thanhnvandClaude Opus 4.8
36a4812ef3
Standard production layout: the OKR app (was nested under AINative_OKR_CASAN5/) is now
the repository root. No more wrapper directory.
- Promote AINative_OKR_CASAN5/* -> repo root (backend/ frontend/ packages/ apps/
.specify/ docs/ infra/ nginx/ scripts/ + configs). Merge tool dirs: .gitea (kept the
active deploy ci.yml, added harness-ci.yml + runbooks), .claude (agents/commands +
launch.json), .github moved up.
- Remove redundant: 00_SUBMISSION_PACKAGE, scattered root notes (FPT_CASAN_Full.md,
tu-tuong-casan.md, casan-tu-sinh..., casan_harness_assessment.md, source-review...,
README_CASAN5_REFINED.md), casan-next-plans/ and optimize-docs/ (competition/planning
artifacts — roadmap + design history preserved in git log / commit messages).
- Update all references to the old layout:
- .gitea/workflows/{ci,harness-ci}.yml, .github/workflows/{ci,deploy}.yml:
working-directory .; drop AINative_OKR_CASAN5/ prefix; .specify/{tests,scripts}
-> packages/casan-harness/... (.specify/logs state kept)
- .claude/launch.json, .gitea/*-runbook.md: path prefixes
- CLAUDE.md, README.md: docs/input -> apps/okr/domain/input
- policy-bundle.yaml: 8 policy paths -> packages/casan-harness/...; manifest re-signed
- secrets-scan.sh: fixture excludes -> new package/domain paths.
Full gate from the new root: PASS=64 FAIL=0 SKIP=3.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
570 lines
15 KiB
JSON
570 lines
15 KiB
JSON
{
|
|
"auditReportVersion": 2,
|
|
"vulnerabilities": {
|
|
"@mapbox/node-pre-gyp": {
|
|
"name": "@mapbox/node-pre-gyp",
|
|
"severity": "high",
|
|
"isDirect": false,
|
|
"via": [
|
|
"tar"
|
|
],
|
|
"effects": [],
|
|
"range": "<=1.0.11",
|
|
"nodes": [
|
|
"node_modules/@mapbox/node-pre-gyp"
|
|
],
|
|
"fixAvailable": true
|
|
},
|
|
"@nestjs/common": {
|
|
"name": "@nestjs/common",
|
|
"severity": "moderate",
|
|
"isDirect": true,
|
|
"via": [
|
|
"file-type"
|
|
],
|
|
"effects": [],
|
|
"range": "10.4.16 - 10.4.22 || 11.0.16 - 11.1.16 || 12.0.0-alpha.0 - 12.0.0-alpha.2",
|
|
"nodes": [
|
|
"node_modules/@nestjs/common"
|
|
],
|
|
"fixAvailable": {
|
|
"name": "@nestjs/common",
|
|
"version": "11.1.27",
|
|
"isSemVerMajor": true
|
|
}
|
|
},
|
|
"@nestjs/core": {
|
|
"name": "@nestjs/core",
|
|
"severity": "moderate",
|
|
"isDirect": true,
|
|
"via": [
|
|
{
|
|
"source": 1117063,
|
|
"name": "@nestjs/core",
|
|
"dependency": "@nestjs/core",
|
|
"title": "@nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')",
|
|
"url": "https://github.com/advisories/GHSA-36xv-jgw5-4q75",
|
|
"severity": "moderate",
|
|
"cwe": [
|
|
"CWE-74"
|
|
],
|
|
"cvss": {
|
|
"score": 6.1,
|
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:L"
|
|
},
|
|
"range": "<=11.1.17"
|
|
}
|
|
],
|
|
"effects": [],
|
|
"range": "<=11.1.17",
|
|
"nodes": [
|
|
"node_modules/@nestjs/core"
|
|
],
|
|
"fixAvailable": {
|
|
"name": "@nestjs/core",
|
|
"version": "11.1.27",
|
|
"isSemVerMajor": true
|
|
}
|
|
},
|
|
"@nestjs/platform-express": {
|
|
"name": "@nestjs/platform-express",
|
|
"severity": "high",
|
|
"isDirect": true,
|
|
"via": [
|
|
"body-parser",
|
|
"express",
|
|
"multer"
|
|
],
|
|
"effects": [],
|
|
"range": "<=11.1.14 || 12.0.0-alpha.0 - 12.0.0-alpha.2",
|
|
"nodes": [
|
|
"node_modules/@nestjs/platform-express"
|
|
],
|
|
"fixAvailable": {
|
|
"name": "@nestjs/platform-express",
|
|
"version": "11.1.27",
|
|
"isSemVerMajor": true
|
|
}
|
|
},
|
|
"body-parser": {
|
|
"name": "body-parser",
|
|
"severity": "moderate",
|
|
"isDirect": false,
|
|
"via": [
|
|
"qs"
|
|
],
|
|
"effects": [
|
|
"@nestjs/platform-express"
|
|
],
|
|
"range": "1.20.3 - 1.20.4 || 2.0.0-beta.1 - 2.0.2",
|
|
"nodes": [
|
|
"node_modules/body-parser"
|
|
],
|
|
"fixAvailable": {
|
|
"name": "@nestjs/platform-express",
|
|
"version": "11.1.27",
|
|
"isSemVerMajor": true
|
|
}
|
|
},
|
|
"esbuild": {
|
|
"name": "esbuild",
|
|
"severity": "moderate",
|
|
"isDirect": false,
|
|
"via": [
|
|
{
|
|
"source": 1102341,
|
|
"name": "esbuild",
|
|
"dependency": "esbuild",
|
|
"title": "esbuild enables any website to send any requests to the development server and read the response",
|
|
"url": "https://github.com/advisories/GHSA-67mh-4wv8-2f99",
|
|
"severity": "moderate",
|
|
"cwe": [
|
|
"CWE-346"
|
|
],
|
|
"cvss": {
|
|
"score": 5.3,
|
|
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N"
|
|
},
|
|
"range": "<=0.24.2"
|
|
}
|
|
],
|
|
"effects": [
|
|
"vite"
|
|
],
|
|
"range": "<=0.24.2",
|
|
"nodes": [
|
|
"node_modules/vite/node_modules/esbuild"
|
|
],
|
|
"fixAvailable": {
|
|
"name": "vite",
|
|
"version": "8.1.1",
|
|
"isSemVerMajor": true
|
|
}
|
|
},
|
|
"express": {
|
|
"name": "express",
|
|
"severity": "moderate",
|
|
"isDirect": false,
|
|
"via": [
|
|
"qs"
|
|
],
|
|
"effects": [
|
|
"@nestjs/platform-express"
|
|
],
|
|
"range": "4.21.0 - 4.22.1 || 5.0.0-alpha.1 - 5.0.1",
|
|
"nodes": [
|
|
"node_modules/express"
|
|
],
|
|
"fixAvailable": {
|
|
"name": "@nestjs/platform-express",
|
|
"version": "11.1.27",
|
|
"isSemVerMajor": true
|
|
}
|
|
},
|
|
"file-type": {
|
|
"name": "file-type",
|
|
"severity": "moderate",
|
|
"isDirect": false,
|
|
"via": [
|
|
{
|
|
"source": 1114301,
|
|
"name": "file-type",
|
|
"dependency": "file-type",
|
|
"title": "file-type affected by infinite loop in ASF parser on malformed input with zero-size sub-header",
|
|
"url": "https://github.com/advisories/GHSA-5v7r-6r5c-r473",
|
|
"severity": "moderate",
|
|
"cwe": [
|
|
"CWE-835"
|
|
],
|
|
"cvss": {
|
|
"score": 5.3,
|
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
|
|
},
|
|
"range": ">=13.0.0 <21.3.1"
|
|
},
|
|
{
|
|
"source": 1114726,
|
|
"name": "file-type",
|
|
"dependency": "file-type",
|
|
"title": "file-type: ZIP Decompression Bomb DoS via [Content_Types].xml entry",
|
|
"url": "https://github.com/advisories/GHSA-j47w-4g3g-c36v",
|
|
"severity": "moderate",
|
|
"cwe": [
|
|
"CWE-400",
|
|
"CWE-409"
|
|
],
|
|
"cvss": {
|
|
"score": 5.3,
|
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
|
|
},
|
|
"range": ">=20.0.0 <=21.3.1"
|
|
}
|
|
],
|
|
"effects": [
|
|
"@nestjs/common"
|
|
],
|
|
"range": "13.0.0 - 21.3.1",
|
|
"nodes": [
|
|
"node_modules/file-type"
|
|
],
|
|
"fixAvailable": {
|
|
"name": "@nestjs/common",
|
|
"version": "11.1.27",
|
|
"isSemVerMajor": true
|
|
}
|
|
},
|
|
"multer": {
|
|
"name": "multer",
|
|
"severity": "high",
|
|
"isDirect": false,
|
|
"via": [
|
|
{
|
|
"source": 1113635,
|
|
"name": "multer",
|
|
"dependency": "multer",
|
|
"title": "Multer vulnerable to Denial of Service via incomplete cleanup",
|
|
"url": "https://github.com/advisories/GHSA-xf7r-hgr6-v32p",
|
|
"severity": "high",
|
|
"cwe": [
|
|
"CWE-459"
|
|
],
|
|
"cvss": {
|
|
"score": 0,
|
|
"vectorString": null
|
|
},
|
|
"range": "<2.1.0"
|
|
},
|
|
{
|
|
"source": 1113636,
|
|
"name": "multer",
|
|
"dependency": "multer",
|
|
"title": "Multer vulnerable to Denial of Service via resource exhaustion",
|
|
"url": "https://github.com/advisories/GHSA-v52c-386h-88mc",
|
|
"severity": "high",
|
|
"cwe": [
|
|
"CWE-772"
|
|
],
|
|
"cvss": {
|
|
"score": 0,
|
|
"vectorString": null
|
|
},
|
|
"range": "<2.1.0"
|
|
},
|
|
{
|
|
"source": 1113996,
|
|
"name": "multer",
|
|
"dependency": "multer",
|
|
"title": "Multer Vulnerable to Denial of Service via Uncontrolled Recursion",
|
|
"url": "https://github.com/advisories/GHSA-5528-5vmv-3xc2",
|
|
"severity": "high",
|
|
"cwe": [
|
|
"CWE-674"
|
|
],
|
|
"cvss": {
|
|
"score": 0,
|
|
"vectorString": null
|
|
},
|
|
"range": "<2.1.1"
|
|
},
|
|
{
|
|
"source": 1121089,
|
|
"name": "multer",
|
|
"dependency": "multer",
|
|
"title": "Multer vulnerable to Denial of Service via deeply nested field names",
|
|
"url": "https://github.com/advisories/GHSA-72gw-mp4g-v24j",
|
|
"severity": "high",
|
|
"cwe": [
|
|
"CWE-400"
|
|
],
|
|
"cvss": {
|
|
"score": 7.5,
|
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
|
|
},
|
|
"range": ">=1.0.0 <2.2.0"
|
|
},
|
|
{
|
|
"source": 1121091,
|
|
"name": "multer",
|
|
"dependency": "multer",
|
|
"title": "Multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads",
|
|
"url": "https://github.com/advisories/GHSA-3p4h-7m6x-2hcm",
|
|
"severity": "moderate",
|
|
"cwe": [
|
|
"CWE-459"
|
|
],
|
|
"cvss": {
|
|
"score": 5.3,
|
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
|
|
},
|
|
"range": ">=2.0.0-alpha.1 <2.2.0"
|
|
}
|
|
],
|
|
"effects": [
|
|
"@nestjs/platform-express"
|
|
],
|
|
"range": "<=2.1.1",
|
|
"nodes": [
|
|
"node_modules/multer"
|
|
],
|
|
"fixAvailable": {
|
|
"name": "@nestjs/platform-express",
|
|
"version": "11.1.27",
|
|
"isSemVerMajor": true
|
|
}
|
|
},
|
|
"qs": {
|
|
"name": "qs",
|
|
"severity": "moderate",
|
|
"isDirect": false,
|
|
"via": [
|
|
{
|
|
"source": 1119502,
|
|
"name": "qs",
|
|
"dependency": "qs",
|
|
"title": "qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set",
|
|
"url": "https://github.com/advisories/GHSA-q8mj-m7cp-5q26",
|
|
"severity": "moderate",
|
|
"cwe": [
|
|
"CWE-476"
|
|
],
|
|
"cvss": {
|
|
"score": 5.3,
|
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
|
|
},
|
|
"range": ">=6.11.1 <=6.15.1"
|
|
}
|
|
],
|
|
"effects": [
|
|
"body-parser",
|
|
"express"
|
|
],
|
|
"range": "6.11.1 - 6.15.1",
|
|
"nodes": [
|
|
"node_modules/qs"
|
|
],
|
|
"fixAvailable": {
|
|
"name": "@nestjs/platform-express",
|
|
"version": "11.1.27",
|
|
"isSemVerMajor": true
|
|
}
|
|
},
|
|
"tar": {
|
|
"name": "tar",
|
|
"severity": "high",
|
|
"isDirect": false,
|
|
"via": [
|
|
{
|
|
"source": 1112659,
|
|
"name": "tar",
|
|
"dependency": "tar",
|
|
"title": "node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal",
|
|
"url": "https://github.com/advisories/GHSA-34x7-hfp2-rc4v",
|
|
"severity": "high",
|
|
"cwe": [
|
|
"CWE-22",
|
|
"CWE-59"
|
|
],
|
|
"cvss": {
|
|
"score": 8.2,
|
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N"
|
|
},
|
|
"range": "<7.5.7"
|
|
},
|
|
{
|
|
"source": 1113300,
|
|
"name": "tar",
|
|
"dependency": "tar",
|
|
"title": "node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization",
|
|
"url": "https://github.com/advisories/GHSA-8qq5-rm4j-mr97",
|
|
"severity": "high",
|
|
"cwe": [
|
|
"CWE-22"
|
|
],
|
|
"cvss": {
|
|
"score": 0,
|
|
"vectorString": null
|
|
},
|
|
"range": "<=7.5.2"
|
|
},
|
|
{
|
|
"source": 1113375,
|
|
"name": "tar",
|
|
"dependency": "tar",
|
|
"title": "Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction",
|
|
"url": "https://github.com/advisories/GHSA-83g3-92jg-28cx",
|
|
"severity": "high",
|
|
"cwe": [
|
|
"CWE-22"
|
|
],
|
|
"cvss": {
|
|
"score": 7.1,
|
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N"
|
|
},
|
|
"range": "<7.5.8"
|
|
},
|
|
{
|
|
"source": 1114200,
|
|
"name": "tar",
|
|
"dependency": "tar",
|
|
"title": "tar has Hardlink Path Traversal via Drive-Relative Linkpath",
|
|
"url": "https://github.com/advisories/GHSA-qffp-2rhf-9h96",
|
|
"severity": "high",
|
|
"cwe": [
|
|
"CWE-22",
|
|
"CWE-59"
|
|
],
|
|
"cvss": {
|
|
"score": 0,
|
|
"vectorString": null
|
|
},
|
|
"range": "<=7.5.9"
|
|
},
|
|
{
|
|
"source": 1114302,
|
|
"name": "tar",
|
|
"dependency": "tar",
|
|
"title": "node-tar Symlink Path Traversal via Drive-Relative Linkpath",
|
|
"url": "https://github.com/advisories/GHSA-9ppj-qmqm-q256",
|
|
"severity": "high",
|
|
"cwe": [
|
|
"CWE-22"
|
|
],
|
|
"cvss": {
|
|
"score": 0,
|
|
"vectorString": null
|
|
},
|
|
"range": "<=7.5.10"
|
|
},
|
|
{
|
|
"source": 1114680,
|
|
"name": "tar",
|
|
"dependency": "tar",
|
|
"title": "Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS",
|
|
"url": "https://github.com/advisories/GHSA-r6q2-hw4h-h46w",
|
|
"severity": "high",
|
|
"cwe": [
|
|
"CWE-176",
|
|
"CWE-367"
|
|
],
|
|
"cvss": {
|
|
"score": 8.8,
|
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L"
|
|
},
|
|
"range": "<=7.5.3"
|
|
},
|
|
{
|
|
"source": 1120782,
|
|
"name": "tar",
|
|
"dependency": "tar",
|
|
"title": "node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)",
|
|
"url": "https://github.com/advisories/GHSA-vmf3-w455-68vh",
|
|
"severity": "moderate",
|
|
"cwe": [
|
|
"CWE-436"
|
|
],
|
|
"cvss": {
|
|
"score": 0,
|
|
"vectorString": null
|
|
},
|
|
"range": "<=7.5.15"
|
|
}
|
|
],
|
|
"effects": [
|
|
"@mapbox/node-pre-gyp"
|
|
],
|
|
"range": "<=7.5.15",
|
|
"nodes": [
|
|
"node_modules/tar"
|
|
],
|
|
"fixAvailable": true
|
|
},
|
|
"vite": {
|
|
"name": "vite",
|
|
"severity": "high",
|
|
"isDirect": true,
|
|
"via": [
|
|
{
|
|
"source": 1116229,
|
|
"name": "vite",
|
|
"dependency": "vite",
|
|
"title": "Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling",
|
|
"url": "https://github.com/advisories/GHSA-4w7w-66w2-5vf9",
|
|
"severity": "moderate",
|
|
"cwe": [
|
|
"CWE-22",
|
|
"CWE-200"
|
|
],
|
|
"cvss": {
|
|
"score": 0,
|
|
"vectorString": null
|
|
},
|
|
"range": "<=6.4.1"
|
|
},
|
|
{
|
|
"source": 1120784,
|
|
"name": "vite",
|
|
"dependency": "vite",
|
|
"title": "launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows",
|
|
"url": "https://github.com/advisories/GHSA-v6wh-96g9-6wx3",
|
|
"severity": "moderate",
|
|
"cwe": [
|
|
"CWE-73",
|
|
"CWE-522"
|
|
],
|
|
"cvss": {
|
|
"score": 0,
|
|
"vectorString": null
|
|
},
|
|
"range": "<=6.4.2"
|
|
},
|
|
{
|
|
"source": 1120789,
|
|
"name": "vite",
|
|
"dependency": "vite",
|
|
"title": "vite: `server.fs.deny` bypass on Windows alternate paths",
|
|
"url": "https://github.com/advisories/GHSA-fx2h-pf6j-xcff",
|
|
"severity": "high",
|
|
"cwe": [
|
|
"CWE-22",
|
|
"CWE-200"
|
|
],
|
|
"cvss": {
|
|
"score": 0,
|
|
"vectorString": null
|
|
},
|
|
"range": "<=6.4.2"
|
|
},
|
|
"esbuild"
|
|
],
|
|
"effects": [],
|
|
"range": "<=6.4.2",
|
|
"nodes": [
|
|
"node_modules/vite"
|
|
],
|
|
"fixAvailable": {
|
|
"name": "vite",
|
|
"version": "8.1.1",
|
|
"isSemVerMajor": true
|
|
}
|
|
}
|
|
},
|
|
"metadata": {
|
|
"vulnerabilities": {
|
|
"info": 0,
|
|
"low": 0,
|
|
"moderate": 7,
|
|
"high": 5,
|
|
"critical": 0,
|
|
"total": 12
|
|
},
|
|
"dependencies": {
|
|
"prod": 220,
|
|
"dev": 259,
|
|
"optional": 75,
|
|
"peer": 0,
|
|
"peerOptional": 0,
|
|
"total": 478
|
|
}
|
|
}
|
|
}
|