Skip to content

[Snyk] Upgrade @contentstack/live-preview-utils from 4.1.2 to 4.2.0 - #73

Open
RohitKini wants to merge 1 commit into
mainfrom
snyk-upgrade-39a530358a518fb1c1e2744035b576a0
Open

[Snyk] Upgrade @contentstack/live-preview-utils from 4.1.2 to 4.2.0#73
RohitKini wants to merge 1 commit into
mainfrom
snyk-upgrade-39a530358a518fb1c1e2744035b576a0

Conversation

@RohitKini

Copy link
Copy Markdown
Contributor

snyk-top-banner

Snyk has created this PR to upgrade @contentstack/live-preview-utils from 4.1.2 to 4.2.0.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.


  • The recommended version is 2 versions ahead of your current version.

  • The recommended version was released a month ago.

Release notes
Package name: @contentstack/live-preview-utils
  • 4.2.0 - 2026-01-09

    What's Changed

    New Contributors

    Full Changelog: v4.1.3...v4.2.0

  • 4.1.3 - 2025-12-10

    General Changes

    • Migration from vitest: 2.x.x to vitest: 3.x.x (Karan Gandhi - #532)

    New Features

    • feat: added resolved variants permission handling logic (csAyushDubey - 15c8f04)
    • feat: added variant order handling logic (csAyushDubey - 47a6f29)

    Fixes

    • fix: handle invalid data-cslp attributes across multiple components to prevent errors (hiteshshetty-dev - ba91cb0)
    • fix: partial state clear when DOM is not visible during mutuation and resize checks (hiteshshetty-dev - 74e6e5b)
    • fix: handle empty data-cslp attributes in getEntryIdentifiersInCurrentPage function (hiteshshetty-dev - 34b7e42)
    • fix: added removal for class (csAyushDubey - f3d83b7)

    Chores And Housekeeping

    • chore: add TODOs for overlay and toolbar position logic to consolidate with existing methods (hiteshshetty-dev - 48e6c69)

    Changes to Test Assests

    • test: added test cases (csAyushDubey - 1ba0b65)
    • test: add additional header element to getEntryIdentifiersInCurrentPage test case (hiteshshetty-dev - b1da67e)

    Full Changelog: v4.1.2...v4.1.3

  • 4.1.2 - 2025-11-13

    What's Changed

    Bug fixes:

    • Toolbar and outline improper display when user moves out of canvas in VB
    • Upgrades preact and preact/signal to avoid global sCU issue
    • Adds fallback font-family for VB DOMs

    Full Changelog: v4.1.1...v4.1.2

from @contentstack/live-preview-utils GitHub release notes

Important

  • Check the changes in this PR to ensure they won't cause issues with your project.
  • This PR was automatically created by Snyk using the credentials of a real user.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

Snyk has created this PR to upgrade @contentstack/live-preview-utils from 4.1.2 to 4.2.0.

See this package in npm:
@contentstack/live-preview-utils

See this project in Snyk:
https://app.snyk.io/org/rohitkini/project/***REDACTED***?utm_source=github&utm_medium=referral&page=upgrade-pr
@RohitKini
RohitKini requested a review from a team as a code owner February 6, 2026 08:52
@priyadarshan-khadtale-cstk
priyadarshan-khadtale-cstk force-pushed the snyk-upgrade-39a530358a518fb1c1e2744035b576a0 branch from f53f80a to 8a71dc9 Compare August 13, 2026 09:55
@snyk-io

snyk-io Bot commented Aug 13, 2026

Copy link
Copy Markdown

Snyk checks have passed. No issues have been found so far.

Status Scan Engine Critical High Medium Low Total (0)
Open Source Security 0 0 0 0 0 issues
Licenses 0 0 0 0 0 issues
Code Security 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

@github-actions

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type Count (with fixes) Without fixes Threshold Result
🔴 Critical Severity 1 0 10 ✅ Passed
🟠 High Severity 30 0 25 ❌ Failed
🟡 Medium Severity 39 0 500 ✅ Passed
🔵 Low Severity 7 0 1000 ✅ Passed

⏱️ SLA Breach Summary

⚠️ Warning: The following vulnerabilities have exceeded their SLA thresholds (days since publication).

Severity Breaches (with fixes) Breaches (no fixes) SLA Threshold (with/no fixes) Status
🔴 Critical 1 0 15 / 30 days ❌ Failed
🟠 High 20 0 30 / 120 days ❌ Failed
🟡 Medium 20 0 90 / 365 days ❌ Failed
🔵 Low 0 0 180 / 365 days ✅ Passed

🔴 Critical Severity - SLA Breached Issues (with fixes)

Showing 1 issue(s) that have exceeded the 15-day SLA threshold:

  1. CRLF Injection
    • ID: SNYK-JS-UNDICI-17372658
    • Package: undici@7.16.0
    • Published: 55 days ago (SLA: 15 days)
    • CVSS Score: 9.2
    • CVE: CVE-2026-9679

🟠 High Severity - SLA Breached Issues (with fixes)

Showing 20 issue(s) that have exceeded the 30-day SLA threshold:

  1. Allocation of Resources Without Limits or Throttling

    • ID: SNYK-JS-NEXT-15104645
    • Package: next@16.0.10
    • Published: 197 days ago (SLA: 30 days)
    • CVSS Score: 8.2
    • CVE: CVE-2025-59471
  2. Allocation of Resources Without Limits or Throttling

    • ID: SNYK-JS-NEXT-15105315
    • Package: next@16.0.10
    • Published: 197 days ago (SLA: 30 days)
    • CVSS Score: 8.2
    • CVE: CVE-2025-59472
  3. Allocation of Resources Without Limits or Throttling

    • ID: SNYK-JS-QS-15268416
    • Package: qs@6.14.1
    • Published: 182 days ago (SLA: 30 days)
    • CVSS Score: 8.2
    • CVE: CVE-2026-2391
  4. Uncaught Exception

    • ID: SNYK-JS-UNDICI-15518064
    • Package: undici@7.16.0
    • Published: 153 days ago (SLA: 30 days)
    • CVSS Score: 8.7
    • CVE: CVE-2026-1528
  5. Improper Handling of Highly Compressed Data (Data Amplification)

    • ID: SNYK-JS-UNDICI-15518068
    • Package: undici@7.16.0
    • Published: 153 days ago (SLA: 30 days)
    • CVSS Score: 8.7
    • CVE: CVE-2026-1526
  6. Uncaught Exception

    • ID: SNYK-JS-UNDICI-15518070
    • Package: undici@7.16.0
    • Published: 153 days ago (SLA: 30 days)
    • CVSS Score: 8.7
    • CVE: CVE-2026-2229
  7. Arbitrary Code Injection

    • ID: SNYK-JS-LODASHES-15869627
    • Package: lodash-es@4.17.21
    • Published: 133 days ago (SLA: 30 days)
    • CVSS Score: 8.6
    • CVE: CVE-2026-4800
  8. Allocation of Resources Without Limits or Throttling

    • ID: SNYK-JS-NEXT-15921797
    • Package: next@16.0.10
    • Published: 128 days ago (SLA: 30 days)
    • CVSS Score: 8.7
    • CVE: CVE-2026-23864
  9. Allocation of Resources Without Limits or Throttling

    • ID: SNYK-JS-NEXT-15954202
    • Package: next@16.0.10
    • Published: 125 days ago (SLA: 30 days)
    • CVSS Score: 8.7
    • CVE: CVE-2026-23869
  10. Allocation of Resources Without Limits or Throttling

  • ID: SNYK-JS-NEXT-16638674
  • Package: next@16.0.10
  • Published: 93 days ago (SLA: 30 days)
  • CVSS Score: 8.7
  • CVE: CVE-2026-23870
  1. Allocation of Resources Without Limits or Throttling
  • ID: SNYK-JS-NEXT-16638678
  • Package: next@16.0.10
  • Published: 93 days ago (SLA: 30 days)
  • CVSS Score: 8.7
  • CVE: CVE-2026-44579
  1. Authentication Bypass Using an Alternate Path or Channel
  • ID: SNYK-JS-NEXT-16638679
  • Package: next@16.0.10
  • Published: 93 days ago (SLA: 30 days)
  • CVSS Score: 8.6
  • CVE: CVE-2026-44574
  1. Allocation of Resources Without Limits or Throttling
  • ID: SNYK-JS-NEXT-16638680
  • Package: next@16.0.10
  • Published: 93 days ago (SLA: 30 days)
  • CVSS Score: 8.2
  • CVE: CVE-2026-44577
  1. Server-side Request Forgery (SSRF)
  • ID: SNYK-JS-NEXT-16638682
  • Package: next@16.0.10
  • Published: 93 days ago (SLA: 30 days)
  • CVSS Score: 7.7
  • CVE: CVE-2026-44578
  1. Incorrect Authorization
  • ID: SNYK-JS-NEXT-16638683
  • Package: next@16.0.10
  • Published: 93 days ago (SLA: 30 days)
  • CVSS Score: 8.2
  • CVE: CVE-2026-44573
  1. Authentication Bypass Using an Alternate Path or Channel
  • ID: SNYK-JS-NEXT-16638685
  • Package: next@16.0.10
  • Published: 93 days ago (SLA: 30 days)
  • CVSS Score: 8.7
  • CVE: CVE-2026-44575
  1. Authentication Bypass Using an Alternate Path or Channel
  • ID: SNYK-JS-NEXT-16638686
  • Package: next@16.0.10
  • Published: 93 days ago (SLA: 30 days)
  • CVSS Score: 8.7
  • CVE: CVE-2026-45109
  1. Use of Cache Containing Sensitive Information
  • ID: SNYK-JS-UNDICI-17372697
  • Package: undici@7.16.0
  • Published: 55 days ago (SLA: 30 days)
  • CVSS Score: 8.9
  • CVE: CVE-2026-9678
  1. Allocation of Resources Without Limits or Throttling
  • ID: SNYK-JS-UNDICI-17372754
  • Package: undici@7.16.0
  • Published: 55 days ago (SLA: 30 days)
  • CVSS Score: 8.7
  • CVE: CVE-2026-12151
  1. Permissive List of Allowed Inputs
  • ID: SNYK-JS-UNDICI-17372758
  • Package: undici@7.16.0
  • Published: 55 days ago (SLA: 30 days)
  • CVSS Score: 8.3
  • CVE: CVE-2026-11525

🟡 Medium Severity - SLA Breached Issues (with fixes)

Showing 20 issue(s) that have exceeded the 90-day SLA threshold:

  1. Allocation of Resources Without Limits or Throttling

    • ID: SNYK-JS-UNDICI-14943963
    • Package: undici@7.16.0
    • Published: 209 days ago (SLA: 90 days)
    • CVSS Score: 5.3
    • CVE: CVE-2026-22036
  2. Prototype Pollution

    • ID: SNYK-JS-LODASHES-15053836
    • Package: lodash-es@4.17.21
    • Published: 203 days ago (SLA: 90 days)
    • CVSS Score: 6.9
    • CVE: CVE-2025-13465
  3. Cross-site Scripting (XSS)

    • ID: SNYK-JS-DOMPURIFY-15371376
    • Package: dompurify@3.3.0
    • Published: 161 days ago (SLA: 90 days)
    • CVSS Score: 5.1
    • CVE: CVE-2026-0540
  4. HTTP Request Smuggling

    • ID: SNYK-JS-UNDICI-15518061
    • Package: undici@7.16.0
    • Published: 153 days ago (SLA: 90 days)
    • CVSS Score: 6.9
    • CVE: CVE-2026-1525
  5. CRLF Injection

    • ID: SNYK-JS-UNDICI-15518072
    • Package: undici@7.16.0
    • Published: 153 days ago (SLA: 90 days)
    • CVSS Score: 5.1
    • CVE: CVE-2026-1527
  6. Allocation of Resources Without Limits or Throttling

    • ID: SNYK-JS-NEXT-15674556
    • Package: next@16.0.10
    • Published: 148 days ago (SLA: 90 days)
    • CVSS Score: 6.9
    • CVE: CVE-2026-27980
  7. Cross-site Request Forgery (CSRF)

    • ID: SNYK-JS-NEXT-15674557
    • Package: next@16.0.10
    • Published: 148 days ago (SLA: 90 days)
    • CVSS Score: 5.3
    • CVE: CVE-2026-27978
  8. HTTP Request Smuggling

    • ID: SNYK-JS-NEXT-15674558
    • Package: next@16.0.10
    • Published: 148 days ago (SLA: 90 days)
    • CVSS Score: 6.3
    • CVE: CVE-2026-29057
  9. Cross-site Scripting (XSS)

    • ID: SNYK-JS-DOMPURIFY-15810938
    • Package: dompurify@3.3.0
    • Published: 136 days ago (SLA: 90 days)
    • CVSS Score: 5.3
    • CVE: CVE-2026-65914
  10. Prototype Pollution

  • ID: SNYK-JS-LODASHES-15869621
  • Package: lodash-es@4.17.21
  • Published: 133 days ago (SLA: 90 days)
  • CVSS Score: 6.9
  • CVE: CVE-2026-2950
  1. Prototype Pollution
  • ID: SNYK-JS-DOMPURIFY-15874903
  • Package: dompurify@3.3.0
  • Published: 132 days ago (SLA: 90 days)
  • CVSS Score: 5.3
  • CVE: CVE-2026-65913
  1. Permissive List of Allowed Inputs
  • ID: SNYK-JS-DOMPURIFY-15874905
  • Package: dompurify@3.3.0
  • Published: 132 days ago (SLA: 90 days)
  • CVSS Score: 5.3
  • CVE: CVE-2026-65912
  1. Operator Precedence Logic Error
  • ID: SNYK-JS-DOMPURIFY-16078387
  • Package: dompurify@3.3.0
  • Published: 119 days ago (SLA: 90 days)
  • CVSS Score: 6.3
  • CVE: CVE-2026-41240
  1. Cross-site Scripting (XSS)
  • ID: SNYK-JS-DOMPURIFY-16132234
  • Package: dompurify@3.3.0
  • Published: 112 days ago (SLA: 90 days)
  • CVSS Score: 5.1
  • CVE: CVE-2026-41238
  1. Improper Validation of Specified Index, Position, or Offset in Input
  • ID: SNYK-JS-UUID-16133035
  • Package: uuid@11.1.0
  • Published: 112 days ago (SLA: 90 days)
  • CVSS Score: 6.3
  • CVE: CVE-2026-41907
  1. Cross-site Scripting (XSS)
  • ID: SNYK-JS-POSTCSS-16189065
  • Package: postcss@8.4.31
  • Published: 111 days ago (SLA: 90 days)
  • CVSS Score: 5.3
  • CVE: CVE-2026-41305
  1. Acceptance of Extraneous Untrusted Data With Trusted Data
  • ID: SNYK-JS-NEXT-16638675
  • Package: next@16.0.10
  • Published: 93 days ago (SLA: 90 days)
  • CVSS Score: 6.3
  • CVE: CVE-2026-44572
  1. Interpretation Conflict
  • ID: SNYK-JS-NEXT-16638676
  • Package: next@16.0.10
  • Published: 93 days ago (SLA: 90 days)
  • CVSS Score: 6.3
  • CVE: CVE-2026-44576
  1. Use of Weak Hash
  • ID: SNYK-JS-NEXT-16638677
  • Package: next@16.0.10
  • Published: 93 days ago (SLA: 90 days)
  • CVSS Score: 6.3
  • CVE: CVE-2026-44582
  1. Cross-site Scripting (XSS)
  • ID: SNYK-JS-NEXT-16638681
  • Package: next@16.0.10
  • Published: 93 days ago (SLA: 90 days)
  • CVSS Score: 5.1
  • CVE: CVE-2026-44580

❌ BUILD FAILED - Security checks failed

Please review and fix the security vulnerabilities before merging.

1 similar comment
@github-actions

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type Count (with fixes) Without fixes Threshold Result
🔴 Critical Severity 1 0 10 ✅ Passed
🟠 High Severity 30 0 25 ❌ Failed
🟡 Medium Severity 39 0 500 ✅ Passed
🔵 Low Severity 7 0 1000 ✅ Passed

⏱️ SLA Breach Summary

⚠️ Warning: The following vulnerabilities have exceeded their SLA thresholds (days since publication).

Severity Breaches (with fixes) Breaches (no fixes) SLA Threshold (with/no fixes) Status
🔴 Critical 1 0 15 / 30 days ❌ Failed
🟠 High 20 0 30 / 120 days ❌ Failed
🟡 Medium 20 0 90 / 365 days ❌ Failed
🔵 Low 0 0 180 / 365 days ✅ Passed

🔴 Critical Severity - SLA Breached Issues (with fixes)

Showing 1 issue(s) that have exceeded the 15-day SLA threshold:

  1. CRLF Injection
    • ID: SNYK-JS-UNDICI-17372658
    • Package: undici@7.16.0
    • Published: 55 days ago (SLA: 15 days)
    • CVSS Score: 9.2
    • CVE: CVE-2026-9679

🟠 High Severity - SLA Breached Issues (with fixes)

Showing 20 issue(s) that have exceeded the 30-day SLA threshold:

  1. Allocation of Resources Without Limits or Throttling

    • ID: SNYK-JS-NEXT-15104645
    • Package: next@16.0.10
    • Published: 197 days ago (SLA: 30 days)
    • CVSS Score: 8.2
    • CVE: CVE-2025-59471
  2. Allocation of Resources Without Limits or Throttling

    • ID: SNYK-JS-NEXT-15105315
    • Package: next@16.0.10
    • Published: 197 days ago (SLA: 30 days)
    • CVSS Score: 8.2
    • CVE: CVE-2025-59472
  3. Allocation of Resources Without Limits or Throttling

    • ID: SNYK-JS-QS-15268416
    • Package: qs@6.14.1
    • Published: 182 days ago (SLA: 30 days)
    • CVSS Score: 8.2
    • CVE: CVE-2026-2391
  4. Uncaught Exception

    • ID: SNYK-JS-UNDICI-15518064
    • Package: undici@7.16.0
    • Published: 153 days ago (SLA: 30 days)
    • CVSS Score: 8.7
    • CVE: CVE-2026-1528
  5. Improper Handling of Highly Compressed Data (Data Amplification)

    • ID: SNYK-JS-UNDICI-15518068
    • Package: undici@7.16.0
    • Published: 153 days ago (SLA: 30 days)
    • CVSS Score: 8.7
    • CVE: CVE-2026-1526
  6. Uncaught Exception

    • ID: SNYK-JS-UNDICI-15518070
    • Package: undici@7.16.0
    • Published: 153 days ago (SLA: 30 days)
    • CVSS Score: 8.7
    • CVE: CVE-2026-2229
  7. Arbitrary Code Injection

    • ID: SNYK-JS-LODASHES-15869627
    • Package: lodash-es@4.17.21
    • Published: 133 days ago (SLA: 30 days)
    • CVSS Score: 8.6
    • CVE: CVE-2026-4800
  8. Allocation of Resources Without Limits or Throttling

    • ID: SNYK-JS-NEXT-15921797
    • Package: next@16.0.10
    • Published: 128 days ago (SLA: 30 days)
    • CVSS Score: 8.7
    • CVE: CVE-2026-23864
  9. Allocation of Resources Without Limits or Throttling

    • ID: SNYK-JS-NEXT-15954202
    • Package: next@16.0.10
    • Published: 125 days ago (SLA: 30 days)
    • CVSS Score: 8.7
    • CVE: CVE-2026-23869
  10. Allocation of Resources Without Limits or Throttling

  • ID: SNYK-JS-NEXT-16638674
  • Package: next@16.0.10
  • Published: 93 days ago (SLA: 30 days)
  • CVSS Score: 8.7
  • CVE: CVE-2026-23870
  1. Allocation of Resources Without Limits or Throttling
  • ID: SNYK-JS-NEXT-16638678
  • Package: next@16.0.10
  • Published: 93 days ago (SLA: 30 days)
  • CVSS Score: 8.7
  • CVE: CVE-2026-44579
  1. Authentication Bypass Using an Alternate Path or Channel
  • ID: SNYK-JS-NEXT-16638679
  • Package: next@16.0.10
  • Published: 93 days ago (SLA: 30 days)
  • CVSS Score: 8.6
  • CVE: CVE-2026-44574
  1. Allocation of Resources Without Limits or Throttling
  • ID: SNYK-JS-NEXT-16638680
  • Package: next@16.0.10
  • Published: 93 days ago (SLA: 30 days)
  • CVSS Score: 8.2
  • CVE: CVE-2026-44577
  1. Server-side Request Forgery (SSRF)
  • ID: SNYK-JS-NEXT-16638682
  • Package: next@16.0.10
  • Published: 93 days ago (SLA: 30 days)
  • CVSS Score: 7.7
  • CVE: CVE-2026-44578
  1. Incorrect Authorization
  • ID: SNYK-JS-NEXT-16638683
  • Package: next@16.0.10
  • Published: 93 days ago (SLA: 30 days)
  • CVSS Score: 8.2
  • CVE: CVE-2026-44573
  1. Authentication Bypass Using an Alternate Path or Channel
  • ID: SNYK-JS-NEXT-16638685
  • Package: next@16.0.10
  • Published: 93 days ago (SLA: 30 days)
  • CVSS Score: 8.7
  • CVE: CVE-2026-44575
  1. Authentication Bypass Using an Alternate Path or Channel
  • ID: SNYK-JS-NEXT-16638686
  • Package: next@16.0.10
  • Published: 93 days ago (SLA: 30 days)
  • CVSS Score: 8.7
  • CVE: CVE-2026-45109
  1. Use of Cache Containing Sensitive Information
  • ID: SNYK-JS-UNDICI-17372697
  • Package: undici@7.16.0
  • Published: 55 days ago (SLA: 30 days)
  • CVSS Score: 8.9
  • CVE: CVE-2026-9678
  1. Allocation of Resources Without Limits or Throttling
  • ID: SNYK-JS-UNDICI-17372754
  • Package: undici@7.16.0
  • Published: 55 days ago (SLA: 30 days)
  • CVSS Score: 8.7
  • CVE: CVE-2026-12151
  1. Permissive List of Allowed Inputs
  • ID: SNYK-JS-UNDICI-17372758
  • Package: undici@7.16.0
  • Published: 55 days ago (SLA: 30 days)
  • CVSS Score: 8.3
  • CVE: CVE-2026-11525

🟡 Medium Severity - SLA Breached Issues (with fixes)

Showing 20 issue(s) that have exceeded the 90-day SLA threshold:

  1. Allocation of Resources Without Limits or Throttling

    • ID: SNYK-JS-UNDICI-14943963
    • Package: undici@7.16.0
    • Published: 209 days ago (SLA: 90 days)
    • CVSS Score: 5.3
    • CVE: CVE-2026-22036
  2. Prototype Pollution

    • ID: SNYK-JS-LODASHES-15053836
    • Package: lodash-es@4.17.21
    • Published: 203 days ago (SLA: 90 days)
    • CVSS Score: 6.9
    • CVE: CVE-2025-13465
  3. Cross-site Scripting (XSS)

    • ID: SNYK-JS-DOMPURIFY-15371376
    • Package: dompurify@3.3.0
    • Published: 161 days ago (SLA: 90 days)
    • CVSS Score: 5.1
    • CVE: CVE-2026-0540
  4. HTTP Request Smuggling

    • ID: SNYK-JS-UNDICI-15518061
    • Package: undici@7.16.0
    • Published: 153 days ago (SLA: 90 days)
    • CVSS Score: 6.9
    • CVE: CVE-2026-1525
  5. CRLF Injection

    • ID: SNYK-JS-UNDICI-15518072
    • Package: undici@7.16.0
    • Published: 153 days ago (SLA: 90 days)
    • CVSS Score: 5.1
    • CVE: CVE-2026-1527
  6. Allocation of Resources Without Limits or Throttling

    • ID: SNYK-JS-NEXT-15674556
    • Package: next@16.0.10
    • Published: 148 days ago (SLA: 90 days)
    • CVSS Score: 6.9
    • CVE: CVE-2026-27980
  7. Cross-site Request Forgery (CSRF)

    • ID: SNYK-JS-NEXT-15674557
    • Package: next@16.0.10
    • Published: 148 days ago (SLA: 90 days)
    • CVSS Score: 5.3
    • CVE: CVE-2026-27978
  8. HTTP Request Smuggling

    • ID: SNYK-JS-NEXT-15674558
    • Package: next@16.0.10
    • Published: 148 days ago (SLA: 90 days)
    • CVSS Score: 6.3
    • CVE: CVE-2026-29057
  9. Cross-site Scripting (XSS)

    • ID: SNYK-JS-DOMPURIFY-15810938
    • Package: dompurify@3.3.0
    • Published: 136 days ago (SLA: 90 days)
    • CVSS Score: 5.3
    • CVE: CVE-2026-65914
  10. Prototype Pollution

  • ID: SNYK-JS-LODASHES-15869621
  • Package: lodash-es@4.17.21
  • Published: 133 days ago (SLA: 90 days)
  • CVSS Score: 6.9
  • CVE: CVE-2026-2950
  1. Prototype Pollution
  • ID: SNYK-JS-DOMPURIFY-15874903
  • Package: dompurify@3.3.0
  • Published: 132 days ago (SLA: 90 days)
  • CVSS Score: 5.3
  • CVE: CVE-2026-65913
  1. Permissive List of Allowed Inputs
  • ID: SNYK-JS-DOMPURIFY-15874905
  • Package: dompurify@3.3.0
  • Published: 132 days ago (SLA: 90 days)
  • CVSS Score: 5.3
  • CVE: CVE-2026-65912
  1. Operator Precedence Logic Error
  • ID: SNYK-JS-DOMPURIFY-16078387
  • Package: dompurify@3.3.0
  • Published: 119 days ago (SLA: 90 days)
  • CVSS Score: 6.3
  • CVE: CVE-2026-41240
  1. Cross-site Scripting (XSS)
  • ID: SNYK-JS-DOMPURIFY-16132234
  • Package: dompurify@3.3.0
  • Published: 112 days ago (SLA: 90 days)
  • CVSS Score: 5.1
  • CVE: CVE-2026-41238
  1. Improper Validation of Specified Index, Position, or Offset in Input
  • ID: SNYK-JS-UUID-16133035
  • Package: uuid@11.1.0
  • Published: 112 days ago (SLA: 90 days)
  • CVSS Score: 6.3
  • CVE: CVE-2026-41907
  1. Cross-site Scripting (XSS)
  • ID: SNYK-JS-POSTCSS-16189065
  • Package: postcss@8.4.31
  • Published: 111 days ago (SLA: 90 days)
  • CVSS Score: 5.3
  • CVE: CVE-2026-41305
  1. Acceptance of Extraneous Untrusted Data With Trusted Data
  • ID: SNYK-JS-NEXT-16638675
  • Package: next@16.0.10
  • Published: 93 days ago (SLA: 90 days)
  • CVSS Score: 6.3
  • CVE: CVE-2026-44572
  1. Interpretation Conflict
  • ID: SNYK-JS-NEXT-16638676
  • Package: next@16.0.10
  • Published: 93 days ago (SLA: 90 days)
  • CVSS Score: 6.3
  • CVE: CVE-2026-44576
  1. Use of Weak Hash
  • ID: SNYK-JS-NEXT-16638677
  • Package: next@16.0.10
  • Published: 93 days ago (SLA: 90 days)
  • CVSS Score: 6.3
  • CVE: CVE-2026-44582
  1. Cross-site Scripting (XSS)
  • ID: SNYK-JS-NEXT-16638681
  • Package: next@16.0.10
  • Published: 93 days ago (SLA: 90 days)
  • CVSS Score: 5.1
  • CVE: CVE-2026-44580

❌ BUILD FAILED - Security checks failed

Please review and fix the security vulnerabilities before merging.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants