{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-4+qual-2+sec-2","generated_at":"2026-11-13T23:21:25.666503Z","repo":{"ref":{"host":"github.com","owner":"julianshapiro","name":"velocity"},"default_branch":"master","clone_url":"https://github.com/julianshapiro/velocity.git","html_url":"https://github.com/julianshapiro/velocity","description":"Accelerated JavaScript animation.","stars":17190,"forks":1510,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":8139,"primary_language":"JavaScript","license_spdx":"MIT","created_at":"2014-04-09T20:02:38Z","pushed_at":"2020-10-24T07:45:51Z","security_policy_url":null,"distribution":{"owner_created_at":"2011-03-07T06:12:47Z","owner_type":"User","release_assets":[]}},"commit_sha":"767e35cac12120be526eef330e4d988b2c3cfc3c","profile":{"lines_by_language":{"JavaScript":13862,"TypeScript":12388},"files_by_category":{"source":168,"test":48,"other":21,"config":10,"docs":9,"vendored":6,"binary":2,"generated":1},"source_lines":20801,"test_lines":5449},"pillars":{"ai_provenance":{"score":0.0,"confidence":0.65,"coverage":1.0,"label":"none-detected","breakdown":{"attributed_share":0.0,"suspected_share":0.0,"estimated_share":0.0,"ai_artifacts":0.0,"flagged_work_units":0.0,"flagged_releases":0.0},"summary":"No AI attribution or AI-consistent velocity signals detected."},"quality":{"score":39.7,"confidence":0.9,"coverage":1.0,"label":"poor","breakdown":{"complexity":20.7,"duplication":2.3,"lint":95.9,"testing":41.4,"docs":100.0,"type_safety":0.0,"process":5.0},"summary":"Code quality is poor: test-to-source ratio 0.26, no CI test run detected; 53% of function code in complex or long functions; 63% duplicated lines. Weakest area: type safety."},"security":{"score":52.0,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":100.0,"sast":83.1,"dependencies":0.2,"ci_actions":null,"posture":0.0,"scorecard":25.0},"summary":"Security posture is weak: 123 known vulnerabilities in 40 dependencies; 10 high-severity SAST findings. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"ok","tool_version":"scorecard v5.6.0","metrics":{"aggregate":2.1,"check:Code-Review":1.0,"check:Maintained":0.0,"check:Binary-Artifacts":10.0,"check:CII-Best-Practices":0.0,"check:Security-Policy":0.0,"check:License":10.0,"check:Fuzzing":0.0,"check:Branch-Protection":0.0,"check:SAST":0.0},"findings":[],"evidence":[{"kind":"scorecard-check","description":"Scorecard Code-Review: 1/10 (Found 3/28 approved changesets -- score normalized to 1)","ref":"Code-Review","url":"https://scorecard.dev/viewer/?uri=github.com/julianshapiro/velocity","weight":0.9},{"kind":"scorecard-check","description":"Scorecard Maintained: 0/10 (0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0)","ref":"Maintained","url":"https://scorecard.dev/viewer/?uri=github.com/julianshapiro/velocity","weight":1.0},{"kind":"scorecard-check","description":"Scorecard Binary-Artifacts: 10/10 (no binaries found in the repo)","ref":"Binary-Artifacts","url":"https://scorecard.dev/viewer/?uri=github.com/julianshapiro/velocity","weight":0.0},{"kind":"scorecard-check","description":"Scorecard CII-Best-Practices: 0/10 (no effort to earn an OpenSSF best practices badge detected)","ref":"CII-Best-Practices","url":"https://scorecard.dev/viewer/?uri=github.com/julianshapiro/velocity","weight":1.0},{"kind":"scorecard-check","description":"Scorecard Security-Policy: 0/10 (security policy file not detected)","ref":"Security-Policy","url":"https://scorecard.dev/viewer/?uri=github.com/julianshapiro/velocity","weight":1.0},{"kind":"scorecard-check","description":"Scorecard License: 10/10 (license file detected)","ref":"License","url":"https://scorecard.dev/viewer/?uri=github.com/julianshapiro/velocity","weight":0.0},{"kind":"scorecard-check","description":"Scorecard Fuzzing: 0/10 (project is not fuzzed)","ref":"Fuzzing","url":"https://scorecard.dev/viewer/?uri=github.com/julianshapiro/velocity","weight":1.0},{"kind":"scorecard-check","description":"Scorecard Branch-Protection: 0/10 (branch protection not enabled on development/release branches)","ref":"Branch-Protection","url":"https://scorecard.dev/viewer/?uri=github.com/julianshapiro/velocity","weight":1.0},{"kind":"scorecard-check","description":"Scorecard SAST: 0/10 (SAST tool is not run on all commits -- score normalized to 0)","ref":"SAST","url":"https://scorecard.dev/viewer/?uri=github.com/julianshapiro/velocity","weight":1.0}],"data":{"date":"2026-11-09","commit":"767e35cac12120be526eef330e4d988b2c3cfc3c","matches_head":true},"error":null},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":21.0,"checked":21.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":829.0,"attributed_commits":0.0,"attributed_commit_share":0.0,"effective_loc":136533.0,"attributed_loc":0.0,"attributed_loc_share":0.0,"tools_detected":0.0},"findings":[],"evidence":[],"data":{"attributed_loc_by_commit":{},"tools":{},"monthly":{"2014-04":{"loc":2545,"attributed_loc":0},"2014-05":{"loc":7231,"attributed_loc":0},"2014-06":{"loc":1303,"attributed_loc":0},"2014-07":{"loc":1367,"attributed_loc":0},"2014-08":{"loc":13260,"attributed_loc":0},"2014-09":{"loc":3801,"attributed_loc":0},"2014-10":{"loc":0,"attributed_loc":0},"2014-11":{"loc":0,"attributed_loc":0},"2014-12":{"loc":0,"attributed_loc":0},"2015-01":{"loc":3482,"attributed_loc":0},"2015-02":{"loc":3161,"attributed_loc":0},"2015-03":{"loc":9,"attributed_loc":0},"2015-05":{"loc":9,"attributed_loc":0},"2015-06":{"loc":0,"attributed_loc":0},"2015-07":{"loc":0,"attributed_loc":0},"2015-08":{"loc":421,"attributed_loc":0},"2015-09":{"loc":4,"attributed_loc":0},"2015-10":{"loc":2,"attributed_loc":0},"2015-12":{"loc":0,"attributed_loc":0},"2016-02":{"loc":10,"attributed_loc":0},"2016-04":{"loc":3,"attributed_loc":0},"2016-05":{"loc":7,"attributed_loc":0},"2016-06":{"loc":0,"attributed_loc":0},"2016-07":{"loc":46,"attributed_loc":0},"2016-08":{"loc":4876,"attributed_loc":0},"2016-09":{"loc":176,"attributed_loc":0},"2016-10":{"loc":237,"attributed_loc":0},"2016-11":{"loc":11,"attributed_loc":0},"2016-12":{"loc":871,"attributed_loc":0},"2017-01":{"loc":28,"attributed_loc":0},"2017-02":{"loc":4,"attributed_loc":0},"2017-03":{"loc":99,"attributed_loc":0},"2017-07":{"loc":21689,"attributed_loc":0},"2017-08":{"loc":6868,"attributed_loc":0},"2017-10":{"loc":9286,"attributed_loc":0},"2017-11":{"loc":14110,"attributed_loc":0},"2017-12":{"loc":1962,"attributed_loc":0},"2018-01":{"loc":5045,"attributed_loc":0},"2018-02":{"loc":1604,"attributed_loc":0},"2018-03":{"loc":7326,"attributed_loc":0},"2018-05":{"loc":22121,"attributed_loc":0},"2018-06":{"loc":2712,"attributed_loc":0},"2018-07":{"loc":51,"attributed_loc":0},"2018-08":{"loc":412,"attributed_loc":0},"2019-11":{"loc":1,"attributed_loc":0},"2020-04":{"loc":383,"attributed_loc":0},"2020-08":{"loc":0,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":133.0,"flagged_units":0.0,"pre_ai_era_bursts":6.0,"pre_ai_era_measured_loc":43652.0,"pre_ai_era_burst_loc":21125.0,"measured_loc":43652.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":1843.75,"median_loc_per_hour":79.5,"pr_timed_units":1.0,"excluded_import_loc":26180.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":["128e49833a2fc4d0e992751f2d318cd1678deea3","8bcc6b5ff5b0de30b8cb32d80e90a65f349eeb3d","e30839aa30da3eafb233acff1f01f60355821b18"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"releases":99.0,"flagged_releases":0.0,"max_loc_per_day":2076.4},"findings":[],"evidence":[],"data":{"releases":[{"from":"0.0.18","to":"v0.0.18","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v0.0.18","to":"0.0.19","loc":18,"days":1.27,"loc_per_day":14.2,"flagged":false},{"from":"0.0.19","to":"v0.0.19","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v0.0.19","to":"0.0.20","loc":67,"days":0.74,"loc_per_day":91.1,"flagged":false},{"from":"0.0.20","to":"v0.0.20","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v0.0.20","to":"0.0.21","loc":105,"days":1.3,"loc_per_day":80.8,"flagged":false},{"from":"0.0.21","to":"v0.0.21","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v0.0.21","to":"0.0.22","loc":19,"days":0.53,"loc_per_day":36.1,"flagged":false},{"from":"0.0.22","to":"v0.0.22","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v0.0.22","to":"0.0.23","loc":31,"days":8.27,"loc_per_day":3.7,"flagged":false},{"from":"0.0.23","to":"v0.0.23","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v0.0.23","to":"0.1.0","loc":82,"days":1.2,"loc_per_day":68.4,"flagged":false},{"from":"0.1.0","to":"v0.1.0","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v0.1.0","to":"0.2.0","loc":114,"days":4.83,"loc_per_day":23.6,"flagged":false},{"from":"0.2.0","to":"v0.2.0","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v0.2.0","to":"0.2.1","loc":6,"days":0.7,"loc_per_day":8.6,"flagged":false},{"from":"0.2.1","to":"v0.2.1","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v0.2.1","to":"0.3.0","loc":192,"days":7.52,"loc_per_day":25.5,"flagged":false},{"from":"0.3.0","to":"v0.3.0","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v0.3.0","to":"0.4.0","loc":603,"days":3.66,"loc_per_day":165.0,"flagged":false},{"from":"0.4.0","to":"v0.4.0","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v0.4.0","to":"0.4.1","loc":232,"days":1.98,"loc_per_day":117.0,"flagged":false},{"from":"0.4.1","to":"v0.4.1","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v0.4.1","to":"0.5.0","loc":524,"days":4.29,"loc_per_day":122.0,"flagged":false},{"from":"0.5.0","to":"v0.5.0","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v0.5.0","to":"0.5.1","loc":24,"days":1.9,"loc_per_day":12.6,"flagged":false},{"from":"0.5.1","to":"v0.5.1","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v0.5.1","to":"0.5.2","loc":44,"days":0.76,"loc_per_day":57.6,"flagged":false},{"from":"0.5.2","to":"v0.5.2","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v0.5.2","to":"0.5.3","loc":43,"days":0.1,"loc_per_day":419.8,"flagged":false},{"from":"0.5.3","to":"v0.5.3","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v0.5.3","to":"0.6.0","loc":54,"days":0.98,"loc_per_day":54.9,"flagged":false},{"from":"0.6.0","to":"v0.6.0","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v0.6.0","to":"0.7.0","loc":79,"days":2.07,"loc_per_day":38.2,"flagged":false},{"from":"0.7.0","to":"v0.7.0","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v0.7.0","to":"0.8.0","loc":105,"days":3.02,"loc_per_day":34.7,"flagged":false},{"from":"0.8.0","to":"v0.8.0","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v0.8.0","to":"0.9.0","loc":115,"days":7.01,"loc_per_day":16.4,"flagged":false},{"from":"0.9.0","to":"v0.9.0","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v0.9.0","to":"0.10.0","loc":49,"days":6.94,"loc_per_day":7.1,"flagged":false},{"from":"0.10.0","to":"v0.10.0","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v0.10.0","to":"0.10.1","loc":32,"days":5.07,"loc_per_day":6.3,"flagged":false},{"from":"0.10.1","to":"v0.10.1","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v0.10.1","to":"0.11.0","loc":150,"days":5.7,"loc_per_day":26.3,"flagged":false},{"from":"0.11.0","to":"v0.11.0","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v0.11.0","to":"0.11.1","loc":132,"days":1.23,"loc_per_day":107.5,"flagged":false},{"from":"0.11.1","to":"v0.11.1","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v0.11.1","to":"0.11.2","loc":3,"days":0.2,"loc_per_day":15.0,"flagged":false},{"from":"0.11.2","to":"v0.11.2","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v0.11.2","to":"0.11.5","loc":58,"days":3.68,"loc_per_day":15.8,"flagged":false},{"from":"0.11.5","to":"v0.11.5","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v0.11.5","to":"0.11.6","loc":17,"days":2.24,"loc_per_day":7.6,"flagged":false},{"from":"0.11.6","to":"v0.11.6","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v0.11.6","to":"0.11.7","loc":3848,"days":1.98,"loc_per_day":1947.7,"flagged":false},{"from":"0.11.7","to":"v0.11.7","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v0.11.7","to":"0.11.8","loc":567,"days":3.89,"loc_per_day":145.6,"flagged":false},{"from":"0.11.8","to":"v0.11.8","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v0.11.8","to":"0.11.9","loc":110,"days":0.98,"loc_per_day":112.3,"flagged":false},{"from":"0.11.9","to":"v0.11.9","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v0.11.9","to":"1.0.0","loc":8343,"days":4.02,"loc_per_day":2076.4,"flagged":false},{"from":"1.0.0","to":"v1.0.0","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v1.0.0","to":"1.1.0","loc":370,"days":20.89,"loc_per_day":17.7,"flagged":false},{"from":"1.1.0","to":"v1.1.0","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v1.1.0","to":"1.2.0","loc":6902,"days":108.37,"loc_per_day":63.7,"flagged":false},{"from":"1.2.0","to":"v1.2.0","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v1.2.0","to":"1.2.1","loc":5,"days":0.81,"loc_per_day":6.2,"flagged":false},{"from":"1.2.1","to":"v1.2.1","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v1.2.1","to":"1.2.2","loc":3167,"days":42.09,"loc_per_day":75.2,"flagged":false},{"from":"1.2.2","to":"v1.2.2","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v1.2.2","to":"1.2.3","loc":425,"days":221.46,"loc_per_day":1.9,"flagged":false},{"from":"1.2.3","to":"v1.2.3","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v1.2.3","to":"1.3.0","loc":4962,"days":321.94,"loc_per_day":15.4,"flagged":false},{"from":"1.3.0","to":"v1.3.0","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v1.3.0","to":"1.3.1","loc":42,"days":38.92,"loc_per_day":1.1,"flagged":false},{"from":"1.3.1","to":"v1.3.1","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v1.3.1","to":"1.3.2","loc":382,"days":61.04,"loc_per_day":6.3,"flagged":false},{"from":"1.3.2","to":"v1.3.2","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v1.3.2","to":"1.4.0","loc":819,"days":13.22,"loc_per_day":62.0,"flagged":false},{"from":"1.4.0","to":"v1.4.0","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v1.4.0","to":"1.4.1","loc":52,"days":13.09,"loc_per_day":4.0,"flagged":false},{"from":"1.4.1","to":"v1.4.1","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v1.4.1","to":"1.4.2","loc":28,"days":43.94,"loc_per_day":0.6,"flagged":false},{"from":"1.4.2","to":"v1.4.2","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v1.4.2","to":"1.4.3","loc":4,"days":16.72,"loc_per_day":0.2,"flagged":false},{"from":"1.4.3","to":"v1.4.3","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v1.4.3","to":"1.5.0","loc":99,"days":30.1,"loc_per_day":3.3,"flagged":false},{"from":"1.5.0","to":"v1.5.0","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v1.5.0","to":"1.5.1","loc":13,"days":293.83,"loc_per_day":0.0,"flagged":false},{"from":"1.5.1","to":"v1.5.1","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v1.5.1","to":"2.0.0","loc":43387,"days":26.58,"loc_per_day":1632.4,"flagged":false},{"from":"2.0.0","to":"v2.0.0","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v2.0.0","to":"2.0.1","loc":671,"days":9.58,"loc_per_day":70.0,"flagged":false},{"from":"2.0.1","to":"v2.0.1","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v2.0.1","to":"2.0.2","loc":1183,"days":21.19,"loc_per_day":55.8,"flagged":false},{"from":"2.0.2","to":"v2.0.2","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v2.0.2","to":"2.0.3","loc":1144,"days":84.23,"loc_per_day":13.6,"flagged":false},{"from":"2.0.3","to":"v2.0.3","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v2.0.3","to":"v2.0.5","loc":3416,"days":13.51,"loc_per_day":252.8,"flagged":false},{"from":"v2.0.5","to":"v2.0.6","loc":851,"days":670.12,"loc_per_day":1.3,"flagged":false}]},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":20801.0,"index":0.0,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":42.0,"findings_high":10.0,"findings_medium":8.0,"findings_low":24.0,"weighted_findings":11.0,"scanned_lines":20801.0,"parse_errors":1.0},"findings":[{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/velocity.ts","line":112,"fingerprint":"javascript.browser.security.insecure-document-method:src/velocity.ts:112"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `div.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/velocity.ts","line":112,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/velocity.ts:112"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"velocity.es5.js","line":3965,"fingerprint":"javascript.browser.security.insecure-document-method:velocity.es5.js:3965"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `div.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"velocity.es5.js","line":3965,"fingerprint":"javascript.browser.security.insecure-innerhtml:velocity.es5.js:3965"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"velocity.es5.js","line":4779,"fingerprint":"javascript.browser.security.insecure-document-method:velocity.es5.js:4779"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `div.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"velocity.es5.js","line":4779,"fingerprint":"javascript.browser.security.insecure-innerhtml:velocity.es5.js:4779"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"velocity.js","line":3971,"fingerprint":"javascript.browser.security.insecure-document-method:velocity.js:3971"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `div.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"velocity.js","line":3971,"fingerprint":"javascript.browser.security.insecure-innerhtml:velocity.js:3971"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"velocity.js","line":4785,"fingerprint":"javascript.browser.security.insecure-document-method:velocity.js:4785"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `div.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"velocity.js","line":4785,"fingerprint":"javascript.browser.security.insecure-innerhtml:velocity.js:4785"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"legacy/normalisations.ts","line":14,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:legacy/normalisations.ts:14"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `className` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-contr [confidence low]","path":"src/utility.ts","line":78,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:src/utility.ts:78"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/velocity.ts","line":112,"fingerprint":"javascript.lang.security.html-in-template-string:src/velocity.ts:112"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"src/velocityFn.ts","line":251,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:src/velocityFn.ts:251"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `className` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-contr [confidence low]","path":"velocity.es5.js","line":198,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:velocity.es5.js:198"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"velocity.es5.js","line":4486,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:velocity.es5.js:4486"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `className` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-contr [confidence low]","path":"velocity.js","line":204,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:velocity.js:204"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"velocity.js","line":4492,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:velocity.js:4492"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/Velocity/actions/property.ts","line":96,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/Velocity/actions/property.ts:96"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/Velocity/actions/property.ts","line":107,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/Velocity/actions/property.ts:107"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/Velocity/css/getPropertyValue.ts","line":123,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/Velocity/css/getPropertyValue.ts:123"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/Velocity/css/setPropertyValue.ts","line":34,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/Velocity/css/setPropertyValue.ts:34"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/Velocity/normalizations/svg/attributes.ts","line":55,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/Velocity/normalizations/svg/attributes.ts:55"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/Velocity/tweens.ts","line":278,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/Velocity/tweens.ts:278"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/Velocity/tweens.ts","line":428,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/Velocity/tweens.ts:428"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/velocityFn.ts","line":480,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/velocityFn.ts:480"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"velocity.es5.js","line":1455,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:velocity.es5.js:1455"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"velocity.es5.js","line":1685,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:velocity.es5.js:1685"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"velocity.es5.js","line":1914,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:velocity.es5.js:1914"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"velocity.es5.js","line":2047,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:velocity.es5.js:2047"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"velocity.es5.js","line":3024,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:velocity.es5.js:3024"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"velocity.es5.js","line":3070,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:velocity.es5.js:3070"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"velocity.es5.js","line":3858,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:velocity.es5.js:3858"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"velocity.es5.js","line":4689,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:velocity.es5.js:4689"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"velocity.js","line":1461,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:velocity.js:1461"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"velocity.js","line":1691,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:velocity.js:1691"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"velocity.js","line":1920,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:velocity.js:1920"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"velocity.js","line":2053,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:velocity.js:2053"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"velocity.js","line":3030,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:velocity.js:3030"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"velocity.js","line":3076,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:velocity.js:3076"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"velocity.js","line":3864,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:velocity.js:3864"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"velocity.js","line":4695,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:velocity.js:4695"}],"evidence":[],"data":{"rulesets":["javascript","typescript"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":40.0,"vulnerabilities":123.0,"vulns_critical":19.0,"vulns_high":61.0,"vulns_medium":30.0,"vulns_low":5.0,"vulns_unknown":8.0,"penalty":369.0},"findings":[{"rule_id":"osv/GHSA-67hx-6x53-jw92","severity":"critical","message":"babel-traverse@6.26.0 (npm) is affected by GHSA-67hx-6x53-jw92","path":"package-lock.json","line":null,"fingerprint":"babel-traverse@6.26.0 (npm):GHSA-67hx-6x53-jw92"},{"rule_id":"osv/GHSA-fjxv-7rqg-78g4","severity":"critical","message":"form-data@2.3.2 (npm) is affected by GHSA-fjxv-7rqg-78g4","path":"package-lock.json","line":null,"fingerprint":"form-data@2.3.2 (npm):GHSA-fjxv-7rqg-78g4"},{"rule_id":"osv/GHSA-8r6j-v8pm-fqw3","severity":"critical","message":"fsevents@1.2.4 (npm) is affected by GHSA-8r6j-v8pm-fqw3","path":"package-lock.json","line":null,"fingerprint":"fsevents@1.2.4 (npm):GHSA-8r6j-v8pm-fqw3"},{"rule_id":"osv/GHSA-2w6w-674q-4c4q","severity":"critical","message":"handlebars@4.0.11 (npm) is affected by GHSA-2w6w-674q-4c4q","path":"package-lock.json","line":null,"fingerprint":"handlebars@4.0.11 (npm):GHSA-2w6w-674q-4c4q"},{"rule_id":"osv/GHSA-765h-qjxv-5f44","severity":"critical","message":"handlebars@4.0.11 (npm) is affected by GHSA-765h-qjxv-5f44","path":"package-lock.json","line":null,"fingerprint":"handlebars@4.0.11 (npm):GHSA-765h-qjxv-5f44"},{"rule_id":"osv/GHSA-8r5x-fm3f-whwj","severity":"critical","message":"handlebars@4.0.11 (npm) is affected by GHSA-8r5x-fm3f-whwj","path":"package-lock.json","line":null,"fingerprint":"handlebars@4.0.11 (npm):GHSA-8r5x-fm3f-whwj"},{"rule_id":"osv/GHSA-f2jv-r9rf-7988","severity":"critical","message":"handlebars@4.0.11 (npm) is affected by GHSA-f2jv-r9rf-7988","path":"package-lock.json","line":null,"fingerprint":"handlebars@4.0.11 (npm):GHSA-f2jv-r9rf-7988"},{"rule_id":"osv/GHSA-p8wg-vrv2-v86f","severity":"critical","message":"handlebars@4.0.11 (npm) is affected by GHSA-p8wg-vrv2-v86f","path":"package-lock.json","line":null,"fingerprint":"handlebars@4.0.11 (npm):GHSA-p8wg-vrv2-v86f"},{"rule_id":"osv/GHSA-w457-6q6x-cgp9","severity":"critical","message":"handlebars@4.0.11 (npm) is affected by GHSA-w457-6q6x-cgp9","path":"package-lock.json","line":null,"fingerprint":"handlebars@4.0.11 (npm):GHSA-w457-6q6x-cgp9"},{"rule_id":"osv/GHSA-896r-f27r-55mw","severity":"critical","message":"json-schema@0.2.3 (npm) is affected by GHSA-896r-f27r-55mw","path":"package-lock.json","line":null,"fingerprint":"json-schema@0.2.3 (npm):GHSA-896r-f27r-55mw"},{"rule_id":"osv/GHSA-jf85-cpcp-j695","severity":"critical","message":"lodash@4.17.10 (npm) is affected by GHSA-jf85-cpcp-j695","path":"package-lock.json","line":null,"fingerprint":"lodash@4.17.10 (npm):GHSA-jf85-cpcp-j695"},{"rule_id":"osv/GHSA-jf85-cpcp-j695","severity":"critical","message":"lodash@4.17.9 (npm) is affected by GHSA-jf85-cpcp-j695","path":"package-lock.json","line":null,"fingerprint":"lodash@4.17.9 (npm):GHSA-jf85-cpcp-j695"},{"rule_id":"osv/GHSA-xvch-5gv4-984h","severity":"critical","message":"minimist@0.0.10 (npm) is affected by GHSA-xvch-5gv4-984h","path":"package-lock.json","line":null,"fingerprint":"minimist@0.0.10 (npm):GHSA-xvch-5gv4-984h"},{"rule_id":"osv/GHSA-xvch-5gv4-984h","severity":"critical","message":"minimist@0.0.8 (npm) is affected by GHSA-xvch-5gv4-984h","path":"package-lock.json","line":null,"fingerprint":"minimist@0.0.8 (npm):GHSA-xvch-5gv4-984h"},{"rule_id":"osv/GHSA-xvch-5gv4-984h","severity":"critical","message":"minimist@1.2.0 (npm) is affected by GHSA-xvch-5gv4-984h","path":"package-lock.json","line":null,"fingerprint":"minimist@1.2.0 (npm):GHSA-xvch-5gv4-984h"},{"rule_id":"osv/GHSA-fhjf-83wg-r2j9","severity":"critical","message":"mixin-deep@1.3.1 (npm) is affected by GHSA-fhjf-83wg-r2j9","path":"package-lock.json","line":null,"fingerprint":"mixin-deep@1.3.1 (npm):GHSA-fhjf-83wg-r2j9"},{"rule_id":"osv/GHSA-4g88-fppr-53pp","severity":"critical","message":"set-value@0.4.3 (npm) is affected by GHSA-4g88-fppr-53pp","path":"package-lock.json","line":null,"fingerprint":"set-value@0.4.3 (npm):GHSA-4g88-fppr-53pp"},{"rule_id":"osv/GHSA-4g88-fppr-53pp","severity":"critical","message":"set-value@2.0.0 (npm) is affected by GHSA-4g88-fppr-53pp","path":"package-lock.json","line":null,"fingerprint":"set-value@2.0.0 (npm):GHSA-4g88-fppr-53pp"},{"rule_id":"osv/GHSA-23hp-3jrh-7fpw","severity":"critical","message":"tar@4.4.1 (npm) is affected by GHSA-23hp-3jrh-7fpw","path":"package-lock.json","line":null,"fingerprint":"tar@4.4.1 (npm):GHSA-23hp-3jrh-7fpw"},{"rule_id":"osv/GHSA-3jxr-9vmj-r5cp","severity":"high","message":"brace-expansion@1.1.11 (npm) is affected by GHSA-3jxr-9vmj-r5cp","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.11 (npm):GHSA-3jxr-9vmj-r5cp"},{"rule_id":"osv/GHSA-6j4f-fj2g-mc7p","severity":"high","message":"brace-expansion@1.1.11 (npm) is affected by GHSA-6j4f-fj2g-mc7p","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.11 (npm):GHSA-6j4f-fj2g-mc7p"},{"rule_id":"osv/GHSA-mh99-v99m-4gvg","severity":"high","message":"brace-expansion@1.1.11 (npm) is affected by GHSA-mh99-v99m-4gvg","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.11 (npm):GHSA-mh99-v99m-4gvg"},{"rule_id":"osv/GHSA-qhr7-859c-m2p7","severity":"high","message":"brace-expansion@1.1.11 (npm) is affected by GHSA-qhr7-859c-m2p7","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.11 (npm):GHSA-qhr7-859c-m2p7"},{"rule_id":"osv/GHSA-rgw5-rvv9-x895","severity":"high","message":"brace-expansion@1.1.11 (npm) is affected by GHSA-rgw5-rvv9-x895","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.11 (npm):GHSA-rgw5-rvv9-x895"},{"rule_id":"osv/GHSA-grv7-fg5c-xmjg","severity":"high","message":"braces@1.8.5 (npm) is affected by GHSA-grv7-fg5c-xmjg","path":"package-lock.json","line":null,"fingerprint":"braces@1.8.5 (npm):GHSA-grv7-fg5c-xmjg"},{"rule_id":"osv/GHSA-grv7-fg5c-xmjg","severity":"high","message":"braces@2.3.2 (npm) is affected by GHSA-grv7-fg5c-xmjg","path":"package-lock.json","line":null,"fingerprint":"braces@2.3.2 (npm):GHSA-grv7-fg5c-xmjg"},{"rule_id":"osv/GHSA-73wf-gq98-2v4g","severity":"high","message":"browserslist@3.2.8 (npm) is affected by GHSA-73wf-gq98-2v4g","path":"package-lock.json","line":null,"fingerprint":"browserslist@3.2.8 (npm):GHSA-73wf-gq98-2v4g"},{"rule_id":"osv/GHSA-c83g-rgw3-j3cx","severity":"high","message":"browserslist@3.2.8 (npm) is affected by GHSA-c83g-rgw3-j3cx","path":"package-lock.json","line":null,"fingerprint":"browserslist@3.2.8 (npm):GHSA-c83g-rgw3-j3cx"},{"rule_id":"osv/GHSA-qr28-fpjm-wq7f","severity":"high","message":"decode-uri-component@0.2.0 (npm) is affected by GHSA-qr28-fpjm-wq7f","path":"package-lock.json","line":null,"fingerprint":"decode-uri-component@0.2.0 (npm):GHSA-qr28-fpjm-wq7f"},{"rule_id":"osv/GHSA-w573-4hg7-7wgq","severity":"high","message":"decode-uri-component@0.2.0 (npm) is affected by GHSA-w573-4hg7-7wgq","path":"package-lock.json","line":null,"fingerprint":"decode-uri-component@0.2.0 (npm):GHSA-w573-4hg7-7wgq"},{"rule_id":"osv/GHSA-hmw2-7cc7-3qxx","severity":"high","message":"form-data@2.3.2 (npm) is affected by GHSA-hmw2-7cc7-3qxx","path":"package-lock.json","line":null,"fingerprint":"form-data@2.3.2 (npm):GHSA-hmw2-7cc7-3qxx"},{"rule_id":"osv/GHSA-2cf5-4w76-r9qv","severity":"high","message":"handlebars@4.0.11 (npm) is affected by GHSA-2cf5-4w76-r9qv","path":"package-lock.json","line":null,"fingerprint":"handlebars@4.0.11 (npm):GHSA-2cf5-4w76-r9qv"},{"rule_id":"osv/GHSA-3cqr-58rm-57f8","severity":"high","message":"handlebars@4.0.11 (npm) is affected by GHSA-3cqr-58rm-57f8","path":"package-lock.json","line":null,"fingerprint":"handlebars@4.0.11 (npm):GHSA-3cqr-58rm-57f8"},{"rule_id":"osv/GHSA-3mfm-83xf-c92r","severity":"high","message":"handlebars@4.0.11 (npm) is affected by GHSA-3mfm-83xf-c92r","path":"package-lock.json","line":null,"fingerprint":"handlebars@4.0.11 (npm):GHSA-3mfm-83xf-c92r"},{"rule_id":"osv/GHSA-62gr-4qp9-h98f","severity":"high","message":"handlebars@4.0.11 (npm) is affected by GHSA-62gr-4qp9-h98f","path":"package-lock.json","line":null,"fingerprint":"handlebars@4.0.11 (npm):GHSA-62gr-4qp9-h98f"},{"rule_id":"osv/GHSA-9cx6-37pm-9jff","severity":"high","message":"handlebars@4.0.11 (npm) is affected by GHSA-9cx6-37pm-9jff","path":"package-lock.json","line":null,"fingerprint":"handlebars@4.0.11 (npm):GHSA-9cx6-37pm-9jff"},{"rule_id":"osv/GHSA-q42p-pg8m-cqh6","severity":"high","message":"handlebars@4.0.11 (npm) is affected by GHSA-q42p-pg8m-cqh6","path":"package-lock.json","line":null,"fingerprint":"handlebars@4.0.11 (npm):GHSA-q42p-pg8m-cqh6"},{"rule_id":"osv/GHSA-xhpv-hc6g-r9c6","severity":"high","message":"handlebars@4.0.11 (npm) is affected by GHSA-xhpv-hc6g-r9c6","path":"package-lock.json","line":null,"fingerprint":"handlebars@4.0.11 (npm):GHSA-xhpv-hc6g-r9c6"},{"rule_id":"osv/GHSA-xjpj-3mr7-gcpf","severity":"high","message":"handlebars@4.0.11 (npm) is affected by GHSA-xjpj-3mr7-gcpf","path":"package-lock.json","line":null,"fingerprint":"handlebars@4.0.11 (npm):GHSA-xjpj-3mr7-gcpf"},{"rule_id":"osv/GHSA-qqgx-2p2h-9c37","severity":"high","message":"ini@1.3.5 (npm) is affected by GHSA-qqgx-2p2h-9c37","path":"package-lock.json","line":null,"fingerprint":"ini@1.3.5 (npm):GHSA-qqgx-2p2h-9c37"},{"rule_id":"osv/GHSA-2883-xcg3-v3hh","severity":"high","message":"js-yaml@3.12.0 (npm) is affected by GHSA-2883-xcg3-v3hh","path":"package-lock.json","line":null,"fingerprint":"js-yaml@3.12.0 (npm):GHSA-2883-xcg3-v3hh"},{"rule_id":"osv/GHSA-52cp-r559-cp3m","severity":"high","message":"js-yaml@3.12.0 (npm) is affected by GHSA-52cp-r559-cp3m","path":"package-lock.json","line":null,"fingerprint":"js-yaml@3.12.0 (npm):GHSA-52cp-r559-cp3m"},{"rule_id":"osv/GHSA-5p4m-2wfm-xmqj","severity":"high","message":"js-yaml@3.12.0 (npm) is affected by GHSA-5p4m-2wfm-xmqj","path":"package-lock.json","line":null,"fingerprint":"js-yaml@3.12.0 (npm):GHSA-5p4m-2wfm-xmqj"},{"rule_id":"osv/GHSA-9c47-m6qq-7p4h","severity":"high","message":"json5@0.5.1 (npm) is affected by GHSA-9c47-m6qq-7p4h","path":"package-lock.json","line":null,"fingerprint":"json5@0.5.1 (npm):GHSA-9c47-m6qq-7p4h"},{"rule_id":"osv/GHSA-6c8f-qphg-qjgp","severity":"high","message":"kind-of@6.0.2 (npm) is affected by GHSA-6c8f-qphg-qjgp","path":"package-lock.json","line":null,"fingerprint":"kind-of@6.0.2 (npm):GHSA-6c8f-qphg-qjgp"},{"rule_id":"osv/GHSA-35jh-r3h4-6jhm","severity":"high","message":"lodash@4.17.10 (npm) is affected by GHSA-35jh-r3h4-6jhm","path":"package-lock.json","line":null,"fingerprint":"lodash@4.17.10 (npm):GHSA-35jh-r3h4-6jhm"},{"rule_id":"osv/GHSA-p6mc-m468-83gw","severity":"high","message":"lodash@4.17.10 (npm) is affected by GHSA-p6mc-m468-83gw","path":"package-lock.json","line":null,"fingerprint":"lodash@4.17.10 (npm):GHSA-p6mc-m468-83gw"},{"rule_id":"osv/GHSA-r5fr-rjxr-66jc","severity":"high","message":"lodash@4.17.10 (npm) is affected by GHSA-r5fr-rjxr-66jc","path":"package-lock.json","line":null,"fingerprint":"lodash@4.17.10 (npm):GHSA-r5fr-rjxr-66jc"},{"rule_id":"osv/GHSA-35jh-r3h4-6jhm","severity":"high","message":"lodash@4.17.9 (npm) is affected by GHSA-35jh-r3h4-6jhm","path":"package-lock.json","line":null,"fingerprint":"lodash@4.17.9 (npm):GHSA-35jh-r3h4-6jhm"},{"rule_id":"osv/GHSA-p6mc-m468-83gw","severity":"high","message":"lodash@4.17.9 (npm) is affected by GHSA-p6mc-m468-83gw","path":"package-lock.json","line":null,"fingerprint":"lodash@4.17.9 (npm):GHSA-p6mc-m468-83gw"},{"rule_id":"osv/GHSA-r5fr-rjxr-66jc","severity":"high","message":"lodash@4.17.9 (npm) is affected by GHSA-r5fr-rjxr-66jc","path":"package-lock.json","line":null,"fingerprint":"lodash@4.17.9 (npm):GHSA-r5fr-rjxr-66jc"},{"rule_id":"osv/GHSA-23c5-xmqv-rm74","severity":"high","message":"minimatch@3.0.4 (npm) is affected by GHSA-23c5-xmqv-rm74","path":"package-lock.json","line":null,"fingerprint":"minimatch@3.0.4 (npm):GHSA-23c5-xmqv-rm74"},{"rule_id":"osv/GHSA-3ppc-4f35-3m26","severity":"high","message":"minimatch@3.0.4 (npm) is affected by GHSA-3ppc-4f35-3m26","path":"package-lock.json","line":null,"fingerprint":"minimatch@3.0.4 (npm):GHSA-3ppc-4f35-3m26"},{"rule_id":"osv/GHSA-7r86-cg39-jmmj","severity":"high","message":"minimatch@3.0.4 (npm) is affected by GHSA-7r86-cg39-jmmj","path":"package-lock.json","line":null,"fingerprint":"minimatch@3.0.4 (npm):GHSA-7r86-cg39-jmmj"},{"rule_id":"osv/GHSA-f8q6-p94x-37v3","severity":"high","message":"minimatch@3.0.4 (npm) is affected by GHSA-f8q6-p94x-37v3","path":"package-lock.json","line":null,"fingerprint":"minimatch@3.0.4 (npm):GHSA-f8q6-p94x-37v3"},{"rule_id":"osv/GHSA-8hfj-j24r-96c4","severity":"high","message":"moment@2.22.2 (npm) is affected by GHSA-8hfj-j24r-96c4","path":"package-lock.json","line":null,"fingerprint":"moment@2.22.2 (npm):GHSA-8hfj-j24r-96c4"},{"rule_id":"osv/GHSA-wc69-rhjr-hc9g","severity":"high","message":"moment@2.22.2 (npm) is affected by GHSA-wc69-rhjr-hc9g","path":"package-lock.json","line":null,"fingerprint":"moment@2.22.2 (npm):GHSA-wc69-rhjr-hc9g"},{"rule_id":"osv/GHSA-r683-j2x4-v87g","severity":"high","message":"node-fetch@2.2.0 (npm) is affected by GHSA-r683-j2x4-v87g","path":"package-lock.json","line":null,"fingerprint":"node-fetch@2.2.0 (npm):GHSA-r683-j2x4-v87g"},{"rule_id":"osv/GHSA-hrpp-h998-j3pp","severity":"high","message":"qs@6.5.2 (npm) is affected by GHSA-hrpp-h998-j3pp","path":"package-lock.json","line":null,"fingerprint":"qs@6.5.2 (npm):GHSA-hrpp-h998-j3pp"},{"rule_id":"osv/GHSA-gcx4-mw62-g8wm","severity":"high","message":"rollup@0.63.5 (npm) is affected by GHSA-gcx4-mw62-g8wm","path":"package-lock.json","line":null,"fingerprint":"rollup@0.63.5 (npm):GHSA-gcx4-mw62-g8wm"},{"rule_id":"osv/GHSA-mw96-cpmx-2vgc","severity":"high","message":"rollup@0.63.5 (npm) is affected by GHSA-mw96-cpmx-2vgc","path":"package-lock.json","line":null,"fingerprint":"rollup@0.63.5 (npm):GHSA-mw96-cpmx-2vgc"},{"rule_id":"osv/GHSA-c2qf-rxjj-qqgw","severity":"high","message":"semver@5.5.0 (npm) is affected by GHSA-c2qf-rxjj-qqgw","path":"package-lock.json","line":null,"fingerprint":"semver@5.5.0 (npm):GHSA-c2qf-rxjj-qqgw"},{"rule_id":"osv/GHSA-4jqc-8m5r-9rpr","severity":"high","message":"set-value@0.4.3 (npm) is affected by GHSA-4jqc-8m5r-9rpr","path":"package-lock.json","line":null,"fingerprint":"set-value@0.4.3 (npm):GHSA-4jqc-8m5r-9rpr"},{"rule_id":"osv/GHSA-4jqc-8m5r-9rpr","severity":"high","message":"set-value@2.0.0 (npm) is affected by GHSA-4jqc-8m5r-9rpr","path":"package-lock.json","line":null,"fingerprint":"set-value@2.0.0 (npm):GHSA-4jqc-8m5r-9rpr"},{"rule_id":"osv/GHSA-34x7-hfp2-rc4v","severity":"high","message":"tar@4.4.1 (npm) is affected by GHSA-34x7-hfp2-rc4v","path":"package-lock.json","line":null,"fingerprint":"tar@4.4.1 (npm):GHSA-34x7-hfp2-rc4v"},{"rule_id":"osv/GHSA-3jfq-g458-7qm9","severity":"high","message":"tar@4.4.1 (npm) is affected by GHSA-3jfq-g458-7qm9","path":"package-lock.json","line":null,"fingerprint":"tar@4.4.1 (npm):GHSA-3jfq-g458-7qm9"},{"rule_id":"osv/GHSA-5955-9wpr-37jh","severity":"high","message":"tar@4.4.1 (npm) is affected by GHSA-5955-9wpr-37jh","path":"package-lock.json","line":null,"fingerprint":"tar@4.4.1 (npm):GHSA-5955-9wpr-37jh"},{"rule_id":"osv/GHSA-83g3-92jg-28cx","severity":"high","message":"tar@4.4.1 (npm) is affected by GHSA-83g3-92jg-28cx","path":"package-lock.json","line":null,"fingerprint":"tar@4.4.1 (npm):GHSA-83g3-92jg-28cx"},{"rule_id":"osv/GHSA-8qq5-rm4j-mr97","severity":"high","message":"tar@4.4.1 (npm) is affected by GHSA-8qq5-rm4j-mr97","path":"package-lock.json","line":null,"fingerprint":"tar@4.4.1 (npm):GHSA-8qq5-rm4j-mr97"},{"rule_id":"osv/GHSA-8x88-c5mf-7j5w","severity":"high","message":"tar@4.4.1 (npm) is affected by GHSA-8x88-c5mf-7j5w","path":"package-lock.json","line":null,"fingerprint":"tar@4.4.1 (npm):GHSA-8x88-c5mf-7j5w"},{"rule_id":"osv/GHSA-9ppj-qmqm-q256","severity":"high","message":"tar@4.4.1 (npm) is affected by GHSA-9ppj-qmqm-q256","path":"package-lock.json","line":null,"fingerprint":"tar@4.4.1 (npm):GHSA-9ppj-qmqm-q256"},{"rule_id":"osv/GHSA-9r2w-394v-53qc","severity":"high","message":"tar@4.4.1 (npm) is affected by GHSA-9r2w-394v-53qc","path":"package-lock.json","line":null,"fingerprint":"tar@4.4.1 (npm):GHSA-9r2w-394v-53qc"},{"rule_id":"osv/GHSA-j44m-qm6p-hp7m","severity":"high","message":"tar@4.4.1 (npm) is affected by GHSA-j44m-qm6p-hp7m","path":"package-lock.json","line":null,"fingerprint":"tar@4.4.1 (npm):GHSA-j44m-qm6p-hp7m"},{"rule_id":"osv/GHSA-qffp-2rhf-9h96","severity":"high","message":"tar@4.4.1 (npm) is affected by GHSA-qffp-2rhf-9h96","path":"package-lock.json","line":null,"fingerprint":"tar@4.4.1 (npm):GHSA-qffp-2rhf-9h96"},{"rule_id":"osv/GHSA-qq89-hq3f-393p","severity":"high","message":"tar@4.4.1 (npm) is affected by GHSA-qq89-hq3f-393p","path":"package-lock.json","line":null,"fingerprint":"tar@4.4.1 (npm):GHSA-qq89-hq3f-393p"},{"rule_id":"osv/GHSA-r292-9mhp-454m","severity":"high","message":"tar@4.4.1 (npm) is affected by GHSA-r292-9mhp-454m","path":"package-lock.json","line":null,"fingerprint":"tar@4.4.1 (npm):GHSA-r292-9mhp-454m"},{"rule_id":"osv/GHSA-r628-mhmh-qjhw","severity":"high","message":"tar@4.4.1 (npm) is affected by GHSA-r628-mhmh-qjhw","path":"package-lock.json","line":null,"fingerprint":"tar@4.4.1 (npm):GHSA-r628-mhmh-qjhw"},{"rule_id":"osv/GHSA-r6q2-hw4h-h46w","severity":"high","message":"tar@4.4.1 (npm) is affected by GHSA-r6q2-hw4h-h46w","path":"package-lock.json","line":null,"fingerprint":"tar@4.4.1 (npm):GHSA-r6q2-hw4h-h46w"},{"rule_id":"osv/GHSA-4wf5-vphf-c2xc","severity":"high","message":"terser@3.8.1 (npm) is affected by GHSA-4wf5-vphf-c2xc","path":"package-lock.json","line":null,"fingerprint":"terser@3.8.1 (npm):GHSA-4wf5-vphf-c2xc"},{"rule_id":"osv/GHSA-w5hq-g745-h8pq","severity":"high","message":"uuid@3.3.2 (npm) is affected by GHSA-w5hq-g745-h8pq","path":"package-lock.json","line":null,"fingerprint":"uuid@3.3.2 (npm):GHSA-w5hq-g745-h8pq"},{"rule_id":"osv/GHSA-2g4f-4pwh-qvx6","severity":"medium","message":"ajv@5.5.2 (npm) is affected by GHSA-2g4f-4pwh-qvx6","path":"package-lock.json","line":null,"fingerprint":"ajv@5.5.2 (npm):GHSA-2g4f-4pwh-qvx6"},{"rule_id":"osv/GHSA-v88g-cgmw-v5xw","severity":"medium","message":"ajv@5.5.2 (npm) is affected by GHSA-v88g-cgmw-v5xw","path":"package-lock.json","line":null,"fingerprint":"ajv@5.5.2 (npm):GHSA-v88g-cgmw-v5xw"},{"rule_id":"osv/GHSA-f886-m6hf-6m8v","severity":"medium","message":"brace-expansion@1.1.11 (npm) is affected by GHSA-f886-m6hf-6m8v","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.11 (npm):GHSA-f886-m6hf-6m8v"},{"rule_id":"osv/GHSA-q2hr-2g5m-vwhr","severity":"medium","message":"brace-expansion@1.1.11 (npm) is affected by GHSA-q2hr-2g5m-vwhr","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.11 (npm):GHSA-q2hr-2g5m-vwhr"},{"rule_id":"osv/GHSA-vcc3-ghjq-m6fr","severity":"medium","message":"decode-uri-component@0.2.0 (npm) is affected by GHSA-vcc3-ghjq-m6fr","path":"package-lock.json","line":null,"fingerprint":"decode-uri-component@0.2.0 (npm):GHSA-vcc3-ghjq-m6fr"},{"rule_id":"osv/MAL-2023-462","severity":"medium","message":"fsevents@1.2.4 (npm) is affected by MAL-2023-462","path":"package-lock.json","line":null,"fingerprint":"fsevents@1.2.4 (npm):MAL-2023-462"},{"rule_id":"osv/GHSA-2qvq-rjwj-gvw9","severity":"medium","message":"handlebars@4.0.11 (npm) is affected by GHSA-2qvq-rjwj-gvw9","path":"package-lock.json","line":null,"fingerprint":"handlebars@4.0.11 (npm):GHSA-2qvq-rjwj-gvw9"},{"rule_id":"osv/GHSA-f52g-6jhx-586p","severity":"medium","message":"handlebars@4.0.11 (npm) is affected by GHSA-f52g-6jhx-586p","path":"package-lock.json","line":null,"fingerprint":"handlebars@4.0.11 (npm):GHSA-f52g-6jhx-586p"},{"rule_id":"osv/GHSA-g9r4-xpmj-mj65","severity":"medium","message":"handlebars@4.0.11 (npm) is affected by GHSA-g9r4-xpmj-mj65","path":"package-lock.json","line":null,"fingerprint":"handlebars@4.0.11 (npm):GHSA-g9r4-xpmj-mj65"},{"rule_id":"osv/GHSA-q2c6-c6pm-g3gh","severity":"medium","message":"handlebars@4.0.11 (npm) is affected by GHSA-q2c6-c6pm-g3gh","path":"package-lock.json","line":null,"fingerprint":"handlebars@4.0.11 (npm):GHSA-q2c6-c6pm-g3gh"},{"rule_id":"osv/GHSA-xw65-4hp5-5hc7","severity":"medium","message":"handlebars@4.0.11 (npm) is affected by GHSA-xw65-4hp5-5hc7","path":"package-lock.json","line":null,"fingerprint":"handlebars@4.0.11 (npm):GHSA-xw65-4hp5-5hc7"},{"rule_id":"osv/GHSA-2pr6-76vf-7546","severity":"medium","message":"js-yaml@3.12.0 (npm) is affected by GHSA-2pr6-76vf-7546","path":"package-lock.json","line":null,"fingerprint":"js-yaml@3.12.0 (npm):GHSA-2pr6-76vf-7546"},{"rule_id":"osv/GHSA-8j8c-7jfh-h6hx","severity":"medium","message":"js-yaml@3.12.0 (npm) is affected by GHSA-8j8c-7jfh-h6hx","path":"package-lock.json","line":null,"fingerprint":"js-yaml@3.12.0 (npm):GHSA-8j8c-7jfh-h6hx"},{"rule_id":"osv/GHSA-h67p-54hq-rp68","severity":"medium","message":"js-yaml@3.12.0 (npm) is affected by GHSA-h67p-54hq-rp68","path":"package-lock.json","line":null,"fingerprint":"js-yaml@3.12.0 (npm):GHSA-h67p-54hq-rp68"},{"rule_id":"osv/GHSA-mh29-5h37-fv8m","severity":"medium","message":"js-yaml@3.12.0 (npm) is affected by GHSA-mh29-5h37-fv8m","path":"package-lock.json","line":null,"fingerprint":"js-yaml@3.12.0 (npm):GHSA-mh29-5h37-fv8m"},{"rule_id":"osv/GHSA-29mw-wpgm-hmr9","severity":"medium","message":"lodash@4.17.10 (npm) is affected by GHSA-29mw-wpgm-hmr9","path":"package-lock.json","line":null,"fingerprint":"lodash@4.17.10 (npm):GHSA-29mw-wpgm-hmr9"},{"rule_id":"osv/GHSA-4xc9-xhrj-v574","severity":"medium","message":"lodash@4.17.10 (npm) is affected by GHSA-4xc9-xhrj-v574","path":"package-lock.json","line":null,"fingerprint":"lodash@4.17.10 (npm):GHSA-4xc9-xhrj-v574"},{"rule_id":"osv/GHSA-x5rq-j2xg-h7qm","severity":"medium","message":"lodash@4.17.10 (npm) is affected by GHSA-x5rq-j2xg-h7qm","path":"package-lock.json","line":null,"fingerprint":"lodash@4.17.10 (npm):GHSA-x5rq-j2xg-h7qm"},{"rule_id":"osv/GHSA-xxjr-mmjv-4gpg","severity":"medium","message":"lodash@4.17.10 (npm) is affected by GHSA-xxjr-mmjv-4gpg","path":"package-lock.json","line":null,"fingerprint":"lodash@4.17.10 (npm):GHSA-xxjr-mmjv-4gpg"},{"rule_id":"osv/GHSA-29mw-wpgm-hmr9","severity":"medium","message":"lodash@4.17.9 (npm) is affected by GHSA-29mw-wpgm-hmr9","path":"package-lock.json","line":null,"fingerprint":"lodash@4.17.9 (npm):GHSA-29mw-wpgm-hmr9"},{"rule_id":"osv/GHSA-4xc9-xhrj-v574","severity":"medium","message":"lodash@4.17.9 (npm) is affected by GHSA-4xc9-xhrj-v574","path":"package-lock.json","line":null,"fingerprint":"lodash@4.17.9 (npm):GHSA-4xc9-xhrj-v574"},{"rule_id":"osv/GHSA-x5rq-j2xg-h7qm","severity":"medium","message":"lodash@4.17.9 (npm) is affected by GHSA-x5rq-j2xg-h7qm","path":"package-lock.json","line":null,"fingerprint":"lodash@4.17.9 (npm):GHSA-x5rq-j2xg-h7qm"},{"rule_id":"osv/GHSA-xxjr-mmjv-4gpg","severity":"medium","message":"lodash@4.17.9 (npm) is affected by GHSA-xxjr-mmjv-4gpg","path":"package-lock.json","line":null,"fingerprint":"lodash@4.17.9 (npm):GHSA-xxjr-mmjv-4gpg"},{"rule_id":"osv/GHSA-wx77-rp39-c6vg","severity":"medium","message":"markdown@0.5.0 (npm) is affected by GHSA-wx77-rp39-c6vg","path":"package-lock.json","line":null,"fingerprint":"markdown@0.5.0 (npm):GHSA-wx77-rp39-c6vg"},{"rule_id":"osv/GHSA-952p-6rrq-rcjv","severity":"medium","message":"micromatch@2.3.11 (npm) is affected by GHSA-952p-6rrq-rcjv","path":"package-lock.json","line":null,"fingerprint":"micromatch@2.3.11 (npm):GHSA-952p-6rrq-rcjv"},{"rule_id":"osv/GHSA-952p-6rrq-rcjv","severity":"medium","message":"micromatch@3.1.10 (npm) is affected by GHSA-952p-6rrq-rcjv","path":"package-lock.json","line":null,"fingerprint":"micromatch@3.1.10 (npm):GHSA-952p-6rrq-rcjv"},{"rule_id":"osv/GHSA-vh95-rmgr-6w4m","severity":"medium","message":"minimist@0.0.10 (npm) is affected by GHSA-vh95-rmgr-6w4m","path":"package-lock.json","line":null,"fingerprint":"minimist@0.0.10 (npm):GHSA-vh95-rmgr-6w4m"},{"rule_id":"osv/GHSA-vh95-rmgr-6w4m","severity":"medium","message":"minimist@0.0.8 (npm) is affected by GHSA-vh95-rmgr-6w4m","path":"package-lock.json","line":null,"fingerprint":"minimist@0.0.8 (npm):GHSA-vh95-rmgr-6w4m"},{"rule_id":"osv/GHSA-vh95-rmgr-6w4m","severity":"medium","message":"minimist@1.2.0 (npm) is affected by GHSA-vh95-rmgr-6w4m","path":"package-lock.json","line":null,"fingerprint":"minimist@1.2.0 (npm):GHSA-vh95-rmgr-6w4m"},{"rule_id":"osv/GHSA-hj48-42vr-x3v9","severity":"medium","message":"path-parse@1.0.5 (npm) is affected by GHSA-hj48-42vr-x3v9","path":"package-lock.json","line":null,"fingerprint":"path-parse@1.0.5 (npm):GHSA-hj48-42vr-x3v9"},{"rule_id":"osv/GHSA-4mjr-xmp4-gh2g","severity":"medium","message":"qs@6.5.2 (npm) is affected by GHSA-4mjr-xmp4-gh2g","path":"package-lock.json","line":null,"fingerprint":"qs@6.5.2 (npm):GHSA-4mjr-xmp4-gh2g"},{"rule_id":"osv/GHSA-6rw7-vpxm-498p","severity":"medium","message":"qs@6.5.2 (npm) is affected by GHSA-6rw7-vpxm-498p","path":"package-lock.json","line":null,"fingerprint":"qs@6.5.2 (npm):GHSA-6rw7-vpxm-498p"},{"rule_id":"osv/GHSA-p8p7-x288-28g6","severity":"medium","message":"request@2.87.0 (npm) is affected by GHSA-p8p7-x288-28g6","path":"package-lock.json","line":null,"fingerprint":"request@2.87.0 (npm):GHSA-p8p7-x288-28g6"},{"rule_id":"osv/GHSA-f5x3-32g6-xq36","severity":"medium","message":"tar@4.4.1 (npm) is affected by GHSA-f5x3-32g6-xq36","path":"package-lock.json","line":null,"fingerprint":"tar@4.4.1 (npm):GHSA-f5x3-32g6-xq36"},{"rule_id":"osv/GHSA-gvwx-54wh-qm9j","severity":"medium","message":"tar@4.4.1 (npm) is affected by GHSA-gvwx-54wh-qm9j","path":"package-lock.json","line":null,"fingerprint":"tar@4.4.1 (npm):GHSA-gvwx-54wh-qm9j"},{"rule_id":"osv/GHSA-vmf3-w455-68vh","severity":"medium","message":"tar@4.4.1 (npm) is affected by GHSA-vmf3-w455-68vh","path":"package-lock.json","line":null,"fingerprint":"tar@4.4.1 (npm):GHSA-vmf3-w455-68vh"},{"rule_id":"osv/GHSA-w8wr-v893-vjvp","severity":"medium","message":"tar@4.4.1 (npm) is affected by GHSA-w8wr-v893-vjvp","path":"package-lock.json","line":null,"fingerprint":"tar@4.4.1 (npm):GHSA-w8wr-v893-vjvp"},{"rule_id":"osv/GHSA-72xf-g2v4-qvf3","severity":"medium","message":"tough-cookie@2.3.4 (npm) is affected by GHSA-72xf-g2v4-qvf3","path":"package-lock.json","line":null,"fingerprint":"tough-cookie@2.3.4 (npm):GHSA-72xf-g2v4-qvf3"},{"rule_id":"osv/GHSA-v6h2-p8h4-qcjw","severity":"low","message":"brace-expansion@1.1.11 (npm) is affected by GHSA-v6h2-p8h4-qcjw","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.11 (npm):GHSA-v6h2-p8h4-qcjw"},{"rule_id":"osv/GHSA-c6rq-rjc2-86v2","severity":"low","message":"chownr@1.0.1 (npm) is affected by GHSA-c6rq-rjc2-86v2","path":"package-lock.json","line":null,"fingerprint":"chownr@1.0.1 (npm):GHSA-c6rq-rjc2-86v2"},{"rule_id":"osv/GHSA-73rr-hh4g-fpgx","severity":"low","message":"diff@3.5.0 (npm) is affected by GHSA-73rr-hh4g-fpgx","path":"package-lock.json","line":null,"fingerprint":"diff@3.5.0 (npm):GHSA-73rr-hh4g-fpgx"},{"rule_id":"osv/GHSA-442j-39wm-28r2","severity":"low","message":"handlebars@4.0.11 (npm) is affected by GHSA-442j-39wm-28r2","path":"package-lock.json","line":null,"fingerprint":"handlebars@4.0.11 (npm):GHSA-442j-39wm-28r2"},{"rule_id":"osv/GHSA-w7rc-rwvf-8q5r","severity":"low","message":"node-fetch@2.2.0 (npm) is affected by GHSA-w7rc-rwvf-8q5r","path":"package-lock.json","line":null,"fingerprint":"node-fetch@2.2.0 (npm):GHSA-w7rc-rwvf-8q5r"}],"evidence":[],"data":{"ecosystems":["npm"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.055,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":717.0,"function_nloc":11405.0,"mean_ccn":4.87,"p90_ccn":9.0,"complex_functions":42.0,"long_functions":21.0,"many_param_functions":0.0,"risky_nloc_share":0.5254},"findings":[],"evidence":[{"kind":"complex-function","description":"Velocity$1 in velocity.es5.js: complexity 96, 253 lines","ref":"velocity.es5.js","url":"https://github.com/julianshapiro/velocity/blob/767e35cac12120be526eef330e4d988b2c3cfc3c/velocity.es5.js#L4299","weight":1.0},{"kind":"complex-function","description":"Velocity$1 in velocity.js: complexity 96, 253 lines","ref":"velocity.js","url":"https://github.com/julianshapiro/velocity/blob/767e35cac12120be526eef330e4d988b2c3cfc3c/velocity.js#L4305","weight":1.0},{"kind":"complex-function","description":"Velocity in src/velocityFn.ts: complexity 88, 254 lines","ref":"src/velocityFn.ts","url":"https://github.com/julianshapiro/velocity/blob/767e35cac12120be526eef330e4d988b2c3cfc3c/src/velocityFn.ts#L71","weight":1.0},{"kind":"complex-function","description":"tick in src/Velocity/tick.ts: complexity 67, 166 lines","ref":"src/Velocity/tick.ts","url":"https://github.com/julianshapiro/velocity/blob/767e35cac12120be526eef330e4d988b2c3cfc3c/src/Velocity/tick.ts#L215","weight":1.0},{"kind":"complex-function","description":"tick in velocity.es5.js: complexity 67, 166 lines","ref":"velocity.es5.js","url":"https://github.com/julianshapiro/velocity/blob/767e35cac12120be526eef330e4d988b2c3cfc3c/velocity.es5.js#L2272","weight":1.0},{"kind":"complex-function","description":"tick in velocity.js: complexity 67, 166 lines","ref":"velocity.js","url":"https://github.com/julianshapiro/velocity/blob/767e35cac12120be526eef330e4d988b2c3cfc3c/velocity.js#L2278","weight":1.0},{"kind":"complex-function","description":"registerSequence in velocity.es5.js: complexity 60, 201 lines","ref":"velocity.es5.js","url":"https://github.com/julianshapiro/velocity/blob/767e35cac12120be526eef330e4d988b2c3cfc3c/velocity.es5.js#L4059","weight":1.0},{"kind":"complex-function","description":"registerSequence in velocity.js: complexity 60, 201 lines","ref":"velocity.js","url":"https://github.com/julianshapiro/velocity/blob/767e35cac12120be526eef330e4d988b2c3cfc3c/velocity.js#L4065","weight":1.0},{"kind":"complex-function","description":"findPattern in src/Velocity/tweens.ts: complexity 56, 151 lines","ref":"src/Velocity/tweens.ts","url":"https://github.com/julianshapiro/velocity/blob/767e35cac12120be526eef330e4d988b2c3cfc3c/src/Velocity/tweens.ts#L138","weight":0.9333333333333333},{"kind":"complex-function","description":"findPattern in velocity.es5.js: complexity 56, 147 lines","ref":"velocity.es5.js","url":"https://github.com/julianshapiro/velocity/blob/767e35cac12120be526eef330e4d988b2c3cfc3c/velocity.es5.js#L1785","weight":0.9333333333333333}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":13930.0,"duplicated_lines":8730.0,"duplicated_share":0.6267,"files":168.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: src-ui/bouncing_exits/bounceOutLeft.ts:12 and src-ui/bouncing_exits/bounceOutRight.ts:12","ref":"src-ui/bouncing_exits/bounceOutLeft.ts","url":"https://github.com/julianshapiro/velocity/blob/767e35cac12120be526eef330e4d988b2c3cfc3c/src-ui/bouncing_exits/bounceOutLeft.ts#L12","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src-ui/fading_exits/fadeOutDown.ts:12 and src-ui/fading_exits/fadeOutDownBig.ts:12","ref":"src-ui/fading_exits/fadeOutDown.ts","url":"https://github.com/julianshapiro/velocity/blob/767e35cac12120be526eef330e4d988b2c3cfc3c/src-ui/fading_exits/fadeOutDown.ts#L12","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src-ui/rotating_exits/rotateOutDownLeft.ts:12 and src-ui/rotating_exits/rotateOutUpLeft.ts:12","ref":"src-ui/rotating_exits/rotateOutDownLeft.ts","url":"https://github.com/julianshapiro/velocity/blob/767e35cac12120be526eef330e4d988b2c3cfc3c/src-ui/rotating_exits/rotateOutDownLeft.ts#L12","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src-ui/rotating_exits/rotateOutDownRight.ts:12 and src-ui/rotating_exits/rotateOutUpRight.ts:12","ref":"src-ui/rotating_exits/rotateOutDownRight.ts","url":"https://github.com/julianshapiro/velocity/blob/767e35cac12120be526eef330e4d988b2c3cfc3c/src-ui/rotating_exits/rotateOutDownRight.ts#L12","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src-ui/sliding_entrances/slideInDown.ts:15 and src-ui/sliding_entrances/slideInLeft.ts:15","ref":"src-ui/sliding_entrances/slideInDown.ts","url":"https://github.com/julianshapiro/velocity/blob/767e35cac12120be526eef330e4d988b2c3cfc3c/src-ui/sliding_entrances/slideInDown.ts#L15","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src-ui/sliding_exits/slideOutDown.ts:12 and src-ui/sliding_exits/slideOutLeft.ts:12","ref":"src-ui/sliding_exits/slideOutDown.ts","url":"https://github.com/julianshapiro/velocity/blob/767e35cac12120be526eef330e4d988b2c3cfc3c/src-ui/sliding_exits/slideOutDown.ts#L12","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/Velocity/actions/finish.ts:36 and velocity.es5.js:2506","ref":"src/Velocity/actions/finish.ts","url":"https://github.com/julianshapiro/velocity/blob/767e35cac12120be526eef330e4d988b2c3cfc3c/src/Velocity/actions/finish.ts#L36","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/Velocity/actions/finish.ts:96 and src/Velocity/actions/stop.ts:61","ref":"src/Velocity/actions/finish.ts","url":"https://github.com/julianshapiro/velocity/blob/767e35cac12120be526eef330e4d988b2c3cfc3c/src/Velocity/actions/finish.ts#L96","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/Velocity/actions/option.ts:52 and velocity.es5.js:2630","ref":"src/Velocity/actions/option.ts","url":"https://github.com/julianshapiro/velocity/blob/767e35cac12120be526eef330e4d988b2c3cfc3c/src/Velocity/actions/option.ts#L52","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/Velocity/actions/pauseResume.ts:51 and velocity.es5.js:2845","ref":"src/Velocity/actions/pauseResume.ts","url":"https://github.com/julianshapiro/velocity/blob/767e35cac12120be526eef330e4d988b2c3cfc3c/src/Velocity/actions/pauseResume.ts#L51","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":5.0,"weighted_findings":3.5,"scanned_lines":20801.0,"category:correctness":5.0},"findings":[{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"src/Velocity/tick.ts","line":411,"fingerprint":"javascript.lang.correctness.no-stringify-keys:src/Velocity/tick.ts:411"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"velocity.es5.js","line":2456,"fingerprint":"javascript.lang.correctness.no-stringify-keys:velocity.es5.js:2456"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"velocity.js","line":2462,"fingerprint":"javascript.lang.correctness.no-stringify-keys:velocity.js:2462"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/Velocity/actions/tween.ts","line":37,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/Velocity/actions/tween.ts:37"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/Velocity/actions/tween.ts","line":37,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/Velocity/actions/tween.ts:37"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":0.5239,"check:ci_present":0.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":0.8319,"test_lines":5449.0,"source_lines":20801.0,"test_ratio":0.262,"ci_files":0.0,"cochange_share":0.208,"cochange_commits":226.0},"findings":[],"evidence":[],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":1.0,"check:changelog":1.0,"readme_lines":55.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE.md","ref":"LICENSE.md","url":null,"weight":0.0},{"kind":"docs","description":"CONTRIBUTING.md","ref":"CONTRIBUTING.md","url":null,"weight":0.0},{"kind":"docs","description":"CHANGELOG.md","ref":"CHANGELOG.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":0.0,"check:low_escape_density":0.0,"escapes":103.0,"escapes_per_kloc":10.776},"findings":[],"evidence":[],"data":{},"error":null}],"flags":[]}