{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T14:52:05.352809Z","repo":{"ref":{"host":"github.com","owner":"jarirantala","name":"ai-marketplace"},"default_branch":"main","clone_url":"https://github.com/jarirantala/ai-marketplace.git","html_url":"https://github.com/jarirantala/ai-marketplace","description":"Collection of Finnish and european AI services","stars":0,"forks":0,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":1675,"primary_language":"TypeScript","license_spdx":"MIT-0","created_at":"2025-06-03T08:55:09Z","pushed_at":"2025-08-10T18:21:03Z","security_policy_url":null,"distribution":{"owner_created_at":"2013-03-11T08:04:27Z","owner_type":"User","release_assets":[]}},"commit_sha":"13d02189442aedb4127eb8dd46c7727e66016527","profile":{"lines_by_language":{"TypeScript":569,"JavaScript":167},"files_by_category":{"source":12,"config":7,"other":7,"docs":4,"generated":1,"oversized":1,"binary":1},"source_lines":736,"test_lines":0},"pillars":{"ai_provenance":{"score":0.0,"confidence":0.61,"coverage":1.0,"label":"none-detected","breakdown":{"attributed_share":0.0,"suspected_share":0.0,"estimated_share":0.0,"ai_artifacts":0.0,"flagged_work_units":0.0,"flagged_releases":null,"style_index":0.0},"summary":"No AI attribution or AI-consistent velocity signals detected."},"quality":{"score":30.2,"confidence":0.9,"coverage":1.0,"label":"poor","breakdown":{"complexity":35.9,"duplication":36.7,"lint":36.8,"testing":0.0,"docs":60.0,"type_safety":60.0,"process":null},"summary":"Code quality is poor: test-to-source ratio 0.00, no CI test run detected; 34% of function code in complex or long functions; 17% duplicated lines. Weakest area: testing."},"security":{"score":48.1,"confidence":0.85,"coverage":1.0,"label":"poor","breakdown":{"secrets":96.7,"sast":59.2,"dependencies":0.1,"ci_actions":null,"posture":0.0,"scorecard":null},"summary":"Security posture is poor: 159 known vulnerabilities in 54 dependencies; 2 high-severity SAST findings. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":25.0,"checked":25.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":84.0,"attributed_commits":0.0,"attributed_commit_share":0.0,"effective_loc":1210.0,"attributed_loc":0.0,"attributed_loc_share":0.0,"tools_detected":0.0},"findings":[],"evidence":[],"data":{"attributed_loc_by_commit":{},"tools":{},"monthly":{"2025-06":{"loc":876,"attributed_loc":0},"2025-08":{"loc":334,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":13.0,"flagged_units":0.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":1210.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":83.5,"median_loc_per_hour":57.676276352552705,"pr_timed_units":0.0,"excluded_import_loc":0.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":[]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":736.0,"index":0.0,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":1.0},"findings":[{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in history (commit 67e3116cae); removed from the current tree but still retrievable","path":"src/App.tsx","line":296,"fingerprint":"67e3116caea1c013370e4012a28fd585a4ef6c41:src/App.tsx:generic-api-key:296"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":2.0,"findings_high":2.0,"findings_medium":0.0,"findings_low":0.0,"weighted_findings":1.5,"scanned_lines":736.0,"parse_errors":0.0},"findings":[{"rule_id":"opengrep/javascript.express.security.audit.remote-property-injection","severity":"high","message":"Bracket object notation with user input is present, this might allow an attacker to access all properties of the object and even it's prototype. Use literal values for object properties. [confidence low]","path":"server/aiapp-api.ts","line":41,"fingerprint":"javascript.express.security.audit.remote-property-injection:server/aiapp-api.ts:41"},{"rule_id":"opengrep/javascript.express.security.audit.remote-property-injection","severity":"high","message":"Bracket object notation with user input is present, this might allow an attacker to access all properties of the object and even it's prototype. Use literal values for object properties. [confidence low]","path":"src/express-api.ts","line":41,"fingerprint":"javascript.express.security.audit.remote-property-injection:src/express-api.ts:41"}],"evidence":[],"data":{"rulesets":["typescript","javascript"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":54.0,"vulnerabilities":159.0,"vulns_critical":7.0,"vulns_high":82.0,"vulns_medium":51.0,"vulns_low":19.0,"vulns_unknown":0.0,"penalty":397.0},"findings":[{"rule_id":"osv/GHSA-5rq4-664w-9x2c","severity":"critical","message":"basic-ftp@5.0.5 (npm) is affected by GHSA-5rq4-664w-9x2c","path":"package-lock.json","line":null,"fingerprint":"basic-ftp@5.0.5 (npm):GHSA-5rq4-664w-9x2c"},{"rule_id":"osv/GHSA-m7jm-9gc2-mpf2","severity":"critical","message":"fast-xml-parser@4.4.1 (npm) is affected by GHSA-m7jm-9gc2-mpf2","path":"package-lock.json","line":null,"fingerprint":"fast-xml-parser@4.4.1 (npm):GHSA-m7jm-9gc2-mpf2"},{"rule_id":"osv/GHSA-2w6w-674q-4c4q","severity":"critical","message":"handlebars@4.7.7 (npm) is affected by GHSA-2w6w-674q-4c4q","path":"package-lock.json","line":null,"fingerprint":"handlebars@4.7.7 (npm):GHSA-2w6w-674q-4c4q"},{"rule_id":"osv/GHSA-8r5x-fm3f-whwj","severity":"critical","message":"handlebars@4.7.7 (npm) is affected by GHSA-8r5x-fm3f-whwj","path":"package-lock.json","line":null,"fingerprint":"handlebars@4.7.7 (npm):GHSA-8r5x-fm3f-whwj"},{"rule_id":"osv/GHSA-p8wg-vrv2-v86f","severity":"critical","message":"handlebars@4.7.7 (npm) is affected by GHSA-p8wg-vrv2-v86f","path":"package-lock.json","line":null,"fingerprint":"handlebars@4.7.7 (npm):GHSA-p8wg-vrv2-v86f"},{"rule_id":"osv/GHSA-wf6x-7x77-mvgw","severity":"critical","message":"immutable@3.7.6 (npm) is affected by GHSA-wf6x-7x77-mvgw","path":"package-lock.json","line":null,"fingerprint":"immutable@3.7.6 (npm):GHSA-wf6x-7x77-mvgw"},{"rule_id":"osv/GHSA-jqcg-44mw-7w3h","severity":"critical","message":"proxy-addr@2.0.7 (npm) is affected by GHSA-jqcg-44mw-7w3h","path":"package-lock.json","line":null,"fingerprint":"proxy-addr@2.0.7 (npm):GHSA-jqcg-44mw-7w3h"},{"rule_id":"osv/GHSA-x8mw-p69m-v3mx","severity":"high","message":"@fastify/busboy@3.1.1 (npm) is affected by GHSA-x8mw-p69m-v3mx","path":"package-lock.json","line":null,"fingerprint":"@fastify/busboy@3.1.1 (npm):GHSA-x8mw-p69m-v3mx"},{"rule_id":"osv/GHSA-xjh9-v7x6-24jw","severity":"high","message":"@fastify/busboy@3.1.1 (npm) is affected by GHSA-xjh9-v7x6-24jw","path":"package-lock.json","line":null,"fingerprint":"@fastify/busboy@3.1.1 (npm):GHSA-xjh9-v7x6-24jw"},{"rule_id":"osv/GHSA-7mx3-vvmw-hjmv","severity":"high","message":"@graphql-tools/utils@10.8.6 (npm) is affected by GHSA-7mx3-vvmw-hjmv","path":"package-lock.json","line":null,"fingerprint":"@graphql-tools/utils@10.8.6 (npm):GHSA-7mx3-vvmw-hjmv"},{"rule_id":"osv/GHSA-7mx3-vvmw-hjmv","severity":"high","message":"@graphql-tools/utils@6.2.4 (npm) is affected by GHSA-7mx3-vvmw-hjmv","path":"package-lock.json","line":null,"fingerprint":"@graphql-tools/utils@6.2.4 (npm):GHSA-7mx3-vvmw-hjmv"},{"rule_id":"osv/GHSA-7mx3-vvmw-hjmv","severity":"high","message":"@graphql-tools/utils@7.10.0 (npm) is affected by GHSA-7mx3-vvmw-hjmv","path":"package-lock.json","line":null,"fingerprint":"@graphql-tools/utils@7.10.0 (npm):GHSA-7mx3-vvmw-hjmv"},{"rule_id":"osv/GHSA-7mx3-vvmw-hjmv","severity":"high","message":"@graphql-tools/utils@9.2.1 (npm) is affected by GHSA-7mx3-vvmw-hjmv","path":"package-lock.json","line":null,"fingerprint":"@graphql-tools/utils@9.2.1 (npm):GHSA-7mx3-vvmw-hjmv"},{"rule_id":"osv/GHSA-999r-qq7v-r334","severity":"high","message":"aws-cdk-lib@2.200.0 (npm) is affected by GHSA-999r-qq7v-r334","path":"package-lock.json","line":null,"fingerprint":"aws-cdk-lib@2.200.0 (npm):GHSA-999r-qq7v-r334"},{"rule_id":"osv/GHSA-vcrf-j523-4mrf","severity":"high","message":"aws-cdk-lib@2.200.0 (npm) is affected by GHSA-vcrf-j523-4mrf","path":"package-lock.json","line":null,"fingerprint":"aws-cdk-lib@2.200.0 (npm):GHSA-vcrf-j523-4mrf"},{"rule_id":"osv/GHSA-6v7q-wjvx-w8wg","severity":"high","message":"basic-ftp@5.0.5 (npm) is affected by GHSA-6v7q-wjvx-w8wg","path":"package-lock.json","line":null,"fingerprint":"basic-ftp@5.0.5 (npm):GHSA-6v7q-wjvx-w8wg"},{"rule_id":"osv/GHSA-c475-qrg2-pj4r","severity":"high","message":"basic-ftp@5.0.5 (npm) is affected by GHSA-c475-qrg2-pj4r","path":"package-lock.json","line":null,"fingerprint":"basic-ftp@5.0.5 (npm):GHSA-c475-qrg2-pj4r"},{"rule_id":"osv/GHSA-rp42-5vxx-qpwr","severity":"high","message":"basic-ftp@5.0.5 (npm) is affected by GHSA-rp42-5vxx-qpwr","path":"package-lock.json","line":null,"fingerprint":"basic-ftp@5.0.5 (npm):GHSA-rp42-5vxx-qpwr"},{"rule_id":"osv/GHSA-rpmf-866q-6p89","severity":"high","message":"basic-ftp@5.0.5 (npm) is affected by GHSA-rpmf-866q-6p89","path":"package-lock.json","line":null,"fingerprint":"basic-ftp@5.0.5 (npm):GHSA-rpmf-866q-6p89"},{"rule_id":"osv/GHSA-27r3-jxmh-p828","severity":"high","message":"body-parser@2.2.0 (npm) is affected by GHSA-27r3-jxmh-p828","path":"package-lock.json","line":null,"fingerprint":"body-parser@2.2.0 (npm):GHSA-27r3-jxmh-p828"},{"rule_id":"osv/GHSA-3jxr-9vmj-r5cp","severity":"high","message":"brace-expansion@1.1.11 (npm) is affected by GHSA-3jxr-9vmj-r5cp","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.11 (npm):GHSA-3jxr-9vmj-r5cp"},{"rule_id":"osv/GHSA-6j4f-fj2g-mc7p","severity":"high","message":"brace-expansion@1.1.11 (npm) is affected by GHSA-6j4f-fj2g-mc7p","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.11 (npm):GHSA-6j4f-fj2g-mc7p"},{"rule_id":"osv/GHSA-mh99-v99m-4gvg","severity":"high","message":"brace-expansion@1.1.11 (npm) is affected by GHSA-mh99-v99m-4gvg","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.11 (npm):GHSA-mh99-v99m-4gvg"},{"rule_id":"osv/GHSA-qhr7-859c-m2p7","severity":"high","message":"brace-expansion@1.1.11 (npm) is affected by GHSA-qhr7-859c-m2p7","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.11 (npm):GHSA-qhr7-859c-m2p7"},{"rule_id":"osv/GHSA-rgw5-rvv9-x895","severity":"high","message":"brace-expansion@1.1.11 (npm) is affected by GHSA-rgw5-rvv9-x895","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.11 (npm):GHSA-rgw5-rvv9-x895"},{"rule_id":"osv/GHSA-3jxr-9vmj-r5cp","severity":"high","message":"brace-expansion@2.0.1 (npm) is affected by GHSA-3jxr-9vmj-r5cp","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@2.0.1 (npm):GHSA-3jxr-9vmj-r5cp"},{"rule_id":"osv/GHSA-6j4f-fj2g-mc7p","severity":"high","message":"brace-expansion@2.0.1 (npm) is affected by GHSA-6j4f-fj2g-mc7p","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@2.0.1 (npm):GHSA-6j4f-fj2g-mc7p"},{"rule_id":"osv/GHSA-mh99-v99m-4gvg","severity":"high","message":"brace-expansion@2.0.1 (npm) is affected by GHSA-mh99-v99m-4gvg","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@2.0.1 (npm):GHSA-mh99-v99m-4gvg"},{"rule_id":"osv/GHSA-qhr7-859c-m2p7","severity":"high","message":"brace-expansion@2.0.1 (npm) is affected by GHSA-qhr7-859c-m2p7","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@2.0.1 (npm):GHSA-qhr7-859c-m2p7"},{"rule_id":"osv/GHSA-rgw5-rvv9-x895","severity":"high","message":"brace-expansion@2.0.1 (npm) is affected by GHSA-rgw5-rvv9-x895","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@2.0.1 (npm):GHSA-rgw5-rvv9-x895"},{"rule_id":"osv/GHSA-73wf-gq98-2v4g","severity":"high","message":"browserslist@4.25.0 (npm) is affected by GHSA-73wf-gq98-2v4g","path":"package-lock.json","line":null,"fingerprint":"browserslist@4.25.0 (npm):GHSA-73wf-gq98-2v4g"},{"rule_id":"osv/GHSA-c83g-rgw3-j3cx","severity":"high","message":"browserslist@4.25.0 (npm) is affected by GHSA-c83g-rgw3-j3cx","path":"package-lock.json","line":null,"fingerprint":"browserslist@4.25.0 (npm):GHSA-c83g-rgw3-j3cx"},{"rule_id":"osv/GHSA-4c8g-83qw-93j6","severity":"high","message":"fast-uri@3.0.6 (npm) is affected by GHSA-4c8g-83qw-93j6","path":"package-lock.json","line":null,"fingerprint":"fast-uri@3.0.6 (npm):GHSA-4c8g-83qw-93j6"},{"rule_id":"osv/GHSA-7p8r-x3mc-p8w7","severity":"high","message":"fast-uri@3.0.6 (npm) is affected by GHSA-7p8r-x3mc-p8w7","path":"package-lock.json","line":null,"fingerprint":"fast-uri@3.0.6 (npm):GHSA-7p8r-x3mc-p8w7"},{"rule_id":"osv/GHSA-f65p-4m7j-42xc","severity":"high","message":"fast-uri@3.0.6 (npm) is affected by GHSA-f65p-4m7j-42xc","path":"package-lock.json","line":null,"fingerprint":"fast-uri@3.0.6 (npm):GHSA-f65p-4m7j-42xc"},{"rule_id":"osv/GHSA-jqff-g426-hqxp","severity":"high","message":"fast-uri@3.0.6 (npm) is affected by GHSA-jqff-g426-hqxp","path":"package-lock.json","line":null,"fingerprint":"fast-uri@3.0.6 (npm):GHSA-jqff-g426-hqxp"},{"rule_id":"osv/GHSA-q3j6-qgpj-74h6","severity":"high","message":"fast-uri@3.0.6 (npm) is affected by GHSA-q3j6-qgpj-74h6","path":"package-lock.json","line":null,"fingerprint":"fast-uri@3.0.6 (npm):GHSA-q3j6-qgpj-74h6"},{"rule_id":"osv/GHSA-qw65-cvwx-89v3","severity":"high","message":"fast-uri@3.0.6 (npm) is affected by GHSA-qw65-cvwx-89v3","path":"package-lock.json","line":null,"fingerprint":"fast-uri@3.0.6 (npm):GHSA-qw65-cvwx-89v3"},{"rule_id":"osv/GHSA-v2hh-gcrm-f6hx","severity":"high","message":"fast-uri@3.0.6 (npm) is affected by GHSA-v2hh-gcrm-f6hx","path":"package-lock.json","line":null,"fingerprint":"fast-uri@3.0.6 (npm):GHSA-v2hh-gcrm-f6hx"},{"rule_id":"osv/GHSA-v39h-62p7-jpjc","severity":"high","message":"fast-uri@3.0.6 (npm) is affected by GHSA-v39h-62p7-jpjc","path":"package-lock.json","line":null,"fingerprint":"fast-uri@3.0.6 (npm):GHSA-v39h-62p7-jpjc"},{"rule_id":"osv/GHSA-8gc5-j5rx-235r","severity":"high","message":"fast-xml-parser@4.4.1 (npm) is affected by GHSA-8gc5-j5rx-235r","path":"package-lock.json","line":null,"fingerprint":"fast-xml-parser@4.4.1 (npm):GHSA-8gc5-j5rx-235r"},{"rule_id":"osv/GHSA-jmr7-xgp7-cmfj","severity":"high","message":"fast-xml-parser@4.4.1 (npm) is affected by GHSA-jmr7-xgp7-cmfj","path":"package-lock.json","line":null,"fingerprint":"fast-xml-parser@4.4.1 (npm):GHSA-jmr7-xgp7-cmfj"},{"rule_id":"osv/GHSA-25h7-pfq9-p65f","severity":"high","message":"flatted@3.3.3 (npm) is affected by GHSA-25h7-pfq9-p65f","path":"package-lock.json","line":null,"fingerprint":"flatted@3.3.3 (npm):GHSA-25h7-pfq9-p65f"},{"rule_id":"osv/GHSA-rf6f-7fwh-wjgh","severity":"high","message":"flatted@3.3.3 (npm) is affected by GHSA-rf6f-7fwh-wjgh","path":"package-lock.json","line":null,"fingerprint":"flatted@3.3.3 (npm):GHSA-rf6f-7fwh-wjgh"},{"rule_id":"osv/GHSA-5j98-mcp5-4vw2","severity":"high","message":"glob@10.4.5 (npm) is affected by GHSA-5j98-mcp5-4vw2","path":"package-lock.json","line":null,"fingerprint":"glob@10.4.5 (npm):GHSA-5j98-mcp5-4vw2"},{"rule_id":"osv/GHSA-5j98-mcp5-4vw2","severity":"high","message":"glob@11.0.2 (npm) is affected by GHSA-5j98-mcp5-4vw2","path":"package-lock.json","line":null,"fingerprint":"glob@11.0.2 (npm):GHSA-5j98-mcp5-4vw2"},{"rule_id":"osv/GHSA-3mfm-83xf-c92r","severity":"high","message":"handlebars@4.7.7 (npm) is affected by GHSA-3mfm-83xf-c92r","path":"package-lock.json","line":null,"fingerprint":"handlebars@4.7.7 (npm):GHSA-3mfm-83xf-c92r"},{"rule_id":"osv/GHSA-9cx6-37pm-9jff","severity":"high","message":"handlebars@4.7.7 (npm) is affected by GHSA-9cx6-37pm-9jff","path":"package-lock.json","line":null,"fingerprint":"handlebars@4.7.7 (npm):GHSA-9cx6-37pm-9jff"},{"rule_id":"osv/GHSA-xhpv-hc6g-r9c6","severity":"high","message":"handlebars@4.7.7 (npm) is affected by GHSA-xhpv-hc6g-r9c6","path":"package-lock.json","line":null,"fingerprint":"handlebars@4.7.7 (npm):GHSA-xhpv-hc6g-r9c6"},{"rule_id":"osv/GHSA-xjpj-3mr7-gcpf","severity":"high","message":"handlebars@4.7.7 (npm) is affected by GHSA-xjpj-3mr7-gcpf","path":"package-lock.json","line":null,"fingerprint":"handlebars@4.7.7 (npm):GHSA-xjpj-3mr7-gcpf"},{"rule_id":"osv/GHSA-v56q-mh7h-f735","severity":"high","message":"immutable@3.7.6 (npm) is affected by GHSA-v56q-mh7h-f735","path":"package-lock.json","line":null,"fingerprint":"immutable@3.7.6 (npm):GHSA-v56q-mh7h-f735"},{"rule_id":"osv/GHSA-xvcm-6775-5m9r","severity":"high","message":"immutable@3.7.6 (npm) is affected by GHSA-xvcm-6775-5m9r","path":"package-lock.json","line":null,"fingerprint":"immutable@3.7.6 (npm):GHSA-xvcm-6775-5m9r"},{"rule_id":"osv/GHSA-mwp4-54f8-5fhr","severity":"high","message":"ip-address@9.0.5 (npm) is affected by GHSA-mwp4-54f8-5fhr","path":"package-lock.json","line":null,"fingerprint":"ip-address@9.0.5 (npm):GHSA-mwp4-54f8-5fhr"},{"rule_id":"osv/GHSA-qjx8-664m-686j","severity":"high","message":"js-cookie@3.0.5 (npm) is affected by GHSA-qjx8-664m-686j","path":"package-lock.json","line":null,"fingerprint":"js-cookie@3.0.5 (npm):GHSA-qjx8-664m-686j"},{"rule_id":"osv/GHSA-2883-xcg3-v3hh","severity":"high","message":"js-yaml@4.1.0 (npm) is affected by GHSA-2883-xcg3-v3hh","path":"package-lock.json","line":null,"fingerprint":"js-yaml@4.1.0 (npm):GHSA-2883-xcg3-v3hh"},{"rule_id":"osv/GHSA-52cp-r559-cp3m","severity":"high","message":"js-yaml@4.1.0 (npm) is affected by GHSA-52cp-r559-cp3m","path":"package-lock.json","line":null,"fingerprint":"js-yaml@4.1.0 (npm):GHSA-52cp-r559-cp3m"},{"rule_id":"osv/GHSA-5p4m-2wfm-xmqj","severity":"high","message":"js-yaml@4.1.0 (npm) is affected by GHSA-5p4m-2wfm-xmqj","path":"package-lock.json","line":null,"fingerprint":"js-yaml@4.1.0 (npm):GHSA-5p4m-2wfm-xmqj"},{"rule_id":"osv/GHSA-r5fr-rjxr-66jc","severity":"high","message":"lodash@4.17.21 (npm) is affected by GHSA-r5fr-rjxr-66jc","path":"package-lock.json","line":null,"fingerprint":"lodash@4.17.21 (npm):GHSA-r5fr-rjxr-66jc"},{"rule_id":"osv/GHSA-r5fr-rjxr-66jc","severity":"high","message":"lodash-es@4.17.21 (npm) is affected by GHSA-r5fr-rjxr-66jc","path":"package-lock.json","line":null,"fingerprint":"lodash-es@4.17.21 (npm):GHSA-r5fr-rjxr-66jc"},{"rule_id":"osv/GHSA-23c5-xmqv-rm74","severity":"high","message":"minimatch@10.0.1 (npm) is affected by GHSA-23c5-xmqv-rm74","path":"package-lock.json","line":null,"fingerprint":"minimatch@10.0.1 (npm):GHSA-23c5-xmqv-rm74"},{"rule_id":"osv/GHSA-3ppc-4f35-3m26","severity":"high","message":"minimatch@10.0.1 (npm) is affected by GHSA-3ppc-4f35-3m26","path":"package-lock.json","line":null,"fingerprint":"minimatch@10.0.1 (npm):GHSA-3ppc-4f35-3m26"},{"rule_id":"osv/GHSA-7r86-cg39-jmmj","severity":"high","message":"minimatch@10.0.1 (npm) is affected by GHSA-7r86-cg39-jmmj","path":"package-lock.json","line":null,"fingerprint":"minimatch@10.0.1 (npm):GHSA-7r86-cg39-jmmj"},{"rule_id":"osv/GHSA-23c5-xmqv-rm74","severity":"high","message":"minimatch@3.1.2 (npm) is affected by GHSA-23c5-xmqv-rm74","path":"package-lock.json","line":null,"fingerprint":"minimatch@3.1.2 (npm):GHSA-23c5-xmqv-rm74"},{"rule_id":"osv/GHSA-3ppc-4f35-3m26","severity":"high","message":"minimatch@3.1.2 (npm) is affected by GHSA-3ppc-4f35-3m26","path":"package-lock.json","line":null,"fingerprint":"minimatch@3.1.2 (npm):GHSA-3ppc-4f35-3m26"},{"rule_id":"osv/GHSA-7r86-cg39-jmmj","severity":"high","message":"minimatch@3.1.2 (npm) is affected by GHSA-7r86-cg39-jmmj","path":"package-lock.json","line":null,"fingerprint":"minimatch@3.1.2 (npm):GHSA-7r86-cg39-jmmj"},{"rule_id":"osv/GHSA-23c5-xmqv-rm74","severity":"high","message":"minimatch@5.1.6 (npm) is affected by GHSA-23c5-xmqv-rm74","path":"package-lock.json","line":null,"fingerprint":"minimatch@5.1.6 (npm):GHSA-23c5-xmqv-rm74"},{"rule_id":"osv/GHSA-3ppc-4f35-3m26","severity":"high","message":"minimatch@5.1.6 (npm) is affected by GHSA-3ppc-4f35-3m26","path":"package-lock.json","line":null,"fingerprint":"minimatch@5.1.6 (npm):GHSA-3ppc-4f35-3m26"},{"rule_id":"osv/GHSA-7r86-cg39-jmmj","severity":"high","message":"minimatch@5.1.6 (npm) is affected by GHSA-7r86-cg39-jmmj","path":"package-lock.json","line":null,"fingerprint":"minimatch@5.1.6 (npm):GHSA-7r86-cg39-jmmj"},{"rule_id":"osv/GHSA-23c5-xmqv-rm74","severity":"high","message":"minimatch@9.0.5 (npm) is affected by GHSA-23c5-xmqv-rm74","path":"package-lock.json","line":null,"fingerprint":"minimatch@9.0.5 (npm):GHSA-23c5-xmqv-rm74"},{"rule_id":"osv/GHSA-3ppc-4f35-3m26","severity":"high","message":"minimatch@9.0.5 (npm) is affected by GHSA-3ppc-4f35-3m26","path":"package-lock.json","line":null,"fingerprint":"minimatch@9.0.5 (npm):GHSA-3ppc-4f35-3m26"},{"rule_id":"osv/GHSA-7r86-cg39-jmmj","severity":"high","message":"minimatch@9.0.5 (npm) is affected by GHSA-7r86-cg39-jmmj","path":"package-lock.json","line":null,"fingerprint":"minimatch@9.0.5 (npm):GHSA-7r86-cg39-jmmj"},{"rule_id":"osv/GHSA-3f6p-5ww8-9rcr","severity":"high","message":"mysql2@3.9.9 (npm) is affected by GHSA-3f6p-5ww8-9rcr","path":"package-lock.json","line":null,"fingerprint":"mysql2@3.9.9 (npm):GHSA-3f6p-5ww8-9rcr"},{"rule_id":"osv/GHSA-28wg-ghj8-5hjv","severity":"high","message":"nanoid@3.3.11 (npm) is affected by GHSA-28wg-ghj8-5hjv","path":"package-lock.json","line":null,"fingerprint":"nanoid@3.3.11 (npm):GHSA-28wg-ghj8-5hjv"},{"rule_id":"osv/GHSA-2v37-7h3g-55p8","severity":"high","message":"nanoid@3.3.11 (npm) is affected by GHSA-2v37-7h3g-55p8","path":"package-lock.json","line":null,"fingerprint":"nanoid@3.3.11 (npm):GHSA-2v37-7h3g-55p8"},{"rule_id":"osv/GHSA-xwg4-73v4-xw9w","severity":"high","message":"nanoid@3.3.11 (npm) is affected by GHSA-xwg4-73v4-xw9w","path":"package-lock.json","line":null,"fingerprint":"nanoid@3.3.11 (npm):GHSA-xwg4-73v4-xw9w"},{"rule_id":"osv/GHSA-j3q9-mxjg-w52f","severity":"high","message":"path-to-regexp@8.2.0 (npm) is affected by GHSA-j3q9-mxjg-w52f","path":"package-lock.json","line":null,"fingerprint":"path-to-regexp@8.2.0 (npm):GHSA-j3q9-mxjg-w52f"},{"rule_id":"osv/GHSA-c2c7-rcm5-vvqj","severity":"high","message":"picomatch@2.3.1 (npm) is affected by GHSA-c2c7-rcm5-vvqj","path":"package-lock.json","line":null,"fingerprint":"picomatch@2.3.1 (npm):GHSA-c2c7-rcm5-vvqj"},{"rule_id":"osv/GHSA-c2c7-rcm5-vvqj","severity":"high","message":"picomatch@4.0.2 (npm) is affected by GHSA-c2c7-rcm5-vvqj","path":"package-lock.json","line":null,"fingerprint":"picomatch@4.0.2 (npm):GHSA-c2c7-rcm5-vvqj"},{"rule_id":"osv/GHSA-6g55-p6wh-862q","severity":"high","message":"postcss@8.5.4 (npm) is affected by GHSA-6g55-p6wh-862q","path":"package-lock.json","line":null,"fingerprint":"postcss@8.5.4 (npm):GHSA-6g55-p6wh-862q"},{"rule_id":"osv/GHSA-r28c-9q8g-f849","severity":"high","message":"postcss@8.5.4 (npm) is affected by GHSA-r28c-9q8g-f849","path":"package-lock.json","line":null,"fingerprint":"postcss@8.5.4 (npm):GHSA-r28c-9q8g-f849"},{"rule_id":"osv/GHSA-mw96-cpmx-2vgc","severity":"high","message":"rollup@4.41.1 (npm) is affected by GHSA-mw96-cpmx-2vgc","path":"package-lock.json","line":null,"fingerprint":"rollup@4.41.1 (npm):GHSA-mw96-cpmx-2vgc"},{"rule_id":"osv/GHSA-68fv-2mgg-jv7q","severity":"high","message":"source-map-js@1.2.1 (npm) is affected by GHSA-68fv-2mgg-jv7q","path":"package-lock.json","line":null,"fingerprint":"source-map-js@1.2.1 (npm):GHSA-68fv-2mgg-jv7q"},{"rule_id":"osv/GHSA-ph9p-34f9-6g65","severity":"high","message":"tmp@0.0.33 (npm) is affected by GHSA-ph9p-34f9-6g65","path":"package-lock.json","line":null,"fingerprint":"tmp@0.0.33 (npm):GHSA-ph9p-34f9-6g65"},{"rule_id":"osv/GHSA-w5hq-g745-h8pq","severity":"high","message":"uuid@11.1.0 (npm) is affected by GHSA-w5hq-g745-h8pq","path":"package-lock.json","line":null,"fingerprint":"uuid@11.1.0 (npm):GHSA-w5hq-g745-h8pq"},{"rule_id":"osv/GHSA-w5hq-g745-h8pq","severity":"high","message":"uuid@9.0.1 (npm) is affected by GHSA-w5hq-g745-h8pq","path":"package-lock.json","line":null,"fingerprint":"uuid@9.0.1 (npm):GHSA-w5hq-g745-h8pq"},{"rule_id":"osv/GHSA-587h-7wmj-h5pm","severity":"high","message":"vite@6.3.5 (npm) is affected by GHSA-587h-7wmj-h5pm","path":"package-lock.json","line":null,"fingerprint":"vite@6.3.5 (npm):GHSA-587h-7wmj-h5pm"},{"rule_id":"osv/GHSA-p9ff-h696-f583","severity":"high","message":"vite@6.3.5 (npm) is affected by GHSA-p9ff-h696-f583","path":"package-lock.json","line":null,"fingerprint":"vite@6.3.5 (npm):GHSA-p9ff-h696-f583"},{"rule_id":"osv/GHSA-mrhx-c7xc-m3w5","severity":"high","message":"zod@3.24.2 (npm) is affected by GHSA-mrhx-c7xc-m3w5","path":"package-lock.json","line":null,"fingerprint":"zod@3.24.2 (npm):GHSA-mrhx-c7xc-m3w5"},{"rule_id":"osv/GHSA-mrhx-c7xc-m3w5","severity":"high","message":"zod@3.25.49 (npm) is affected by GHSA-mrhx-c7xc-m3w5","path":"package-lock.json","line":null,"fingerprint":"zod@3.25.49 (npm):GHSA-mrhx-c7xc-m3w5"},{"rule_id":"osv/GHSA-gxm5-99cw-xjw9","severity":"medium","message":"@fastify/busboy@3.1.1 (npm) is affected by GHSA-gxm5-99cw-xjw9","path":"package-lock.json","line":null,"fingerprint":"@fastify/busboy@3.1.1 (npm):GHSA-gxm5-99cw-xjw9"},{"rule_id":"osv/GHSA-8988-4f7v-96qf","severity":"medium","message":"@opentelemetry/core@2.0.1 (npm) is affected by GHSA-8988-4f7v-96qf","path":"package-lock.json","line":null,"fingerprint":"@opentelemetry/core@2.0.1 (npm):GHSA-8988-4f7v-96qf"},{"rule_id":"osv/GHSA-2g4f-4pwh-qvx6","severity":"medium","message":"ajv@6.12.6 (npm) is affected by GHSA-2g4f-4pwh-qvx6","path":"package-lock.json","line":null,"fingerprint":"ajv@6.12.6 (npm):GHSA-2g4f-4pwh-qvx6"},{"rule_id":"osv/GHSA-2g4f-4pwh-qvx6","severity":"medium","message":"ajv@8.17.1 (npm) is affected by GHSA-2g4f-4pwh-qvx6","path":"package-lock.json","line":null,"fingerprint":"ajv@8.17.1 (npm):GHSA-2g4f-4pwh-qvx6"},{"rule_id":"osv/GHSA-5pm8-86m8-9m6r","severity":"medium","message":"basic-ftp@5.0.5 (npm) is affected by GHSA-5pm8-86m8-9m6r","path":"package-lock.json","line":null,"fingerprint":"basic-ftp@5.0.5 (npm):GHSA-5pm8-86m8-9m6r"},{"rule_id":"osv/GHSA-r4jh-29pc-gfqr","severity":"medium","message":"basic-ftp@5.0.5 (npm) is affected by GHSA-r4jh-29pc-gfqr","path":"package-lock.json","line":null,"fingerprint":"basic-ftp@5.0.5 (npm):GHSA-r4jh-29pc-gfqr"},{"rule_id":"osv/GHSA-wqch-xfxh-vrr4","severity":"medium","message":"body-parser@2.2.0 (npm) is affected by GHSA-wqch-xfxh-vrr4","path":"package-lock.json","line":null,"fingerprint":"body-parser@2.2.0 (npm):GHSA-wqch-xfxh-vrr4"},{"rule_id":"osv/GHSA-f886-m6hf-6m8v","severity":"medium","message":"brace-expansion@1.1.11 (npm) is affected by GHSA-f886-m6hf-6m8v","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.11 (npm):GHSA-f886-m6hf-6m8v"},{"rule_id":"osv/GHSA-q2hr-2g5m-vwhr","severity":"medium","message":"brace-expansion@1.1.11 (npm) is affected by GHSA-q2hr-2g5m-vwhr","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.11 (npm):GHSA-q2hr-2g5m-vwhr"},{"rule_id":"osv/GHSA-f886-m6hf-6m8v","severity":"medium","message":"brace-expansion@2.0.1 (npm) is affected by GHSA-f886-m6hf-6m8v","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@2.0.1 (npm):GHSA-f886-m6hf-6m8v"},{"rule_id":"osv/GHSA-q2hr-2g5m-vwhr","severity":"medium","message":"brace-expansion@2.0.1 (npm) is affected by GHSA-q2hr-2g5m-vwhr","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@2.0.1 (npm):GHSA-q2hr-2g5m-vwhr"},{"rule_id":"osv/GHSA-8cw4-87c7-c6xx","severity":"medium","message":"csv-parse@5.6.0 (npm) is affected by GHSA-8cw4-87c7-c6xx","path":"package-lock.json","line":null,"fingerprint":"csv-parse@5.6.0 (npm):GHSA-8cw4-87c7-c6xx"},{"rule_id":"osv/GHSA-hrr3-gc8f-f4qj","severity":"medium","message":"fast-uri@3.0.6 (npm) is affected by GHSA-hrr3-gc8f-f4qj","path":"package-lock.json","line":null,"fingerprint":"fast-uri@3.0.6 (npm):GHSA-hrr3-gc8f-f4qj"},{"rule_id":"osv/GHSA-w74x-v6f9-j3xg","severity":"medium","message":"fast-uri@3.0.6 (npm) is affected by GHSA-w74x-v6f9-j3xg","path":"package-lock.json","line":null,"fingerprint":"fast-uri@3.0.6 (npm):GHSA-w74x-v6f9-j3xg"},{"rule_id":"osv/GHSA-gh4j-gqv2-49f6","severity":"medium","message":"fast-xml-parser@4.4.1 (npm) is affected by GHSA-gh4j-gqv2-49f6","path":"package-lock.json","line":null,"fingerprint":"fast-xml-parser@4.4.1 (npm):GHSA-gh4j-gqv2-49f6"},{"rule_id":"osv/GHSA-jp2q-39xq-3w4g","severity":"medium","message":"fast-xml-parser@4.4.1 (npm) is affected by GHSA-jp2q-39xq-3w4g","path":"package-lock.json","line":null,"fingerprint":"fast-xml-parser@4.4.1 (npm):GHSA-jp2q-39xq-3w4g"},{"rule_id":"osv/GHSA-3g3m-2fjr-6pw4","severity":"medium","message":"glob@10.4.5 (npm) is affected by GHSA-3g3m-2fjr-6pw4","path":"package-lock.json","line":null,"fingerprint":"glob@10.4.5 (npm):GHSA-3g3m-2fjr-6pw4"},{"rule_id":"osv/GHSA-3g3m-2fjr-6pw4","severity":"medium","message":"glob@11.0.2 (npm) is affected by GHSA-3g3m-2fjr-6pw4","path":"package-lock.json","line":null,"fingerprint":"glob@11.0.2 (npm):GHSA-3g3m-2fjr-6pw4"},{"rule_id":"osv/GHSA-2qvq-rjwj-gvw9","severity":"medium","message":"handlebars@4.7.7 (npm) is affected by GHSA-2qvq-rjwj-gvw9","path":"package-lock.json","line":null,"fingerprint":"handlebars@4.7.7 (npm):GHSA-2qvq-rjwj-gvw9"},{"rule_id":"osv/GHSA-7rx3-28cr-v5wh","severity":"medium","message":"handlebars@4.7.7 (npm) is affected by GHSA-7rx3-28cr-v5wh","path":"package-lock.json","line":null,"fingerprint":"handlebars@4.7.7 (npm):GHSA-7rx3-28cr-v5wh"},{"rule_id":"osv/GHSA-xw65-4hp5-5hc7","severity":"medium","message":"handlebars@4.7.7 (npm) is affected by GHSA-xw65-4hp5-5hc7","path":"package-lock.json","line":null,"fingerprint":"handlebars@4.7.7 (npm):GHSA-xw65-4hp5-5hc7"},{"rule_id":"osv/GHSA-h3mg-xc3c-68pw","severity":"medium","message":"ip-address@9.0.5 (npm) is affected by GHSA-h3mg-xc3c-68pw","path":"package-lock.json","line":null,"fingerprint":"ip-address@9.0.5 (npm):GHSA-h3mg-xc3c-68pw"},{"rule_id":"osv/GHSA-j6r3-76f7-8jcv","severity":"medium","message":"ip-address@9.0.5 (npm) is affected by GHSA-j6r3-76f7-8jcv","path":"package-lock.json","line":null,"fingerprint":"ip-address@9.0.5 (npm):GHSA-j6r3-76f7-8jcv"},{"rule_id":"osv/GHSA-rpw4-54j3-4h4q","severity":"medium","message":"ip-address@9.0.5 (npm) is affected by GHSA-rpw4-54j3-4h4q","path":"package-lock.json","line":null,"fingerprint":"ip-address@9.0.5 (npm):GHSA-rpw4-54j3-4h4q"},{"rule_id":"osv/GHSA-rxp7-6hxx-x8q5","severity":"medium","message":"ip-address@9.0.5 (npm) is affected by GHSA-rxp7-6hxx-x8q5","path":"package-lock.json","line":null,"fingerprint":"ip-address@9.0.5 (npm):GHSA-rxp7-6hxx-x8q5"},{"rule_id":"osv/GHSA-v2v4-37r5-5v8g","severity":"medium","message":"ip-address@9.0.5 (npm) is affected by GHSA-v2v4-37r5-5v8g","path":"package-lock.json","line":null,"fingerprint":"ip-address@9.0.5 (npm):GHSA-v2v4-37r5-5v8g"},{"rule_id":"osv/GHSA-h67p-54hq-rp68","severity":"medium","message":"js-yaml@4.1.0 (npm) is affected by GHSA-h67p-54hq-rp68","path":"package-lock.json","line":null,"fingerprint":"js-yaml@4.1.0 (npm):GHSA-h67p-54hq-rp68"},{"rule_id":"osv/GHSA-mh29-5h37-fv8m","severity":"medium","message":"js-yaml@4.1.0 (npm) is affected by GHSA-mh29-5h37-fv8m","path":"package-lock.json","line":null,"fingerprint":"js-yaml@4.1.0 (npm):GHSA-mh29-5h37-fv8m"},{"rule_id":"osv/GHSA-xxjr-mmjv-4gpg","severity":"medium","message":"lodash@4.17.21 (npm) is affected by GHSA-xxjr-mmjv-4gpg","path":"package-lock.json","line":null,"fingerprint":"lodash@4.17.21 (npm):GHSA-xxjr-mmjv-4gpg"},{"rule_id":"osv/GHSA-xxjr-mmjv-4gpg","severity":"medium","message":"lodash-es@4.17.21 (npm) is affected by GHSA-xxjr-mmjv-4gpg","path":"package-lock.json","line":null,"fingerprint":"lodash-es@4.17.21 (npm):GHSA-xxjr-mmjv-4gpg"},{"rule_id":"osv/GHSA-g3hv-75wg-m249","severity":"medium","message":"minimatch@10.0.1 (npm) is affected by GHSA-g3hv-75wg-m249","path":"package-lock.json","line":null,"fingerprint":"minimatch@10.0.1 (npm):GHSA-g3hv-75wg-m249"},{"rule_id":"osv/GHSA-g3hv-75wg-m249","severity":"medium","message":"minimatch@9.0.5 (npm) is affected by GHSA-g3hv-75wg-m249","path":"package-lock.json","line":null,"fingerprint":"minimatch@9.0.5 (npm):GHSA-g3hv-75wg-m249"},{"rule_id":"osv/GHSA-rgwj-5xj2-c3m3","severity":"medium","message":"mysql2@3.9.9 (npm) is affected by GHSA-rgwj-5xj2-c3m3","path":"package-lock.json","line":null,"fingerprint":"mysql2@3.9.9 (npm):GHSA-rgwj-5xj2-c3m3"},{"rule_id":"osv/GHSA-27v5-c462-wpq7","severity":"medium","message":"path-to-regexp@8.2.0 (npm) is affected by GHSA-27v5-c462-wpq7","path":"package-lock.json","line":null,"fingerprint":"path-to-regexp@8.2.0 (npm):GHSA-27v5-c462-wpq7"},{"rule_id":"osv/GHSA-3v7f-55p6-f55p","severity":"medium","message":"picomatch@2.3.1 (npm) is affected by GHSA-3v7f-55p6-f55p","path":"package-lock.json","line":null,"fingerprint":"picomatch@2.3.1 (npm):GHSA-3v7f-55p6-f55p"},{"rule_id":"osv/GHSA-3v7f-55p6-f55p","severity":"medium","message":"picomatch@4.0.2 (npm) is affected by GHSA-3v7f-55p6-f55p","path":"package-lock.json","line":null,"fingerprint":"picomatch@4.0.2 (npm):GHSA-3v7f-55p6-f55p"},{"rule_id":"osv/GHSA-fxqj-rqcc-2cmp","severity":"medium","message":"postcss@8.5.4 (npm) is affected by GHSA-fxqj-rqcc-2cmp","path":"package-lock.json","line":null,"fingerprint":"postcss@8.5.4 (npm):GHSA-fxqj-rqcc-2cmp"},{"rule_id":"osv/GHSA-qx2v-qp2m-jg93","severity":"medium","message":"postcss@8.5.4 (npm) is affected by GHSA-qx2v-qp2m-jg93","path":"package-lock.json","line":null,"fingerprint":"postcss@8.5.4 (npm):GHSA-qx2v-qp2m-jg93"},{"rule_id":"osv/GHSA-4mjr-xmp4-gh2g","severity":"medium","message":"qs@6.14.0 (npm) is affected by GHSA-4mjr-xmp4-gh2g","path":"package-lock.json","line":null,"fingerprint":"qs@6.14.0 (npm):GHSA-4mjr-xmp4-gh2g"},{"rule_id":"osv/GHSA-6pq8-jhm2-2vcw","severity":"medium","message":"qs@6.14.0 (npm) is affected by GHSA-6pq8-jhm2-2vcw","path":"package-lock.json","line":null,"fingerprint":"qs@6.14.0 (npm):GHSA-6pq8-jhm2-2vcw"},{"rule_id":"osv/GHSA-6rw7-vpxm-498p","severity":"medium","message":"qs@6.14.0 (npm) is affected by GHSA-6rw7-vpxm-498p","path":"package-lock.json","line":null,"fingerprint":"qs@6.14.0 (npm):GHSA-6rw7-vpxm-498p"},{"rule_id":"osv/GHSA-q8mj-m7cp-5q26","severity":"medium","message":"qs@6.14.0 (npm) is affected by GHSA-q8mj-m7cp-5q26","path":"package-lock.json","line":null,"fingerprint":"qs@6.14.0 (npm):GHSA-q8mj-m7cp-5q26"},{"rule_id":"osv/GHSA-4w7w-66w2-5vf9","severity":"medium","message":"vite@6.3.5 (npm) is affected by GHSA-4w7w-66w2-5vf9","path":"package-lock.json","line":null,"fingerprint":"vite@6.3.5 (npm):GHSA-4w7w-66w2-5vf9"},{"rule_id":"osv/GHSA-698v-4r3x-3vcv","severity":"medium","message":"vite@6.3.5 (npm) is affected by GHSA-698v-4r3x-3vcv","path":"package-lock.json","line":null,"fingerprint":"vite@6.3.5 (npm):GHSA-698v-4r3x-3vcv"},{"rule_id":"osv/GHSA-93m4-6634-74q7","severity":"medium","message":"vite@6.3.5 (npm) is affected by GHSA-93m4-6634-74q7","path":"package-lock.json","line":null,"fingerprint":"vite@6.3.5 (npm):GHSA-93m4-6634-74q7"},{"rule_id":"osv/GHSA-fx2h-pf6j-xcff","severity":"medium","message":"vite@6.3.5 (npm) is affected by GHSA-fx2h-pf6j-xcff","path":"package-lock.json","line":null,"fingerprint":"vite@6.3.5 (npm):GHSA-fx2h-pf6j-xcff"},{"rule_id":"osv/GHSA-r825-w8mm-5pxw","severity":"medium","message":"vite@6.3.5 (npm) is affected by GHSA-r825-w8mm-5pxw","path":"package-lock.json","line":null,"fingerprint":"vite@6.3.5 (npm):GHSA-r825-w8mm-5pxw"},{"rule_id":"osv/GHSA-rq7h-c2jc-7f22","severity":"medium","message":"vite@6.3.5 (npm) is affected by GHSA-rq7h-c2jc-7f22","path":"package-lock.json","line":null,"fingerprint":"vite@6.3.5 (npm):GHSA-rq7h-c2jc-7f22"},{"rule_id":"osv/GHSA-v6wh-96g9-6wx3","severity":"medium","message":"vite@6.3.5 (npm) is affected by GHSA-v6wh-96g9-6wx3","path":"package-lock.json","line":null,"fingerprint":"vite@6.3.5 (npm):GHSA-v6wh-96g9-6wx3"},{"rule_id":"osv/GHSA-48c2-rrv3-qjmp","severity":"medium","message":"yaml@1.10.2 (npm) is affected by GHSA-48c2-rrv3-qjmp","path":"package-lock.json","line":null,"fingerprint":"yaml@1.10.2 (npm):GHSA-48c2-rrv3-qjmp"},{"rule_id":"osv/GHSA-48c2-rrv3-qjmp","severity":"medium","message":"yaml@2.8.0 (npm) is affected by GHSA-48c2-rrv3-qjmp","path":"package-lock.json","line":null,"fingerprint":"yaml@2.8.0 (npm):GHSA-48c2-rrv3-qjmp"},{"rule_id":"osv/GHSA-4x5r-pxfx-6jf8","severity":"low","message":"@babel/core@7.27.4 (npm) is affected by GHSA-4x5r-pxfx-6jf8","path":"package-lock.json","line":null,"fingerprint":"@babel/core@7.27.4 (npm):GHSA-4x5r-pxfx-6jf8"},{"rule_id":"osv/GHSA-6475-r3vj-m8vf","severity":"low","message":"@smithy/config-resolver@3.0.13 (npm) is affected by GHSA-6475-r3vj-m8vf","path":"package-lock.json","line":null,"fingerprint":"@smithy/config-resolver@3.0.13 (npm):GHSA-6475-r3vj-m8vf"},{"rule_id":"osv/GHSA-6475-r3vj-m8vf","severity":"low","message":"@smithy/config-resolver@4.1.0 (npm) is affected by GHSA-6475-r3vj-m8vf","path":"package-lock.json","line":null,"fingerprint":"@smithy/config-resolver@4.1.0 (npm):GHSA-6475-r3vj-m8vf"},{"rule_id":"osv/GHSA-6475-r3vj-m8vf","severity":"low","message":"@smithy/config-resolver@4.1.4 (npm) is affected by GHSA-6475-r3vj-m8vf","path":"package-lock.json","line":null,"fingerprint":"@smithy/config-resolver@4.1.4 (npm):GHSA-6475-r3vj-m8vf"},{"rule_id":"osv/GHSA-464c-974j-9xm6","severity":"low","message":"aws-cdk-lib@2.200.0 (npm) is affected by GHSA-464c-974j-9xm6","path":"package-lock.json","line":null,"fingerprint":"aws-cdk-lib@2.200.0 (npm):GHSA-464c-974j-9xm6"},{"rule_id":"osv/GHSA-v422-hmwv-36x6","severity":"low","message":"body-parser@2.2.0 (npm) is affected by GHSA-v422-hmwv-36x6","path":"package-lock.json","line":null,"fingerprint":"body-parser@2.2.0 (npm):GHSA-v422-hmwv-36x6"},{"rule_id":"osv/GHSA-v6h2-p8h4-qcjw","severity":"low","message":"brace-expansion@1.1.11 (npm) is affected by GHSA-v6h2-p8h4-qcjw","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.11 (npm):GHSA-v6h2-p8h4-qcjw"},{"rule_id":"osv/GHSA-v6h2-p8h4-qcjw","severity":"low","message":"brace-expansion@2.0.1 (npm) is affected by GHSA-v6h2-p8h4-qcjw","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@2.0.1 (npm):GHSA-v6h2-p8h4-qcjw"},{"rule_id":"osv/GHSA-73rr-hh4g-fpgx","severity":"low","message":"diff@7.0.0 (npm) is affected by GHSA-73rr-hh4g-fpgx","path":"package-lock.json","line":null,"fingerprint":"diff@7.0.0 (npm):GHSA-73rr-hh4g-fpgx"},{"rule_id":"osv/GHSA-333x-w4r6-6crp","severity":"low","message":"fast-uri@3.0.6 (npm) is affected by GHSA-333x-w4r6-6crp","path":"package-lock.json","line":null,"fingerprint":"fast-uri@3.0.6 (npm):GHSA-333x-w4r6-6crp"},{"rule_id":"osv/GHSA-xhq7-xmqj-769h","severity":"low","message":"fast-uri@3.0.6 (npm) is affected by GHSA-xhq7-xmqj-769h","path":"package-lock.json","line":null,"fingerprint":"fast-uri@3.0.6 (npm):GHSA-xhq7-xmqj-769h"},{"rule_id":"osv/GHSA-474x-hrwr-fgx4","severity":"low","message":"fast-xml-parser@4.4.1 (npm) is affected by GHSA-474x-hrwr-fgx4","path":"package-lock.json","line":null,"fingerprint":"fast-xml-parser@4.4.1 (npm):GHSA-474x-hrwr-fgx4"},{"rule_id":"osv/GHSA-fj3w-jwp8-x2g3","severity":"low","message":"fast-xml-parser@4.4.1 (npm) is affected by GHSA-fj3w-jwp8-x2g3","path":"package-lock.json","line":null,"fingerprint":"fast-xml-parser@4.4.1 (npm):GHSA-fj3w-jwp8-x2g3"},{"rule_id":"osv/GHSA-442j-39wm-28r2","severity":"low","message":"handlebars@4.7.7 (npm) is affected by GHSA-442j-39wm-28r2","path":"package-lock.json","line":null,"fingerprint":"handlebars@4.7.7 (npm):GHSA-442j-39wm-28r2"},{"rule_id":"osv/GHSA-w7fw-mjwx-w883","severity":"low","message":"qs@6.14.0 (npm) is affected by GHSA-w7fw-mjwx-w883","path":"package-lock.json","line":null,"fingerprint":"qs@6.14.0 (npm):GHSA-w7fw-mjwx-w883"},{"rule_id":"osv/GHSA-52f5-9888-hmc6","severity":"low","message":"tmp@0.0.33 (npm) is affected by GHSA-52f5-9888-hmc6","path":"package-lock.json","line":null,"fingerprint":"tmp@0.0.33 (npm):GHSA-52f5-9888-hmc6"},{"rule_id":"osv/GHSA-9jrq-w75r-8gcw","severity":"low","message":"vite@6.3.5 (npm) is affected by GHSA-9jrq-w75r-8gcw","path":"package-lock.json","line":null,"fingerprint":"vite@6.3.5 (npm):GHSA-9jrq-w75r-8gcw"},{"rule_id":"osv/GHSA-g4jq-h2w9-997c","severity":"low","message":"vite@6.3.5 (npm) is affected by GHSA-g4jq-h2w9-997c","path":"package-lock.json","line":null,"fingerprint":"vite@6.3.5 (npm):GHSA-g4jq-h2w9-997c"},{"rule_id":"osv/GHSA-jqfw-vq24-v9c3","severity":"low","message":"vite@6.3.5 (npm) is affected by GHSA-jqfw-vq24-v9c3","path":"package-lock.json","line":null,"fingerprint":"vite@6.3.5 (npm):GHSA-jqfw-vq24-v9c3"}],"evidence":[],"data":{"ecosystems":["npm"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.0119,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":55.0,"function_nloc":524.0,"mean_ccn":2.35,"p90_ccn":4.0,"complex_functions":1.0,"long_functions":1.0,"many_param_functions":0.0,"risky_nloc_share":0.3416},"findings":[],"evidence":[{"kind":"complex-function","description":"handleSubmit in src/App.tsx: complexity 17, 63 lines","ref":"src/App.tsx","url":"https://github.com/jarirantala/ai-marketplace/blob/13d02189442aedb4127eb8dd46c7727e66016527/src/App.tsx#L99","weight":0.2833333333333333},{"kind":"complex-function","description":"App in src/App.tsx: complexity 3, 116 lines","ref":"src/App.tsx","url":"https://github.com/jarirantala/ai-marketplace/blob/13d02189442aedb4127eb8dd46c7727e66016527/src/App.tsx#L23","weight":0.05}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":539.0,"duplicated_lines":90.0,"duplicated_share":0.167,"files":12.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: server/aiapp-api.ts:5 and src/express-api.ts:5","ref":"server/aiapp-api.ts","url":"https://github.com/jarirantala/ai-marketplace/blob/13d02189442aedb4127eb8dd46c7727e66016527/server/aiapp-api.ts#L5","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/App.tsx:84 and src/App.tsx:164","ref":"src/App.tsx","url":"https://github.com/jarirantala/ai-marketplace/blob/13d02189442aedb4127eb8dd46c7727e66016527/src/App.tsx#L84","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":4.0,"weighted_findings":4.0,"scanned_lines":736.0,"category:best-practice":4.0},"findings":[{"rule_id":"opengrep/javascript.lang.best-practice.javascript-alert","severity":"medium","message":"found alert() call; should this be in production code?","path":"src/App.tsx","line":106,"fingerprint":"javascript.lang.best-practice.javascript-alert:src/App.tsx:106"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-alert","severity":"medium","message":"found alert() call; should this be in production code?","path":"src/App.tsx","line":113,"fingerprint":"javascript.lang.best-practice.javascript-alert:src/App.tsx:113"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-alert","severity":"medium","message":"found alert() call; should this be in production code?","path":"src/App.tsx","line":119,"fingerprint":"javascript.lang.best-practice.javascript-alert:src/App.tsx:119"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-alert","severity":"medium","message":"found alert() call; should this be in production code?","path":"src/App.tsx","line":138,"fingerprint":"javascript.lang.best-practice.javascript-alert:src/App.tsx:138"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":0.0,"check:test_ratio":0.0,"check:ci_present":0.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":0.0,"test_lines":0.0,"source_lines":736.0,"test_ratio":0.0,"ci_files":0.0,"cochange_share":0.0,"cochange_commits":49.0},"findings":[],"evidence":[],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":0.5,"check:license":1.0,"check:contributing":1.0,"check:changelog":0.0,"readme_lines":3.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0},{"kind":"docs","description":"CONTRIBUTING.md","ref":"CONTRIBUTING.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":1.0,"check:low_escape_density":0.0,"escapes":8.0,"escapes_per_kloc":8.0},"findings":[],"evidence":[{"kind":"typing","description":"TypeScript strict type checking: tsconfig.json","ref":"tsconfig.json","url":null,"weight":0.0}],"data":{},"error":null}],"flags":[]}