjq9-62q9-8jv4","path":"coval/bun.lock","line":null,"fingerprint":"next@16.2.4 (npm):GHSA-cjq9-62q9-8jv4"},{"rule_id":"osv/GHSA-m99w-x7hq-7vfj","severity":"high","message":"next@16.2.4 (npm) is affected by GHSA-m99w-x7hq-7vfj","path":"coval/bun.lock","line":null,"fingerprint":"next@16.2.4 (npm):GHSA-m99w-x7hq-7vfj"},{"rule_id":"osv/GHSA-mg66-mrh9-m8jx","severity":"high","message":"next@16.2.4 (npm) is affected by GHSA-mg66-mrh9-m8jx","path":"coval/bun.lock","line":null,"fingerprint":"next@16.2.4 (npm):GHSA-mg66-mrh9-m8jx"},{"rule_id":"osv/GHSA-p3m5-59mp-jv5r","severity":"high","message":"next@16.2.4 (npm) is affected by GHSA-p3m5-59mp-jv5r","path":"coval/bun.lock","line":null,"fingerprint":"next@16.2.4 (npm):GHSA-p3m5-59mp-jv5r"},{"rule_id":"osv/GHSA-p9j2-gv94-2wf4","severity":"high","message":"next@16.2.4 (npm) is affected by GHSA-p9j2-gv94-2wf4","path":"coval/bun.lock","line":null,"fingerprint":"next@16.2.4 (npm):GHSA-p9j2-gv94-2wf4"},{"rule_id":"osv/GHSA-j3q9-mxjg-w52f","severity":"high","message":"path-to-regexp@8.2.0 (npm) is affected by GHSA-j3q9-mxjg-w52f","path":"coval/bun.lock","line":null,"fingerprint":"path-to-regexp@8.2.0 (npm):GHSA-j3q9-mxjg-w52f"},{"rule_id":"osv/GHSA-c2c7-rcm5-vvqj","severity":"high","message":"picomatch@2.3.1 (npm) is affected by GHSA-c2c7-rcm5-vvqj; also in coval/codegen-sandbox/app/bun.lock","path":"coval/bun.lock","line":null,"fingerprint":"picomatch@2.3.1 (npm):GHSA-c2c7-rcm5-vvqj"},{"rule_id":"osv/GHSA-c2c7-rcm5-vvqj","severity":"high","message":"picomatch@4.0.3 (npm) is affected by GHSA-c2c7-rcm5-vvqj; also in coval/codegen-sandbox/app/bun.lock","path":"coval/bun.lock","line":null,"fingerprint":"picomatch@4.0.3 (npm):GHSA-c2c7-rcm5-vvqj"},{"rule_id":"osv/GHSA-6g55-p6wh-862q","severity":"high","message":"postcss@8.4.31 (npm) is affected by GHSA-6g55-p6wh-862q","path":"coval/bun.lock","line":null,"fingerprint":"postcss@8.4.31 (npm):GHSA-6g55-p6wh-862q"},{"rule_id":"osv/GHSA-r28c-9q8g-f849","severity":"high","message":"postcss@8.4.31 (npm) is affected by GHSA-r28c-9q8g-f849","path":"coval/bun.lock","line":null,"fingerprint":"postcss@8.4.31 (npm):GHSA-r28c-9q8g-f849"},{"rule_id":"osv/GHSA-6g55-p6wh-862q","severity":"high","message":"postcss@8.5.10 (npm) is affected by GHSA-6g55-p6wh-862q","path":"coval/bun.lock","line":null,"fingerprint":"postcss@8.5.10 (npm):GHSA-6g55-p6wh-862q"},{"rule_id":"osv/GHSA-r28c-9q8g-f849","severity":"high","message":"postcss@8.5.10 (npm) is affected by GHSA-r28c-9q8g-f849","path":"coval/bun.lock","line":null,"fingerprint":"postcss@8.5.10 (npm):GHSA-r28c-9q8g-f849"},{"rule_id":"osv/GHSA-f88m-g3jw-g9cj","severity":"high","message":"sharp@0.34.5 (npm) is affected by GHSA-f88m-g3jw-g9cj","path":"coval/bun.lock","line":null,"fingerprint":"sharp@0.34.5 (npm):GHSA-f88m-g3jw-g9cj"},{"rule_id":"osv/GHSA-rgj7-g3m4-5g8c","severity":"high","message":"sharp@0.34.5 (npm) is affected by GHSA-rgj7-g3m4-5g8c","path":"coval/bun.lock","line":null,"fingerprint":"sharp@0.34.5 (npm):GHSA-rgj7-g3m4-5g8c"},{"rule_id":"osv/GHSA-wq5f-xc86-pv6w","severity":"high","message":"sharp@0.34.5 (npm) is affected by GHSA-wq5f-xc86-pv6w","path":"coval/bun.lock","line":null,"fingerprint":"sharp@0.34.5 (npm):GHSA-wq5f-xc86-pv6w"},{"rule_id":"osv/GHSA-68fv-2mgg-jv7q","severity":"high","message":"source-map-js@1.2.1 (npm) is affected by GHSA-68fv-2mgg-jv7q; also in coval/codegen-sandbox/app/bun.lock","path":"coval/bun.lock","line":null,"fingerprint":"source-map-js@1.2.1 (npm):GHSA-68fv-2mgg-jv7q"},{"rule_id":"osv/GHSA-34x7-hfp2-rc4v","severity":"high","message":"tar@6.2.1 (npm) is affected by GHSA-34x7-hfp2-rc4v","path":"coval/bun.lock","line":null,"fingerprint":"tar@6.2.1 (npm):GHSA-34x7-hfp2-rc4v"},{"rule_id":"osv/GHSA-83g3-92jg-28cx","severity":"high","message":"tar@6.2.1 (npm) is affected by GHSA-83g3-92jg-28cx","path":"coval/bun.lock","line":null,"fingerprint":"tar@6.2.1 (npm):GHSA-83g3-92jg-28cx"},{"rule_id":"osv/GHSA-8qq5-rm4j-mr97","severity":"high","message":"tar@6.2.1 (npm) is affected by GHSA-8qq5-rm4j-mr97","path":"coval/bun.lock","line":null,"fingerprint":"tar@6.2.1 (npm):GHSA-8qq5-rm4j-mr97"},{"rule_id":"osv/GHSA-8x88-c5mf-7j5w","severity":"high","message":"tar@6.2.1 (npm) is affected by GHSA-8x88-c5mf-7j5w","path":"coval/bun.lock","line":null,"fingerprint":"tar@6.2.1 (npm):GHSA-8x88-c5mf-7j5w"},{"rule_id":"osv/GHSA-9ppj-qmqm-q256","severity":"high","message":"tar@6.2.1 (npm) is affected by GHSA-9ppj-qmqm-q256","path":"coval/bun.lock","line":null,"fingerprint":"tar@6.2.1 (npm):GHSA-9ppj-qmqm-q256"},{"rule_id":"osv/GHSA-qffp-2rhf-9h96","severity":"high","message":"tar@6.2.1 (npm) is affected by GHSA-qffp-2rhf-9h96","path":"coval/bun.lock","line":null,"fingerprint":"tar@6.2.1 (npm):GHSA-qffp-2rhf-9h96"},{"rule_id":"osv/GHSA-r292-9mhp-454m","severity":"high","message":"tar@6.2.1 (npm) is affected by GHSA-r292-9mhp-454m","path":"coval/bun.lock","line":null,"fingerprint":"tar@6.2.1 (npm):GHSA-r292-9mhp-454m"},{"rule_id":"osv/GHSA-r6q2-hw4h-h46w","severity":"high","message":"tar@6.2.1 (npm) is affected by GHSA-r6q2-hw4h-h46w","path":"coval/bun.lock","line":null,"fingerprint":"tar@6.2.1 (npm):GHSA-r6q2-hw4h-h46w"},{"rule_id":"osv/GHSA-w5hq-g745-h8pq","severity":"high","message":"uuid@11.1.0 (npm) is affected by GHSA-w5hq-g745-h8pq; also in pr-review-agent/bun.lock","path":"coval/bun.lock","line":null,"fingerprint":"uuid@11.1.0 (npm):GHSA-w5hq-g745-h8pq"},{"rule_id":"osv/GHSA-96hv-2xvq-fx4p","severity":"high","message":"ws@8.19.0 (npm) is affected by GHSA-96hv-2xvq-fx4p; also in pr-review-agent/bun.lock","path":"coval/bun.lock","line":null,"fingerprint":"ws@8.19.0 (npm):GHSA-96hv-2xvq-fx4p"},{"rule_id":"osv/GHSA-mrhx-c7xc-m3w5","severity":"high","message":"zod@3.25.76 (npm) is affected by GHSA-mrhx-c7xc-m3w5; also in pr-review-agent/bun.lock","path":"coval/bun.lock","line":null,"fingerprint":"zod@3.25.76 (npm):GHSA-mrhx-c7xc-m3w5"},{"rule_id":"osv/GHSA-6g55-p6wh-862q","severity":"high","message":"postcss@8.5.6 (npm) is affected by GHSA-6g55-p6wh-862q","path":"coval/codegen-sandbox/app/bun.lock","line":null,"fingerprint":"postcss@8.5.6 (npm):GHSA-6g55-p6wh-862q"},{"rule_id":"osv/GHSA-r28c-9q8g-f849","severity":"high","message":"postcss@8.5.6 (npm) is affected by GHSA-r28c-9q8g-f849","path":"coval/codegen-sandbox/app/bun.lock","line":null,"fingerprint":"postcss@8.5.6 (npm):GHSA-r28c-9q8g-f849"},{"rule_id":"osv/GHSA-2m5v-pch6-74hx","severity":"high","message":"undici@8.11.2 (npm) is affected by GHSA-2m5v-pch6-74hx","path":"coval/codegen-sandbox/app/bun.lock","line":null,"fingerprint":"undici@8.11.2 (npm):GHSA-2m5v-pch6-74hx"},{"rule_id":"osv/GHSA-4w7w-5xrc-9h26","severity":"high","message":"undici@8.11.2 (npm) is affected by GHSA-4w7w-5xrc-9h26","path":"coval/codegen-sandbox/app/bun.lock","line":null,"fingerprint":"undici@8.11.2 (npm):GHSA-4w7w-5xrc-9h26"},{"rule_id":"osv/GHSA-qrxm-fqhp-jwvm","severity":"high","message":"undici@8.11.2 (npm) is affected by GHSA-qrxm-fqhp-jwvm","path":"coval/codegen-sandbox/app/bun.lock","line":null,"fingerprint":"undici@8.11.2 (npm):GHSA-qrxm-fqhp-jwvm"},{"rule_id":"osv/GHSA-xjj6-f33q-929c","severity":"high","message":"undici@8.11.2 (npm) is affected by GHSA-xjj6-f33q-929c","path":"coval/codegen-sandbox/app/bun.lock","line":null,"fingerprint":"undici@8.11.2 (npm):GHSA-xjj6-f33q-929c"},{"rule_id":"osv/GHSA-wc8c-qw6v-h7f6","severity":"high","message":"@hono/node-server@1.19.9 (npm) is affected by GHSA-wc8c-qw6v-h7f6","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"@hono/node-server@1.19.9 (npm):GHSA-wc8c-qw6v-h7f6"},{"rule_id":"osv/GHSA-22jm-h49p-29qw","severity":"high","message":"@modelcontextprotocol/sdk@1.25.3 (npm) is affected by GHSA-22jm-h49p-29qw","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.25.3 (npm):GHSA-22jm-h49p-29qw"},{"rule_id":"osv/GHSA-345p-7cg4-v4c7","severity":"high","message":"@modelcontextprotocol/sdk@1.25.3 (npm) is affected by GHSA-345p-7cg4-v4c7","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.25.3 (npm):GHSA-345p-7cg4-v4c7"},{"rule_id":"osv/GHSA-46jr-4wx8-v453","severity":"high","message":"@modelcontextprotocol/sdk@1.25.3 (npm) is affected by GHSA-46jr-4wx8-v453","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.25.3 (npm):GHSA-46jr-4wx8-v453"},{"rule_id":"osv/GHSA-6qxp-vccf-f47h","severity":"high","message":"@modelcontextprotocol/sdk@1.25.3 (npm) is affected by GHSA-6qxp-vccf-f47h","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.25.3 (npm):GHSA-6qxp-vccf-f47h"},{"rule_id":"osv/GHSA-f897-62hf-6gxq","severity":"high","message":"@modelcontextprotocol/sdk@1.25.3 (npm) is affected by GHSA-f897-62hf-6gxq","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.25.3 (npm):GHSA-f897-62hf-6gxq"},{"rule_id":"osv/GHSA-35jp-ww65-95wh","severity":"high","message":"axios@1.13.2 (npm) is affected by GHSA-35jp-ww65-95wh","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"axios@1.13.2 (npm):GHSA-35jp-ww65-95wh"},{"rule_id":"osv/GHSA-3g43-6gmg-66jw","severity":"high","message":"axios@1.13.2 (npm) is affected by GHSA-3g43-6gmg-66jw","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"axios@1.13.2 (npm):GHSA-3g43-6gmg-66jw"},{"rule_id":"osv/GHSA-3pq3-5fj3-cg6v","severity":"high","message":"axios@1.13.2 (npm) is affected by GHSA-3pq3-5fj3-cg6v","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"axios@1.13.2 (npm):GHSA-3pq3-5fj3-cg6v"},{"rule_id":"osv/GHSA-43fc-jf86-j433","severity":"high","message":"axios@1.13.2 (npm) is affected by GHSA-43fc-jf86-j433","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"axios@1.13.2 (npm):GHSA-43fc-jf86-j433"},{"rule_id":"osv/GHSA-542g-h47m-68v8","severity":"high","message":"axios@1.13.2 (npm) is affected by GHSA-542g-h47m-68v8","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"axios@1.13.2 (npm):GHSA-542g-h47m-68v8"},{"rule_id":"osv/GHSA-62hf-57xw-28j9","severity":"high","message":"axios@1.13.2 (npm) is affected by GHSA-62hf-57xw-28j9","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"axios@1.13.2 (npm):GHSA-62hf-57xw-28j9"},{"rule_id":"osv/GHSA-6chq-wfr3-2hj9","severity":"high","message":"axios@1.13.2 (npm) is affected by GHSA-6chq-wfr3-2hj9","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"axios@1.13.2 (npm):GHSA-6chq-wfr3-2hj9"},{"rule_id":"osv/GHSA-777c-7fjr-54vf","severity":"high","message":"axios@1.13.2 (npm) is affected by GHSA-777c-7fjr-54vf","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"axios@1.13.2 (npm):GHSA-777c-7fjr-54vf"},{"rule_id":"osv/GHSA-hfxv-24rg-xrqf","severity":"high","message":"axios@1.13.2 (npm) is affected by GHSA-hfxv-24rg-xrqf","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"axios@1.13.2 (npm):GHSA-hfxv-24rg-xrqf"},{"rule_id":"osv/GHSA-j5f8-grm9-p9fc","severity":"high","message":"axios@1.13.2 (npm) is affected by GHSA-j5f8-grm9-p9fc","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"axios@1.13.2 (npm):GHSA-j5f8-grm9-p9fc"},{"rule_id":"osv/GHSA-p92q-9vqr-4j8v","severity":"high","message":"axios@1.13.2 (npm) is affected by GHSA-p92q-9vqr-4j8v","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"axios@1.13.2 (npm):GHSA-p92q-9vqr-4j8v"},{"rule_id":"osv/GHSA-pf86-5x62-jrwf","severity":"high","message":"axios@1.13.2 (npm) is affected by GHSA-pf86-5x62-jrwf","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"axios@1.13.2 (npm):GHSA-pf86-5x62-jrwf"},{"rule_id":"osv/GHSA-pmwg-cvhr-8vh7","severity":"high","message":"axios@1.13.2 (npm) is affected by GHSA-pmwg-cvhr-8vh7","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"axios@1.13.2 (npm):GHSA-pmwg-cvhr-8vh7"},{"rule_id":"osv/GHSA-q8qp-cvcw-x6jj","severity":"high","message":"axios@1.13.2 (npm) is affected by GHSA-q8qp-cvcw-x6jj","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"axios@1.13.2 (npm):GHSA-q8qp-cvcw-x6jj"},{"rule_id":"osv/GHSA-27r3-jxmh-p828","severity":"high","message":"body-parser@2.2.2 (npm) is affected by GHSA-27r3-jxmh-p828","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"body-parser@2.2.2 (npm):GHSA-27r3-jxmh-p828"},{"rule_id":"osv/GHSA-4c8g-83qw-93j6","severity":"high","message":"fast-uri@3.1.0 (npm) is affected by GHSA-4c8g-83qw-93j6","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-4c8g-83qw-93j6"},{"rule_id":"osv/GHSA-7p8r-x3mc-p8w7","severity":"high","message":"fast-uri@3.1.0 (npm) is affected by GHSA-7p8r-x3mc-p8w7","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-7p8r-x3mc-p8w7"},{"rule_id":"osv/GHSA-f65p-4m7j-42xc","severity":"high","message":"fast-uri@3.1.0 (npm) is affected by GHSA-f65p-4m7j-42xc","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-f65p-4m7j-42xc"},{"rule_id":"osv/GHSA-jqff-g426-hqxp","severity":"high","message":"fast-uri@3.1.0 (npm) is affected by GHSA-jqff-g426-hqxp","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-jqff-g426-hqxp"},{"rule_id":"osv/GHSA-q3j6-qgpj-74h6","severity":"high","message":"fast-uri@3.1.0 (npm) is affected by GHSA-q3j6-qgpj-74h6","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-q3j6-qgpj-74h6"},{"rule_id":"osv/GHSA-qw65-cvwx-89v3","severity":"high","message":"fast-uri@3.1.0 (npm) is affected by GHSA-qw65-cvwx-89v3","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-qw65-cvwx-89v3"},{"rule_id":"osv/GHSA-v2hh-gcrm-f6hx","severity":"high","message":"fast-uri@3.1.0 (npm) is affected by GHSA-v2hh-gcrm-f6hx","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-v2hh-gcrm-f6hx"},{"rule_id":"osv/GHSA-v39h-62p7-jpjc","severity":"high","message":"fast-uri@3.1.0 (npm) is affected by GHSA-v39h-62p7-jpjc","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-v39h-62p7-jpjc"},{"rule_id":"osv/GHSA-247c-9743-5963","severity":"high","message":"fastify@5.7.1 (npm) is affected by GHSA-247c-9743-5963","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"fastify@5.7.1 (npm):GHSA-247c-9743-5963"},{"rule_id":"osv/GHSA-667r-xxjv-c9mm","severity":"high","message":"fastify@5.7.1 (npm) is affected by GHSA-667r-xxjv-c9mm","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"fastify@5.7.1 (npm):GHSA-667r-xxjv-c9mm"},{"rule_id":"osv/GHSA-9q9j-q6p8-xq58","severity":"high","message":"fastify@5.7.1 (npm) is affected by GHSA-9q9j-q6p8-xq58","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"fastify@5.7.1 (npm):GHSA-9q9j-q6p8-xq58"},{"rule_id":"osv/GHSA-hwr6-493r-vm6h","severity":"high","message":"fastify@5.7.1 (npm) is affected by GHSA-hwr6-493r-vm6h","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"fastify@5.7.1 (npm):GHSA-hwr6-493r-vm6h"},{"rule_id":"osv/GHSA-jx2c-rxcm-jvmq","severity":"high","message":"fastify@5.7.1 (npm) is affected by GHSA-jx2c-rxcm-jvmq","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"fastify@5.7.1 (npm):GHSA-jx2c-rxcm-jvmq"},{"rule_id":"osv/GHSA-p68q-wchp-6fh7","severity":"high","message":"fastify@5.7.1 (npm) is affected by GHSA-p68q-wchp-6fh7","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"fastify@5.7.1 (npm):GHSA-p68q-wchp-6fh7"},{"rule_id":"osv/GHSA-c96f-x56v-gq3h","severity":"high","message":"find-my-way@9.4.0 (npm) is affected by GHSA-c96f-x56v-gq3h","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"find-my-way@9.4.0 (npm):GHSA-c96f-x56v-gq3h"},{"rule_id":"osv/GHSA-hmw2-7cc7-3qxx","severity":"high","message":"form-data@4.0.5 (npm) is affected by GHSA-hmw2-7cc7-3qxx","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"form-data@4.0.5 (npm):GHSA-hmw2-7cc7-3qxx"},{"rule_id":"osv/GHSA-88fw-hqm2-52qc","severity":"high","message":"hono@4.11.4 (npm) is affected by GHSA-88fw-hqm2-52qc","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"hono@4.11.4 (npm):GHSA-88fw-hqm2-52qc"},{"rule_id":"osv/GHSA-q5qw-h33p-qvwr","severity":"high","message":"hono@4.11.4 (npm) is affected by GHSA-q5qw-h33p-qvwr","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"hono@4.11.4 (npm):GHSA-q5qw-h33p-qvwr"},{"rule_id":"osv/GHSA-2883-xcg3-v3hh","severity":"high","message":"js-yaml@4.1.1 (npm) is affected by GHSA-2883-xcg3-v3hh","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"js-yaml@4.1.1 (npm):GHSA-2883-xcg3-v3hh"},{"rule_id":"osv/GHSA-52cp-r559-cp3m","severity":"high","message":"js-yaml@4.1.1 (npm) is affected by GHSA-52cp-r559-cp3m","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"js-yaml@4.1.1 (npm):GHSA-52cp-r559-cp3m"},{"rule_id":"osv/GHSA-5p4m-2wfm-xmqj","severity":"high","message":"js-yaml@4.1.1 (npm) is affected by GHSA-5p4m-2wfm-xmqj","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"js-yaml@4.1.1 (npm):GHSA-5p4m-2wfm-xmqj"},{"rule_id":"osv/GHSA-j3q9-mxjg-w52f","severity":"high","message":"path-to-regexp@8.3.0 (npm) is affected by GHSA-j3q9-mxjg-w52f","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"path-to-regexp@8.3.0 (npm):GHSA-j3q9-mxjg-w52f"},{"rule_id":"osv/GHSA-66ff-xgx4-vchm","severity":"high","message":"protobufjs@7.5.4 (npm) is affected by GHSA-66ff-xgx4-vchm","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"protobufjs@7.5.4 (npm):GHSA-66ff-xgx4-vchm"},{"rule_id":"osv/GHSA-685m-2w69-288q","severity":"high","message":"protobufjs@7.5.4 (npm) is affected by GHSA-685m-2w69-288q","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"protobufjs@7.5.4 (npm):GHSA-685m-2w69-288q"},{"rule_id":"osv/GHSA-75px-5xx7-5xc7","severity":"high","message":"protobufjs@7.5.4 (npm) is affected by GHSA-75px-5xx7-5xc7","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"protobufjs@7.5.4 (npm):GHSA-75px-5xx7-5xc7"},{"rule_id":"osv/GHSA-jvwf-75h9-cwgg","severity":"high","message":"protobufjs@7.5.4 (npm) is affected by GHSA-jvwf-75h9-cwgg","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"protobufjs@7.5.4 (npm):GHSA-jvwf-75h9-cwgg"},{"rule_id":"osv/GHSA-wcpc-wj8m-hjx6","severity":"high","message":"protobufjs@7.5.4 (npm) is affected by GHSA-wcpc-wj8m-hjx6","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"protobufjs@7.5.4 (npm):GHSA-wcpc-wj8m-hjx6"},{"rule_id":"osv/GHSA-4qx8-w7c3-pj3p","severity":"high","message":"toml@3.0.0 (npm) is affected by GHSA-4qx8-w7c3-pj3p","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"toml@3.0.0 (npm):GHSA-4qx8-w7c3-pj3p"},{"rule_id":"osv/GHSA-82x6-q7mm-w9cf","severity":"high","message":"toml@3.0.0 (npm) is affected by GHSA-82x6-q7mm-w9cf","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"toml@3.0.0 (npm):GHSA-82x6-q7mm-w9cf"},{"rule_id":"osv/GHSA-9j65-hcg3-gc64","severity":"high","message":"toml@3.0.0 (npm) is affected by GHSA-9j65-hcg3-gc64","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"toml@3.0.0 (npm):GHSA-9j65-hcg3-gc64"},{"rule_id":"osv/GHSA-9qmh-m7c6-f92p","severity":"high","message":"toml@3.0.0 (npm) is affected by GHSA-9qmh-m7c6-f92p","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"toml@3.0.0 (npm):GHSA-9qmh-m7c6-f92p"},{"rule_id":"osv/GHSA-h895-cgqg-jf52","severity":"high","message":"toml@3.0.0 (npm) is affected by GHSA-h895-cgqg-jf52","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"toml@3.0.0 (npm):GHSA-h895-cgqg-jf52"},{"rule_id":"osv/GHSA-v5mp-jgw5-2x6j","severity":"high","message":"toml@3.0.0 (npm) is affected by GHSA-v5mp-jgw5-2x6j","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"toml@3.0.0 (npm):GHSA-v5mp-jgw5-2x6j"},{"rule_id":"osv/GHSA-mrhx-c7xc-m3w5","severity":"high","message":"zod@4.3.5 (npm) is affected by GHSA-mrhx-c7xc-m3w5","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"zod@4.3.5 (npm):GHSA-mrhx-c7xc-m3w5"},{"rule_id":"osv/GHSA-866g-f22w-33x8","severity":"medium","message":"@ai-sdk/provider-utils@4.0.23 (npm) is affected by GHSA-866g-f22w-33x8","path":"coval/bun.lock","line":null,"fingerprint":"@ai-sdk/provider-utils@4.0.23 (npm):GHSA-866g-f22w-33x8"},{"rule_id":"osv/GHSA-hhx9-57xq-r5rw","severity":"medium","message":"@hey-api/openapi-ts@0.80.13 (npm) is affected by GHSA-hhx9-57xq-r5rw","path":"coval/bun.lock","line":null,"fingerprint":"@hey-api/openapi-ts@0.80.13 (npm):GHSA-hhx9-57xq-r5rw"},{"rule_id":"osv/GHSA-p498-v437-472g","severity":"medium","message":"@humanfs/node@0.16.7 (npm) is affected by GHSA-p498-v437-472g","path":"coval/bun.lock","line":null,"fingerprint":"@humanfs/node@0.16.7 (npm):GHSA-p498-v437-472g"},{"rule_id":"osv/GHSA-6prh-2h8m-c8cw","severity":"medium","message":"@modelcontextprotocol/sdk@1.20.2 (npm) is affected by GHSA-6prh-2h8m-c8cw","path":"coval/bun.lock","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.20.2 (npm):GHSA-6prh-2h8m-c8cw"},{"rule_id":"osv/GHSA-rvq5-wwqv-78pq","severity":"medium","message":"@modelcontextprotocol/sdk@1.20.2 (npm) is affected by GHSA-rvq5-wwqv-78pq","path":"coval/bun.lock","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.20.2 (npm):GHSA-rvq5-wwqv-78pq"},{"rule_id":"osv/GHSA-2g4f-4pwh-qvx6","severity":"medium","message":"ajv@6.12.6 (npm) is affected by GHSA-2g4f-4pwh-qvx6","path":"coval/bun.lock","line":null,"fingerprint":"ajv@6.12.6 (npm):GHSA-2g4f-4pwh-qvx6"},{"rule_id":"osv/GHSA-3p68-rc4w-qgx5","severity":"medium","message":"axios@1.11.0 (npm) is affected by GHSA-3p68-rc4w-qgx5","path":"coval/bun.lock","line":null,"fingerprint":"axios@1.11.0 (npm):GHSA-3p68-rc4w-qgx5"},{"rule_id":"osv/GHSA-3w6x-2g7m-8v23","severity":"medium","message":"axios@1.11.0 (npm) is affected by GHSA-3w6x-2g7m-8v23","path":"coval/bun.lock","line":null,"fingerprint":"axios@1.11.0 (npm):GHSA-3w6x-2g7m-8v23"},{"rule_id":"osv/GHSA-42h9-826w-cgv3","severity":"medium","message":"axios@1.11.0 (npm) is affected by GHSA-42h9-826w-cgv3","path":"coval/bun.lock","line":null,"fingerprint":"axios@1.11.0 (npm):GHSA-42h9-826w-cgv3"},{"rule_id":"osv/GHSA-445q-vr5w-6q77","severity":"medium","message":"axios@1.11.0 (npm) is affected by GHSA-445q-vr5w-6q77","path":"coval/bun.lock","line":null,"fingerprint":"axios@1.11.0 (npm):GHSA-445q-vr5w-6q77"},{"rule_id":"osv/GHSA-5c9x-8gcm-mpgx","severity":"medium","message":"axios@1.11.0 (npm) is affected by GHSA-5c9x-8gcm-mpgx","path":"coval/bun.lock","line":null,"fingerprint":"axios@1.11.0 (npm):GHSA-5c9x-8gcm-mpgx"},{"rule_id":"osv/GHSA-7q8q-rj6j-mhjq","severity":"medium","message":"axios@1.11.0 (npm) is affected by GHSA-7q8q-rj6j-mhjq","path":"coval/bun.lock","line":null,"fingerprint":"axios@1.11.0 (npm):GHSA-7q8q-rj6j-mhjq"},{"rule_id":"osv/GHSA-898c-q2cr-xwhg","severity":"medium","message":"axios@1.11.0 (npm) is affected by GHSA-898c-q2cr-xwhg","path":"coval/bun.lock","line":null,"fingerprint":"axios@1.11.0 (npm):GHSA-898c-q2cr-xwhg"},{"rule_id":"osv/GHSA-9fr6-4gfg-395g","severity":"medium","message":"axios@1.11.0 (npm) is affected by GHSA-9fr6-4gfg-395g","path":"coval/bun.lock","line":null,"fingerprint":"axios@1.11.0 (npm):GHSA-9fr6-4gfg-395g"},{"rule_id":"osv/GHSA-fvcv-3m26-pcqx","severity":"medium","message":"axios@1.11.0 (npm) is affected by GHSA-fvcv-3m26-pcqx","path":"coval/bun.lock","line":null,"fingerprint":"axios@1.11.0 (npm):GHSA-fvcv-3m26-pcqx"},{"rule_id":"osv/GHSA-j8rh-479h-cp32","severity":"medium","message":"axios@1.11.0 (npm) is affected by GHSA-j8rh-479h-cp32","path":"coval/bun.lock","line":null,"fingerprint":"axios@1.11.0 (npm):GHSA-j8rh-479h-cp32"},{"rule_id":"osv/GHSA-jqh4-m9w3-8hp9","severity":"medium","message":"axios@1.11.0 (npm) is affected by GHSA-jqh4-m9w3-8hp9","path":"coval/bun.lock","line":null,"fingerprint":"axios@1.11.0 (npm):GHSA-jqh4-m9w3-8hp9"},{"rule_id":"osv/GHSA-m7pr-hjqh-92cm","severity":"medium","message":"axios@1.11.0 (npm) is affected by GHSA-m7pr-hjqh-92cm","path":"coval/bun.lock","line":null,"fingerprint":"axios@1.11.0 (npm):GHSA-m7pr-hjqh-92cm"},{"rule_id":"osv/GHSA-mmx7-hfxf-jppx","severity":"medium","message":"axios@1.11.0 (npm) is affected by GHSA-mmx7-hfxf-jppx","path":"coval/bun.lock","line":null,"fingerprint":"axios@1.11.0 (npm):GHSA-mmx7-hfxf-jppx"},{"rule_id":"osv/GHSA-pmv8-rq9r-6j72","severity":"medium","message":"axios@1.11.0 (npm) is affected by GHSA-pmv8-rq9r-6j72","path":"coval/bun.lock","line":null,"fingerprint":"axios@1.11.0 (npm):GHSA-pmv8-rq9r-6j72"},{"rule_id":"osv/GHSA-vf2m-468p-8v99","severity":"medium","message":"axios@1.11.0 (npm) is affected by GHSA-vf2m-468p-8v99","path":"coval/bun.lock","line":null,"fingerprint":"axios@1.11.0 (npm):GHSA-vf2m-468p-8v99"},{"rule_id":"osv/GHSA-vh66-26gq-q6x8","severity":"medium","message":"axios@1.11.0 (npm) is affected by GHSA-vh66-26gq-q6x8","path":"coval/bun.lock","line":null,"fingerprint":"axios@1.11.0 (npm):GHSA-vh66-26gq-q6x8"},{"rule_id":"osv/GHSA-w9j2-pvgh-6h63","severity":"medium","message":"axios@1.11.0 (npm) is affected by GHSA-w9j2-pvgh-6h63","path":"coval/bun.lock","line":null,"fingerprint":"axios@1.11.0 (npm):GHSA-w9j2-pvgh-6h63"},{"rule_id":"osv/GHSA-xx6v-rp6x-q39c","severity":"medium","message":"axios@1.11.0 (npm) is affected by GHSA-xx6v-rp6x-q39c","path":"coval/bun.lock","line":null,"fingerprint":"axios@1.11.0 (npm):GHSA-xx6v-rp6x-q39c"},{"rule_id":"osv/GHSA-w5vr-8v7q-w6rv","severity":"medium","message":"baseline-browser-mapping@2.10.21 (npm) is affected by GHSA-w5vr-8v7q-w6rv","path":"coval/bun.lock","line":null,"fingerprint":"baseline-browser-mapping@2.10.21 (npm):GHSA-w5vr-8v7q-w6rv"},{"rule_id":"osv/GHSA-w5vr-8v7q-w6rv","severity":"medium","message":"baseline-browser-mapping@2.9.14 (npm) is affected by GHSA-w5vr-8v7q-w6rv","path":"coval/bun.lock","line":null,"fingerprint":"baseline-browser-mapping@2.9.14 (npm):GHSA-w5vr-8v7q-w6rv"},{"rule_id":"osv/GHSA-5pm8-86m8-9m6r","severity":"medium","message":"basic-ftp@5.1.0 (npm) is affected by GHSA-5pm8-86m8-9m6r","path":"coval/bun.lock","line":null,"fingerprint":"basic-ftp@5.1.0 (npm):GHSA-5pm8-86m8-9m6r"},{"rule_id":"osv/GHSA-r4jh-29pc-gfqr","severity":"medium","message":"basic-ftp@5.1.0 (npm) is affected by GHSA-r4jh-29pc-gfqr","path":"coval/bun.lock","line":null,"fingerprint":"basic-ftp@5.1.0 (npm):GHSA-r4jh-29pc-gfqr"},{"rule_id":"osv/GHSA-wqch-xfxh-vrr4","severity":"medium","message":"body-parser@2.2.0 (npm) is affected by GHSA-wqch-xfxh-vrr4","path":"coval/bun.lock","line":null,"fingerprint":"body-parser@2.2.0 (npm):GHSA-wqch-xfxh-vrr4"},{"rule_id":"osv/GHSA-f886-m6hf-6m8v","severity":"medium","message":"brace-expansion@1.1.12 (npm) is affected by GHSA-f886-m6hf-6m8v","path":"coval/bun.lock","line":null,"fingerprint":"brace-expansion@1.1.12 (npm):GHSA-f886-m6hf-6m8v"},{"rule_id":"osv/GHSA-q2hr-2g5m-vwhr","severity":"medium","message":"brace-expansion@1.1.12 (npm) is affected by GHSA-q2hr-2g5m-vwhr","path":"coval/bun.lock","line":null,"fingerprint":"brace-expansion@1.1.12 (npm):GHSA-q2hr-2g5m-vwhr"},{"rule_id":"osv/GHSA-f886-m6hf-6m8v","severity":"medium","message":"brace-expansion@2.0.2 (npm) is affected by GHSA-f886-m6hf-6m8v","path":"coval/bun.lock","line":null,"fingerprint":"brace-expansion@2.0.2 (npm):GHSA-f886-m6hf-6m8v"},{"rule_id":"osv/GHSA-q2hr-2g5m-vwhr","severity":"medium","message":"brace-expansion@2.0.2 (npm) is affected by GHSA-q2hr-2g5m-vwhr","path":"coval/bun.lock","line":null,"fingerprint":"brace-expansion@2.0.2 (npm):GHSA-q2hr-2g5m-vwhr"},{"rule_id":"osv/GHSA-jxxr-4gwj-5jf2","severity":"medium","message":"brace-expansion@5.0.5 (npm) is affected by GHSA-jxxr-4gwj-5jf2","path":"coval/bun.lock","line":null,"fingerprint":"brace-expansion@5.0.5 (npm):GHSA-jxxr-4gwj-5jf2"},{"rule_id":"osv/GHSA-q2hr-2g5m-vwhr","severity":"medium","message":"brace-expansion@5.0.5 (npm) is affected by GHSA-q2hr-2g5m-vwhr","path":"coval/bun.lock","line":null,"fingerprint":"brace-expansion@5.0.5 (npm):GHSA-q2hr-2g5m-vwhr"},{"rule_id":"osv/GHSA-39q2-94rc-95cp","severity":"medium","message":"dompurify@3.1.7 (npm) is affected by GHSA-39q2-94rc-95cp","path":"coval/bun.lock","line":null,"fingerprint":"dompurify@3.1.7 (npm):GHSA-39q2-94rc-95cp"},{"rule_id":"osv/GHSA-55q2-fjhq-7xh7","severity":"medium","message":"dompurify@3.1.7 (npm) is affected by GHSA-55q2-fjhq-7xh7","path":"coval/bun.lock","line":null,"fingerprint":"dompurify@3.1.7 (npm):GHSA-55q2-fjhq-7xh7"},{"rule_id":"osv/GHSA-6688-9rhm-gjv2","severity":"medium","message":"dompurify@3.1.7 (npm) is affected by GHSA-6688-9rhm-gjv2","path":"coval/bun.lock","line":null,"fingerprint":"dompurify@3.1.7 (npm):GHSA-6688-9rhm-gjv2"},{"rule_id":"osv/GHSA-76mc-f452-cxcm","severity":"medium","message":"dompurify@3.1.7 (npm) is affected by GHSA-76mc-f452-cxcm","path":"coval/bun.lock","line":null,"fingerprint":"dompurify@3.1.7 (npm):GHSA-76mc-f452-cxcm"},{"rule_id":"osv/GHSA-c6gr-qvv4-5v3f","severity":"medium","message":"dompurify@3.1.7 (npm) is affected by GHSA-c6gr-qvv4-5v3f","path":"coval/bun.lock","line":null,"fingerprint":"dompurify@3.1.7 (npm):GHSA-c6gr-qvv4-5v3f"},{"rule_id":"osv/GHSA-cj63-jhhr-wcxv","severity":"medium","message":"dompurify@3.1.7 (npm) is affected by GHSA-cj63-jhhr-wcxv","path":"coval/bun.lock","line":null,"fingerprint":"dompurify@3.1.7 (npm):GHSA-cj63-jhhr-wcxv"},{"rule_id":"osv/GHSA-cjmm-f4jc-qw8r","severity":"medium","message":"dompurify@3.1.7 (npm) is affected by GHSA-cjmm-f4jc-qw8r","path":"coval/bun.lock","line":null,"fingerprint":"dompurify@3.1.7 (npm):GHSA-cjmm-f4jc-qw8r"},{"rule_id":"osv/GHSA-cmwh-pvxp-8882","severity":"medium","message":"dompurify@3.1.7 (npm) is affected by GHSA-cmwh-pvxp-8882","path":"coval/bun.lock","line":null,"fingerprint":"dompurify@3.1.7 (npm):GHSA-cmwh-pvxp-8882"},{"rule_id":"osv/GHSA-crv5-9vww-q3g8","severity":"medium","message":"dompurify@3.1.7 (npm) is affected by GHSA-crv5-9vww-q3g8","path":"coval/bun.lock","line":null,"fingerprint":"dompurify@3.1.7 (npm):GHSA-crv5-9vww-q3g8"},{"rule_id":"osv/GHSA-h7mw-gpvr-xq4m","severity":"medium","message":"dompurify@3.1.7 (npm) is affected by GHSA-h7mw-gpvr-xq4m","path":"coval/bun.lock","line":null,"fingerprint":"dompurify@3.1.7 (npm):GHSA-h7mw-gpvr-xq4m"},{"rule_id":"osv/GHSA-h8r8-wccr-v5f2","severity":"medium","message":"dompurify@3.1.7 (npm) is affected by GHSA-h8r8-wccr-v5f2","path":"coval/bun.lock","line":null,"fingerprint":"dompurify@3.1.7 (npm):GHSA-h8r8-wccr-v5f2"},{"rule_id":"osv/GHSA-hpcv-96wg-7vj8","severity":"medium","message":"dompurify@3.1.7 (npm) is affected by GHSA-hpcv-96wg-7vj8","path":"coval/bun.lock","line":null,"fingerprint":"dompurify@3.1.7 (npm):GHSA-hpcv-96wg-7vj8"},{"rule_id":"osv/GHSA-r47g-fvhr-h676","severity":"medium","message":"dompurify@3.1.7 (npm) is affected by GHSA-r47g-fvhr-h676","path":"coval/bun.lock","line":null,"fingerprint":"dompurify@3.1.7 (npm):GHSA-r47g-fvhr-h676"},{"rule_id":"osv/GHSA-rp9w-3fw7-7cwq","severity":"medium","message":"dompurify@3.1.7 (npm) is affected by GHSA-rp9w-3fw7-7cwq","path":"coval/bun.lock","line":null,"fingerprint":"dompurify@3.1.7 (npm):GHSA-rp9w-3fw7-7cwq"},{"rule_id":"osv/GHSA-v2wj-7wpq-c8vv","severity":"medium","message":"dompurify@3.1.7 (npm) is affected by GHSA-v2wj-7wpq-c8vv","path":"coval/bun.lock","line":null,"fingerprint":"dompurify@3.1.7 (npm):GHSA-v2wj-7wpq-c8vv"},{"rule_id":"osv/GHSA-v8jm-5vwx-cfxm","severity":"medium","message":"dompurify@3.1.7 (npm) is affected by GHSA-v8jm-5vwx-cfxm","path":"coval/bun.lock","line":null,"fingerprint":"dompurify@3.1.7 (npm):GHSA-v8jm-5vwx-cfxm"},{"rule_id":"osv/GHSA-v9jr-rg53-9pgp","severity":"medium","message":"dompurify@3.1.7 (npm) is affected by GHSA-v9jr-rg53-9pgp","path":"coval/bun.lock","line":null,"fingerprint":"dompurify@3.1.7 (npm):GHSA-v9jr-rg53-9pgp"},{"rule_id":"osv/GHSA-vhxf-7vqr-mrjg","severity":"medium","message":"dompurify@3.1.7 (npm) is affected by GHSA-vhxf-7vqr-mrjg","path":"coval/bun.lock","line":null,"fingerprint":"dompurify@3.1.7 (npm):GHSA-vhxf-7vqr-mrjg"},{"rule_id":"osv/GHSA-x4vx-rjvf-j5p4","severity":"medium","message":"dompurify@3.1.7 (npm) is affected by GHSA-x4vx-rjvf-j5p4","path":"coval/bun.lock","line":null,"fingerprint":"dompurify@3.1.7 (npm):GHSA-x4vx-rjvf-j5p4"},{"rule_id":"osv/GHSA-r4q5-vmmm-2653","severity":"medium","message":"follow-redirects@1.15.11 (npm) is affected by GHSA-r4q5-vmmm-2653; also in pr-review-agent/bun.lock","path":"coval/bun.lock","line":null,"fingerprint":"follow-redirects@1.15.11 (npm):GHSA-r4q5-vmmm-2653"},{"rule_id":"osv/GHSA-3g3m-2fjr-6pw4","severity":"medium","message":"glob@10.5.0 (npm) is affected by GHSA-3g3m-2fjr-6pw4","path":"coval/bun.lock","line":null,"fingerprint":"glob@10.5.0 (npm):GHSA-3g3m-2fjr-6pw4"},{"rule_id":"osv/GHSA-2qvq-rjwj-gvw9","severity":"medium","message":"handlebars@4.7.8 (npm) is affected by GHSA-2qvq-rjwj-gvw9","path":"coval/bun.lock","line":null,"fingerprint":"handlebars@4.7.8 (npm):GHSA-2qvq-rjwj-gvw9"},{"rule_id":"osv/GHSA-7rx3-28cr-v5wh","severity":"medium","message":"handlebars@4.7.8 (npm) is affected by GHSA-7rx3-28cr-v5wh","path":"coval/bun.lock","line":null,"fingerprint":"handlebars@4.7.8 (npm):GHSA-7rx3-28cr-v5wh"},{"rule_id":"osv/GHSA-xw65-4hp5-5hc7","severity":"medium","message":"handlebars@4.7.8 (npm) is affected by GHSA-xw65-4hp5-5hc7","path":"coval/bun.lock","line":null,"fingerprint":"handlebars@4.7.8 (npm):GHSA-xw65-4hp5-5hc7"},{"rule_id":"osv/GHSA-h3mg-xc3c-68pw","severity":"medium","message":"ip-address@10.1.0 (npm) is affected by GHSA-h3mg-xc3c-68pw","path":"coval/bun.lock","line":null,"fingerprint":"ip-address@10.1.0 (npm):GHSA-h3mg-xc3c-68pw"},{"rule_id":"osv/GHSA-j6r3-76f7-8jcv","severity":"medium","message":"ip-address@10.1.0 (npm) is affected by GHSA-j6r3-76f7-8jcv","path":"coval/bun.lock","line":null,"fingerprint":"ip-address@10.1.0 (npm):GHSA-j6r3-76f7-8jcv"},{"rule_id":"osv/GHSA-rpw4-54j3-4h4q","severity":"medium","message":"ip-address@10.1.0 (npm) is affected by GHSA-rpw4-54j3-4h4q","path":"coval/bun.lock","line":null,"fingerprint":"ip-address@10.1.0 (npm):GHSA-rpw4-54j3-4h4q"},{"rule_id":"osv/GHSA-rxp7-6hxx-x8q5","severity":"medium","message":"ip-address@10.1.0 (npm) is affected by GHSA-rxp7-6hxx-x8q5","path":"coval/bun.lock","line":null,"fingerprint":"ip-address@10.1.0 (npm):GHSA-rxp7-6hxx-x8q5"},{"rule_id":"osv/GHSA-v2v4-37r5-5v8g","severity":"medium","message":"ip-address@10.1.0 (npm) is affected by GHSA-v2v4-37r5-5v8g","path":"coval/bun.lock","line":null,"fingerprint":"ip-address@10.1.0 (npm):GHSA-v2v4-37r5-5v8g"},{"rule_id":"osv/GHSA-h67p-54hq-rp68","severity":"medium","message":"js-yaml@4.1.0 (npm) is affected by GHSA-h67p-54hq-rp68","path":"coval/bun.lock","line":null,"fingerprint":"js-yaml@4.1.0 (npm):GHSA-h67p-54hq-rp68"},{"rule_id":"osv/GHSA-mh29-5h37-fv8m","severity":"medium","message":"js-yaml@4.1.0 (npm) is affected by GHSA-mh29-5h37-fv8m","path":"coval/bun.lock","line":null,"fingerprint":"js-yaml@4.1.0 (npm):GHSA-mh29-5h37-fv8m"},{"rule_id":"osv/GHSA-xxjr-mmjv-4gpg","severity":"medium","message":"lodash@4.17.21 (npm) is affected by GHSA-xxjr-mmjv-4gpg; also in pr-review-agent/bun.lock","path":"coval/bun.lock","line":null,"fingerprint":"lodash@4.17.21 (npm):GHSA-xxjr-mmjv-4gpg"},{"rule_id":"osv/GHSA-4fh9-h7wg-q85m","severity":"medium","message":"mdast-util-to-hast@13.2.0 (npm) is affected by GHSA-4fh9-h7wg-q85m","path":"coval/bun.lock","line":null,"fingerprint":"mdast-util-to-hast@13.2.0 (npm):GHSA-4fh9-h7wg-q85m"},{"rule_id":"osv/GHSA-g3hv-75wg-m249","severity":"medium","message":"minimatch@10.2.5 (npm) is affected by GHSA-g3hv-75wg-m249","path":"coval/bun.lock","line":null,"fingerprint":"minimatch@10.2.5 (npm):GHSA-g3hv-75wg-m249"},{"rule_id":"osv/GHSA-g3hv-75wg-m249","severity":"medium","message":"minimatch@9.0.5 (npm) is affected by GHSA-g3hv-75wg-m249","path":"coval/bun.lock","line":null,"fingerprint":"minimatch@9.0.5 (npm):GHSA-g3hv-75wg-m249"},{"rule_id":"osv/GHSA-39w2-rjm5-chcv","severity":"medium","message":"next@16.2.4 (npm) is affected by GHSA-39w2-rjm5-chcv","path":"coval/bun.lock","line":null,"fingerprint":"next@16.2.4 (npm):GHSA-39w2-rjm5-chcv"},{"rule_id":"osv/GHSA-4633-3j49-mh5q","severity":"medium","message":"next@16.2.4 (npm) is affected by GHSA-4633-3j49-mh5q","path":"coval/bun.lock","line":null,"fingerprint":"next@16.2.4 (npm):GHSA-4633-3j49-mh5q"},{"rule_id":"osv/GHSA-4c39-4ccg-62r3","severity":"medium","message":"next@16.2.4 (npm) is affected by GHSA-4c39-4ccg-62r3","path":"coval/bun.lock","line":null,"fingerprint":"next@16.2.4 (npm):GHSA-4c39-4ccg-62r3"},{"rule_id":"osv/GHSA-4jqv-mc3x-m676","severity":"medium","message":"next@16.2.4 (npm) is affected by GHSA-4jqv-mc3x-m676","path":"coval/bun.lock","line":null,"fingerprint":"next@16.2.4 (npm):GHSA-4jqv-mc3x-m676"},{"rule_id":"osv/GHSA-68g3-v927-f742","severity":"medium","message":"next@16.2.4 (npm) is affected by GHSA-68g3-v927-f742","path":"coval/bun.lock","line":null,"fingerprint":"next@16.2.4 (npm):GHSA-68g3-v927-f742"},{"rule_id":"osv/GHSA-955p-x3mx-jcvp","severity":"medium","message":"next@16.2.4 (npm) is affected by GHSA-955p-x3mx-jcvp","path":"coval/bun.lock","line":null,"fingerprint":"next@16.2.4 (npm):GHSA-955p-x3mx-jcvp"},{"rule_id":"osv/GHSA-f87g-xv8r-7p7x","severity":"medium","message":"next@16.2.4 (npm) is affected by GHSA-f87g-xv8r-7p7x","path":"coval/bun.lock","line":null,"fingerprint":"next@16.2.4 (npm):GHSA-f87g-xv8r-7p7x"},{"rule_id":"osv/GHSA-ffhc-5mcf-pf4q","severity":"medium","message":"next@16.2.4 (npm) is affected by GHSA-ffhc-5mcf-pf4q","path":"coval/bun.lock","line":null,"fingerprint":"next@16.2.4 (npm):GHSA-ffhc-5mcf-pf4q"},{"rule_id":"osv/GHSA-gx5p-jg67-6x7h","severity":"medium","message":"next@16.2.4 (npm) is affected by GHSA-gx5p-jg67-6x7h","path":"coval/bun.lock","line":null,"fingerprint":"next@16.2.4 (npm):GHSA-gx5p-jg67-6x7h"},{"rule_id":"osv/GHSA-h64f-5h5j-jqjh","severity":"medium","message":"next@16.2.4 (npm) is affected by GHSA-h64f-5h5j-jqjh","path":"coval/bun.lock","line":null,"fingerprint":"next@16.2.4 (npm):GHSA-h64f-5h5j-jqjh"},{"rule_id":"osv/GHSA-mcj8-r9mp-w47p","severity":"medium","message":"next@16.2.4 (npm) is affected by GHSA-mcj8-r9mp-w47p","path":"coval/bun.lock","line":null,"fingerprint":"next@16.2.4 (npm):GHSA-mcj8-r9mp-w47p"},{"rule_id":"osv/GHSA-q8wf-6r8g-63ch","severity":"medium","message":"next@16.2.4 (npm) is affected by GHSA-q8wf-6r8g-63ch","path":"coval/bun.lock","line":null,"fingerprint":"next@16.2.4 (npm):GHSA-q8wf-6r8g-63ch"},{"rule_id":"osv/GHSA-wfc6-r584-vfw7","severity":"medium","message":"next@16.2.4 (npm) is affected by GHSA-wfc6-r584-vfw7","path":"coval/bun.lock","line":null,"fingerprint":"next@16.2.4 (npm):GHSA-wfc6-r584-vfw7"},{"rule_id":"osv/GHSA-27v5-c462-wpq7","severity":"medium","message":"path-to-regexp@8.2.0 (npm) is affected by GHSA-27v5-c462-wpq7","path":"coval/bun.lock","line":null,"fingerprint":"path-to-regexp@8.2.0 (npm):GHSA-27v5-c462-wpq7"},{"rule_id":"osv/GHSA-3v7f-55p6-f55p","severity":"medium","message":"picomatch@2.3.1 (npm) is affected by GHSA-3v7f-55p6-f55p; also in coval/codegen-sandbox/app/bun.lock","path":"coval/bun.lock","line":null,"fingerprint":"picomatch@2.3.1 (npm):GHSA-3v7f-55p6-f55p"},{"rule_id":"osv/GHSA-3v7f-55p6-f55p","severity":"medium","message":"picomatch@4.0.3 (npm) is affected by GHSA-3v7f-55p6-f55p; also in coval/codegen-sandbox/app/bun.lock","path":"coval/bun.lock","line":null,"fingerprint":"picomatch@4.0.3 (npm):GHSA-3v7f-55p6-f55p"},{"rule_id":"osv/GHSA-fxqj-rqcc-2cmp","severity":"medium","message":"postcss@8.4.31 (npm) is affected by GHSA-fxqj-rqcc-2cmp","path":"coval/bun.lock","line":null,"fingerprint":"postcss@8.4.31 (npm):GHSA-fxqj-rqcc-2cmp"},{"rule_id":"osv/GHSA-qx2v-qp2m-jg93","severity":"medium","message":"postcss@8.4.31 (npm) is affected by GHSA-qx2v-qp2m-jg93","path":"coval/bun.lock","line":null,"fingerprint":"postcss@8.4.31 (npm):GHSA-qx2v-qp2m-jg93"},{"rule_id":"osv/GHSA-fxqj-rqcc-2cmp","severity":"medium","message":"postcss@8.5.10 (npm) is affected by GHSA-fxqj-rqcc-2cmp","path":"coval/bun.lock","line":null,"fingerprint":"postcss@8.5.10 (npm):GHSA-fxqj-rqcc-2cmp"},{"rule_id":"osv/GHSA-4mjr-xmp4-gh2g","severity":"medium","message":"qs@6.14.0 (npm) is affected by GHSA-4mjr-xmp4-gh2g","path":"coval/bun.lock","line":null,"fingerprint":"qs@6.14.0 (npm):GHSA-4mjr-xmp4-gh2g"},{"rule_id":"osv/GHSA-6pq8-jhm2-2vcw","severity":"medium","message":"qs@6.14.0 (npm) is affected by GHSA-6pq8-jhm2-2vcw","path":"coval/bun.lock","line":null,"fingerprint":"qs@6.14.0 (npm):GHSA-6pq8-jhm2-2vcw"},{"rule_id":"osv/GHSA-6rw7-vpxm-498p","severity":"medium","message":"qs@6.14.0 (npm) is affected by GHSA-6rw7-vpxm-498p","path":"coval/bun.lock","line":null,"fingerprint":"qs@6.14.0 (npm):GHSA-6rw7-vpxm-498p"},{"rule_id":"osv/GHSA-q8mj-m7cp-5q26","severity":"medium","message":"qs@6.14.0 (npm) is affected by GHSA-q8mj-m7cp-5q26","path":"coval/bun.lock","line":null,"fingerprint":"qs@6.14.0 (npm):GHSA-q8mj-m7cp-5q26"},{"rule_id":"osv/GHSA-gvwx-54wh-qm9j","severity":"medium","message":"tar@6.2.1 (npm) is affected by GHSA-gvwx-54wh-qm9j","path":"coval/bun.lock","line":null,"fingerprint":"tar@6.2.1 (npm):GHSA-gvwx-54wh-qm9j"},{"rule_id":"osv/GHSA-vmf3-w455-68vh","severity":"medium","message":"tar@6.2.1 (npm) is affected by GHSA-vmf3-w455-68vh","path":"coval/bun.lock","line":null,"fingerprint":"tar@6.2.1 (npm):GHSA-vmf3-w455-68vh"},{"rule_id":"osv/GHSA-w8wr-v893-vjvp","severity":"medium","message":"tar@6.2.1 (npm) is affected by GHSA-w8wr-v893-vjvp","path":"coval/bun.lock","line":null,"fingerprint":"tar@6.2.1 (npm):GHSA-w8wr-v893-vjvp"},{"rule_id":"osv/GHSA-58qx-3vcg-4xpx","severity":"medium","message":"ws@8.19.0 (npm) is affected by GHSA-58qx-3vcg-4xpx; also in pr-review-agent/bun.lock","path":"coval/bun.lock","line":null,"fingerprint":"ws@8.19.0 (npm):GHSA-58qx-3vcg-4xpx"},{"rule_id":"osv/GHSA-48c2-rrv3-qjmp","severity":"medium","message":"yaml@2.8.1 (npm) is affected by GHSA-48c2-rrv3-qjmp","path":"coval/bun.lock","line":null,"fingerprint":"yaml@2.8.1 (npm):GHSA-48c2-rrv3-qjmp"},{"rule_id":"osv/GHSA-r3h5-4585-7x3w","severity":"medium","message":"astro@7.3.8 (npm) is affected by GHSA-r3h5-4585-7x3w","path":"coval/codegen-sandbox/app/bun.lock","line":null,"fingerprint":"astro@7.3.8 (npm):GHSA-r3h5-4585-7x3w"},{"rule_id":"osv/GHSA-fxqj-rqcc-2cmp","severity":"medium","message":"postcss@8.5.6 (npm) is affected by GHSA-fxqj-rqcc-2cmp","path":"coval/codegen-sandbox/app/bun.lock","line":null,"fingerprint":"postcss@8.5.6 (npm):GHSA-fxqj-rqcc-2cmp"},{"rule_id":"osv/GHSA-qx2v-qp2m-jg93","severity":"medium","message":"postcss@8.5.6 (npm) is affected by GHSA-qx2v-qp2m-jg93","path":"coval/codegen-sandbox/app/bun.lock","line":null,"fingerprint":"postcss@8.5.6 (npm):GHSA-qx2v-qp2m-jg93"},{"rule_id":"osv/GHSA-rj75-hqrm-r3gf","severity":"medium","message":"postcss-selector-parser@6.0.10 (npm) is affected by GHSA-rj75-hqrm-r3gf","path":"coval/codegen-sandbox/app/bun.lock","line":null,"fingerprint":"postcss-selector-parser@6.0.10 (npm):GHSA-rj75-hqrm-r3gf"},{"rule_id":"osv/GHSA-rj75-hqrm-r3gf","severity":"medium","message":"postcss-selector-parser@6.1.2 (npm) is affected by GHSA-rj75-hqrm-r3gf","path":"coval/codegen-sandbox/app/bun.lock","line":null,"fingerprint":"postcss-selector-parser@6.1.2 (npm):GHSA-rj75-hqrm-r3gf"},{"rule_id":"osv/GHSA-w9m9-85wc-3x92","severity":"medium","message":"postcss-selector-parser@6.1.2 (npm) is affected by GHSA-w9m9-85wc-3x92","path":"coval/codegen-sandbox/app/bun.lock","line":null,"fingerprint":"postcss-selector-parser@6.1.2 (npm):GHSA-w9m9-85wc-3x92"},{"rule_id":"osv/GHSA-4qv8-2p9j-2685","severity":"medium","message":"undici@8.11.2 (npm) is affected by GHSA-4qv8-2p9j-2685","path":"coval/codegen-sandbox/app/bun.lock","line":null,"fingerprint":"undici@8.11.2 (npm):GHSA-4qv8-2p9j-2685"},{"rule_id":"osv/GHSA-55wc-3pg8-jfw6","severity":"medium","message":"undici@8.11.2 (npm) is affected by GHSA-55wc-3pg8-jfw6","path":"coval/codegen-sandbox/app/bun.lock","line":null,"fingerprint":"undici@8.11.2 (npm):GHSA-55wc-3pg8-jfw6"},{"rule_id":"osv/GHSA-9fm3-97px-rjf6","severity":"medium","message":"undici@8.11.2 (npm) is affected by GHSA-9fm3-97px-rjf6","path":"coval/codegen-sandbox/app/bun.lock","line":null,"fingerprint":"undici@8.11.2 (npm):GHSA-9fm3-97px-rjf6"},{"rule_id":"osv/GHSA-f72v-6w45-q472","severity":"medium","message":"undici@8.11.2 (npm) is affected by GHSA-f72v-6w45-q472","path":"coval/codegen-sandbox/app/bun.lock","line":null,"fingerprint":"undici@8.11.2 (npm):GHSA-f72v-6w45-q472"},{"rule_id":"osv/GHSA-48c2-rrv3-qjmp","severity":"medium","message":"yaml@2.8.2 (npm) is affected by GHSA-48c2-rrv3-qjmp; also in pr-review-agent/bun.lock","path":"coval/codegen-sandbox/app/bun.lock","line":null,"fingerprint":"yaml@2.8.2 (npm):GHSA-48c2-rrv3-qjmp"},{"rule_id":"osv/GHSA-866g-f22w-33x8","severity":"medium","message":"@ai-sdk/provider-utils@3.0.20 (npm) is affected by GHSA-866g-f22w-33x8","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"@ai-sdk/provider-utils@3.0.20 (npm):GHSA-866g-f22w-33x8"},{"rule_id":"osv/GHSA-866g-f22w-33x8","severity":"medium","message":"@ai-sdk/provider-utils@4.0.8 (npm) is affected by GHSA-866g-f22w-33x8","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"@ai-sdk/provider-utils@4.0.8 (npm):GHSA-866g-f22w-33x8"},{"rule_id":"osv/GHSA-hhx9-57xq-r5rw","severity":"medium","message":"@hey-api/openapi-ts@0.90.4 (npm) is affected by GHSA-hhx9-57xq-r5rw","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"@hey-api/openapi-ts@0.90.4 (npm):GHSA-hhx9-57xq-r5rw"},{"rule_id":"osv/GHSA-92pp-h63x-v22m","severity":"medium","message":"@hono/node-server@1.19.9 (npm) is affected by GHSA-92pp-h63x-v22m","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"@hono/node-server@1.19.9 (npm):GHSA-92pp-h63x-v22m"},{"rule_id":"osv/GHSA-frvp-7c67-39w9","severity":"medium","message":"@hono/node-server@1.19.9 (npm) is affected by GHSA-frvp-7c67-39w9","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"@hono/node-server@1.19.9 (npm):GHSA-frvp-7c67-39w9"},{"rule_id":"osv/GHSA-jpvv-r467-5p4w","severity":"medium","message":"@hono/node-server@1.19.9 (npm) is affected by GHSA-jpvv-r467-5p4w","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"@hono/node-server@1.19.9 (npm):GHSA-jpvv-r467-5p4w"},{"rule_id":"osv/GHSA-6prh-2h8m-c8cw","severity":"medium","message":"@modelcontextprotocol/sdk@1.25.3 (npm) is affected by GHSA-6prh-2h8m-c8cw","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.25.3 (npm):GHSA-6prh-2h8m-c8cw"},{"rule_id":"osv/GHSA-rvq5-wwqv-78pq","severity":"medium","message":"@modelcontextprotocol/sdk@1.25.3 (npm) is affected by GHSA-rvq5-wwqv-78pq","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.25.3 (npm):GHSA-rvq5-wwqv-78pq"},{"rule_id":"osv/GHSA-8988-4f7v-96qf","severity":"medium","message":"@opentelemetry/core@2.0.0 (npm) is affected by GHSA-8988-4f7v-96qf","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"@opentelemetry/core@2.0.0 (npm):GHSA-8988-4f7v-96qf"},{"rule_id":"osv/GHSA-8988-4f7v-96qf","severity":"medium","message":"@opentelemetry/core@2.4.0 (npm) is affected by GHSA-8988-4f7v-96qf","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"@opentelemetry/core@2.4.0 (npm):GHSA-8988-4f7v-96qf"},{"rule_id":"osv/GHSA-q6x5-8v7m-xcrf","severity":"medium","message":"@protobufjs/utf8@1.1.0 (npm) is affected by GHSA-q6x5-8v7m-xcrf","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"@protobufjs/utf8@1.1.0 (npm):GHSA-q6x5-8v7m-xcrf"},{"rule_id":"osv/GHSA-2g4f-4pwh-qvx6","severity":"medium","message":"ajv@8.17.1 (npm) is affected by GHSA-2g4f-4pwh-qvx6","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"ajv@8.17.1 (npm):GHSA-2g4f-4pwh-qvx6"},{"rule_id":"osv/GHSA-3p68-rc4w-qgx5","severity":"medium","message":"axios@1.13.2 (npm) is affected by GHSA-3p68-rc4w-qgx5","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"axios@1.13.2 (npm):GHSA-3p68-rc4w-qgx5"},{"rule_id":"osv/GHSA-3w6x-2g7m-8v23","severity":"medium","message":"axios@1.13.2 (npm) is affected by GHSA-3w6x-2g7m-8v23","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"axios@1.13.2 (npm):GHSA-3w6x-2g7m-8v23"},{"rule_id":"osv/GHSA-42h9-826w-cgv3","severity":"medium","message":"axios@1.13.2 (npm) is affected by GHSA-42h9-826w-cgv3","path":"pr-review-agent/bun.lock","line":null,"fingerprint":"axios@1.13.2 (npm):GHSA-42h9-826w-cgv3"}],"evidence":[],"data":{"ecosystems":["npm"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.2927,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":147.0,"function_nloc":2492.0,"mean_ccn":3.69,"p90_ccn":7.0,"complex_functions":4.0,"long_functions":6.0,"many_param_functions":0.0,"risky_nloc_share":0.4434},"findings":[],"evidence":[{"kind":"complex-function","description":"ProjectPage in coval/src/app/projects/[projectId]/page.tsx: complexity 47, 277 lines","ref":"coval/src/app/projects/[projectId]/page.tsx","url":"https://github.com/blaxel-templates/cookbook/blob/c95d2e92368c6727e6398d292104e8f423393c3c/coval/src/app/projects/[projectId]/page.tsx#L114","weight":0.7833333333333333},{"kind":"complex-function","description":"startGeneration in coval/src/app/projects/[projectId]/page.tsx: complexity 39, 133 lines","ref":"coval/src/app/projects/[projectId]/page.tsx","url":"https://github.com/blaxel-templates/cookbook/blob/c95d2e92368c6727e6398d292104e8f423393c3c/coval/src/app/projects/[projectId]/page.tsx#L248","weight":0.65},{"kind":"complex-function","description":"agent in pr-review-agent/src/agent.ts: complexity 25, 185 lines","ref":"pr-review-agent/src/agent.ts","url":"https://github.com/blaxel-templates/cookbook/blob/c95d2e92368c6727e6398d292104e8f423393c3c/pr-review-agent/src/agent.ts#L25","weight":0.4166666666666667},{"kind":"complex-function","description":"(anonymous) in coval/src/app/projects/[projectId]/page.tsx: complexity 23, 45 lines","ref":"coval/src/app/projects/[projectId]/page.tsx","url":"https://github.com/blaxel-templates/cookbook/blob/c95d2e92368c6727e6398d292104e8f423393c3c/coval/src/app/projects/[projectId]/page.tsx#L556","weight":0.38333333333333336},{"kind":"complex-function","description":"start in coval/src/app/api/generate/route.ts: complexity 12, 117 lines","ref":"coval/src/app/api/generate/route.ts","url":"https://github.com/blaxel-templates/cookbook/blob/c95d2e92368c6727e6398d292104e8f423393c3c/coval/src/app/api/generate/route.ts#L90","weight":0.2},{"kind":"complex-function","description":"Home in coval/src/app/page.tsx: complexity 1, 225 lines","ref":"coval/src/app/page.tsx","url":"https://github.com/blaxel-templates/cookbook/blob/c95d2e92368c6727e6398d292104e8f423393c3c/coval/src/app/page.tsx#L36","weight":0.016666666666666666},{"kind":"complex-function","description":"buildContextMessage in coval/src/lib/system-prompt.ts: complexity 1, 123 lines","ref":"coval/src/lib/system-prompt.ts","url":"https://github.com/blaxel-templates/cookbook/blob/c95d2e92368c6727e6398d292104e8f423393c3c/coval/src/lib/system-prompt.ts#L96","weight":0.016666666666666666}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":2568.0,"duplicated_lines":60.0,"duplicated_share":0.0234,"files":32.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: coval/codegen-sandbox/entrypoint.sh:19 and pr-review-agent/pr-review-sandbox/entrypoint.sh:29","ref":"coval/codegen-sandbox/entrypoint.sh","url":"https://github.com/blaxel-templates/cookbook/blob/c95d2e92368c6727e6398d292104e8f423393c3c/coval/codegen-sandbox/entrypoint.sh#L19","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: coval/src/app/api/projects/[projectId]/route.ts:10 and coval/src/app/api/projects/[projectId]/screenshot/route.ts:10","ref":"coval/src/app/api/projects/[projectId]/route.ts","url":"https://github.com/blaxel-templates/cookbook/blob/c95d2e92368c6727e6398d292104e8f423393c3c/coval/src/app/api/projects/[projectId]/route.ts#L10","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: coval/src/app/page.tsx:89 and coval/src/app/projects/[projectId]/page.tsx:432","ref":"coval/src/app/page.tsx","url":"https://github.com/blaxel-templates/cookbook/blob/c95d2e92368c6727e6398d292104e8f423393c3c/coval/src/app/page.tsx#L89","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: coval/src/app/projects/[projectId]/page.tsx:885 and coval/src/app/projects/[projectId]/page.tsx:898","ref":"coval/src/app/projects/[projectId]/page.tsx","url":"https://github.com/blaxel-templates/cookbook/blob/c95d2e92368c6727e6398d292104e8f423393c3c/coval/src/app/projects/[projectId]/page.tsx#L885","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":10.0,"weighted_findings":5.5,"scanned_lines":3586.0,"category:best-practice":4.0,"category:correctness":6.0},"findings":[{"rule_id":"opengrep/javascript.lang.best-practice.javascript-confirm","severity":"medium","message":"found confirm() call; should this be in production code?","path":"coval/src/app/page.tsx","line":88,"fingerprint":"javascript.lang.best-practice.javascript-confirm:coval/src/app/page.tsx:88"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-alert","severity":"medium","message":"found alert() call; should this be in production code?","path":"coval/src/app/page.tsx","line":104,"fingerprint":"javascript.lang.best-practice.javascript-alert:coval/src/app/page.tsx:104"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-confirm","severity":"medium","message":"found confirm() call; should this be in production code?","path":"coval/src/app/projects/[projectId]/page.tsx","line":431,"fingerprint":"javascript.lang.best-practice.javascript-confirm:coval/src/app/projects/[projectId]/page.tsx:431"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-alert","severity":"medium","message":"found alert() call; should this be in production code?","path":"coval/src/app/projects/[projectId]/page.tsx","line":448,"fingerprint":"javascript.lang.best-practice.javascript-alert:coval/src/app/projects/[projectId]/page.tsx:448"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"coval/codegen-sandbox/entrypoint.sh","line":17,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:coval/codegen-sandbox/entrypoint.sh:17"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"coval/src/lib/system-prompt.ts","line":5,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:coval/src/lib/system-prompt.ts:5"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"coval/src/lib/system-prompt.ts","line":5,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:coval/src/lib/system-prompt.ts:5"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"coval/src/lib/system-prompt.ts","line":97,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:coval/src/lib/system-prompt.ts:97"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"coval/src/lib/system-prompt.ts","line":97,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:coval/src/lib/system-prompt.ts:97"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"pr-review-agent/pr-review-sandbox/entrypoint.sh","line":27,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:pr-review-agent/pr-review-sandbox/entrypoint.sh:27"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":0.0351,"check:ci_present":0.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":0.1379,"test_lines":63.0,"source_lines":3586.0,"test_ratio":0.0176,"ci_files":0.0,"cochange_share":0.0345,"cochange_commits":29.0},"findings":[],"evidence":[],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":150.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":1.0,"check:low_escape_density":0.0,"escapes":29.0,"escapes_per_kloc":8.57},"findings":[],"evidence":[{"kind":"typing","description":"TypeScript strict type checking: coval/tsconfig.json","ref":"coval/tsconfig.json","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"x-blame","pillar":"ai_provenance","status":"ok","tool_version":"git-blame","metrics":{"ai_lines":5.0,"other_lines":3581.0,"files_blamed":32.0,"blame_failures":0.0,"quality:ai_findings":0.0,"quality:ai_per_kloc":0.0,"quality:other_findings":10.0,"quality:other_per_kloc":2.793,"security:ai_findings":0.0,"security:ai_per_kloc":0.0,"security:other_findings":0.0,"security:other_per_kloc":0.0},"findings":[],"evidence":[],"data":{"sampled":false,"comparable":false},"error":null}],"flags":[]}