gitea-admin/CASAN
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
ee5d1f7af5b01f1a054ca98795683d3b484f06a4
CASAN/docs/output/casan/phase3-evidence/preflight/npm-audit.json
T
thanhnvandClaude Opus 4.8 36a4812ef3 refactor(structure): promote app to repo root + remove redundant workspace cruft 
Standard production layout: the OKR app (was nested under AINative_OKR_CASAN5/) is now
the repository root. No more wrapper directory.

- Promote AINative_OKR_CASAN5/* -> repo root (backend/ frontend/ packages/ apps/
  .specify/ docs/ infra/ nginx/ scripts/ + configs). Merge tool dirs: .gitea (kept the
  active deploy ci.yml, added harness-ci.yml + runbooks), .claude (agents/commands +
  launch.json), .github moved up.
- Remove redundant: 00_SUBMISSION_PACKAGE, scattered root notes (FPT_CASAN_Full.md,
  tu-tuong-casan.md, casan-tu-sinh..., casan_harness_assessment.md, source-review...,
  README_CASAN5_REFINED.md), casan-next-plans/ and optimize-docs/ (competition/planning
  artifacts — roadmap + design history preserved in git log / commit messages).
- Update all references to the old layout:
  - .gitea/workflows/{ci,harness-ci}.yml, .github/workflows/{ci,deploy}.yml:
    working-directory .; drop AINative_OKR_CASAN5/ prefix; .specify/{tests,scripts}
    -> packages/casan-harness/... (.specify/logs state kept)
  - .claude/launch.json, .gitea/*-runbook.md: path prefixes
  - CLAUDE.md, README.md: docs/input -> apps/okr/domain/input
  - policy-bundle.yaml: 8 policy paths -> packages/casan-harness/...; manifest re-signed
- secrets-scan.sh: fixture excludes -> new package/domain paths.

Full gate from the new root: PASS=64 FAIL=0 SKIP=3.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-08 13:26:36 +09:00

570 lines
15 KiB
JSON
Raw Blame History

{
"auditReportVersion": 2,
"vulnerabilities": {
"@mapbox/node-pre-gyp": {
"name": "@mapbox/node-pre-gyp",
"severity": "high",
"isDirect": false,
"via": [
"tar"
],
"effects": [],
"range": "<=1.0.11",
"nodes": [
"node_modules/@mapbox/node-pre-gyp"
],
"fixAvailable": true
},
"@nestjs/common": {
"name": "@nestjs/common",
"severity": "moderate",
"isDirect": true,
"via": [
"file-type"
],
"effects": [],
"range": "10.4.16 - 10.4.22 || 11.0.16 - 11.1.16 || 12.0.0-alpha.0 - 12.0.0-alpha.2",
"nodes": [
"node_modules/@nestjs/common"
],
"fixAvailable": {
"name": "@nestjs/common",
"version": "11.1.27",
"isSemVerMajor": true
}
},
"@nestjs/core": {
"name": "@nestjs/core",
"severity": "moderate",
"isDirect": true,
"via": [
{
"source": 1117063,
"name": "@nestjs/core",
"dependency": "@nestjs/core",
"title": "@nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')",
"url": "https://github.com/advisories/GHSA-36xv-jgw5-4q75",
"severity": "moderate",
"cwe": [
"CWE-74"
],
"cvss": {
"score": 6.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:L"
},
"range": "<=11.1.17"
}
],
"effects": [],
"range": "<=11.1.17",
"nodes": [
"node_modules/@nestjs/core"
],
"fixAvailable": {
"name": "@nestjs/core",
"version": "11.1.27",
"isSemVerMajor": true
}
},
"@nestjs/platform-express": {
"name": "@nestjs/platform-express",
"severity": "high",
"isDirect": true,
"via": [
"body-parser",
"express",
"multer"
],
"effects": [],
"range": "<=11.1.14 || 12.0.0-alpha.0 - 12.0.0-alpha.2",
"nodes": [
"node_modules/@nestjs/platform-express"
],
"fixAvailable": {
"name": "@nestjs/platform-express",
"version": "11.1.27",
"isSemVerMajor": true
}
},
"body-parser": {
"name": "body-parser",
"severity": "moderate",
"isDirect": false,
"via": [
"qs"
],
"effects": [
"@nestjs/platform-express"
],
"range": "1.20.3 - 1.20.4 || 2.0.0-beta.1 - 2.0.2",
"nodes": [
"node_modules/body-parser"
],
"fixAvailable": {
"name": "@nestjs/platform-express",
"version": "11.1.27",
"isSemVerMajor": true
}
},
"esbuild": {
"name": "esbuild",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1102341,
"name": "esbuild",
"dependency": "esbuild",
"title": "esbuild enables any website to send any requests to the development server and read the response",
"url": "https://github.com/advisories/GHSA-67mh-4wv8-2f99",
"severity": "moderate",
"cwe": [
"CWE-346"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N"
},
"range": "<=0.24.2"
}
],
"effects": [
"vite"
],
"range": "<=0.24.2",
"nodes": [
"node_modules/vite/node_modules/esbuild"
],
"fixAvailable": {
"name": "vite",
"version": "8.1.1",
"isSemVerMajor": true
}
},
"express": {
"name": "express",
"severity": "moderate",
"isDirect": false,
"via": [
"qs"
],
"effects": [
"@nestjs/platform-express"
],
"range": "4.21.0 - 4.22.1 || 5.0.0-alpha.1 - 5.0.1",
"nodes": [
"node_modules/express"
],
"fixAvailable": {
"name": "@nestjs/platform-express",
"version": "11.1.27",
"isSemVerMajor": true
}
},
"file-type": {
"name": "file-type",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1114301,
"name": "file-type",
"dependency": "file-type",
"title": "file-type affected by infinite loop in ASF parser on malformed input with zero-size sub-header",
"url": "https://github.com/advisories/GHSA-5v7r-6r5c-r473",
"severity": "moderate",
"cwe": [
"CWE-835"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": ">=13.0.0 <21.3.1"
},
{
"source": 1114726,
"name": "file-type",
"dependency": "file-type",
"title": "file-type: ZIP Decompression Bomb DoS via [Content_Types].xml entry",
"url": "https://github.com/advisories/GHSA-j47w-4g3g-c36v",
"severity": "moderate",
"cwe": [
"CWE-400",
"CWE-409"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": ">=20.0.0 <=21.3.1"
}
],
"effects": [
"@nestjs/common"
],
"range": "13.0.0 - 21.3.1",
"nodes": [
"node_modules/file-type"
],
"fixAvailable": {
"name": "@nestjs/common",
"version": "11.1.27",
"isSemVerMajor": true
}
},
"multer": {
"name": "multer",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1113635,
"name": "multer",
"dependency": "multer",
"title": "Multer vulnerable to Denial of Service via incomplete cleanup",
"url": "https://github.com/advisories/GHSA-xf7r-hgr6-v32p",
"severity": "high",
"cwe": [
"CWE-459"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<2.1.0"
},
{
"source": 1113636,
"name": "multer",
"dependency": "multer",
"title": "Multer vulnerable to Denial of Service via resource exhaustion",
"url": "https://github.com/advisories/GHSA-v52c-386h-88mc",
"severity": "high",
"cwe": [
"CWE-772"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<2.1.0"
},
{
"source": 1113996,
"name": "multer",
"dependency": "multer",
"title": "Multer Vulnerable to Denial of Service via Uncontrolled Recursion",
"url": "https://github.com/advisories/GHSA-5528-5vmv-3xc2",
"severity": "high",
"cwe": [
"CWE-674"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<2.1.1"
},
{
"source": 1121089,
"name": "multer",
"dependency": "multer",
"title": "Multer vulnerable to Denial of Service via deeply nested field names",
"url": "https://github.com/advisories/GHSA-72gw-mp4g-v24j",
"severity": "high",
"cwe": [
"CWE-400"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=1.0.0 <2.2.0"
},
{
"source": 1121091,
"name": "multer",
"dependency": "multer",
"title": "Multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads",
"url": "https://github.com/advisories/GHSA-3p4h-7m6x-2hcm",
"severity": "moderate",
"cwe": [
"CWE-459"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": ">=2.0.0-alpha.1 <2.2.0"
}
],
"effects": [
"@nestjs/platform-express"
],
"range": "<=2.1.1",
"nodes": [
"node_modules/multer"
],
"fixAvailable": {
"name": "@nestjs/platform-express",
"version": "11.1.27",
"isSemVerMajor": true
}
},
"qs": {
"name": "qs",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1119502,
"name": "qs",
"dependency": "qs",
"title": "qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set",
"url": "https://github.com/advisories/GHSA-q8mj-m7cp-5q26",
"severity": "moderate",
"cwe": [
"CWE-476"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": ">=6.11.1 <=6.15.1"
}
],
"effects": [
"body-parser",
"express"
],
"range": "6.11.1 - 6.15.1",
"nodes": [
"node_modules/qs"
],
"fixAvailable": {
"name": "@nestjs/platform-express",
"version": "11.1.27",
"isSemVerMajor": true
}
},
"tar": {
"name": "tar",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1112659,
"name": "tar",
"dependency": "tar",
"title": "node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal",
"url": "https://github.com/advisories/GHSA-34x7-hfp2-rc4v",
"severity": "high",
"cwe": [
"CWE-22",
"CWE-59"
],
"cvss": {
"score": 8.2,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N"
},
"range": "<7.5.7"
},
{
"source": 1113300,
"name": "tar",
"dependency": "tar",
"title": "node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization",
"url": "https://github.com/advisories/GHSA-8qq5-rm4j-mr97",
"severity": "high",
"cwe": [
"CWE-22"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<=7.5.2"
},
{
"source": 1113375,
"name": "tar",
"dependency": "tar",
"title": "Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction",
"url": "https://github.com/advisories/GHSA-83g3-92jg-28cx",
"severity": "high",
"cwe": [
"CWE-22"
],
"cvss": {
"score": 7.1,
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N"
},
"range": "<7.5.8"
},
{
"source": 1114200,
"name": "tar",
"dependency": "tar",
"title": "tar has Hardlink Path Traversal via Drive-Relative Linkpath",
"url": "https://github.com/advisories/GHSA-qffp-2rhf-9h96",
"severity": "high",
"cwe": [
"CWE-22",
"CWE-59"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<=7.5.9"
},
{
"source": 1114302,
"name": "tar",
"dependency": "tar",
"title": "node-tar Symlink Path Traversal via Drive-Relative Linkpath",
"url": "https://github.com/advisories/GHSA-9ppj-qmqm-q256",
"severity": "high",
"cwe": [
"CWE-22"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<=7.5.10"
},
{
"source": 1114680,
"name": "tar",
"dependency": "tar",
"title": "Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS",
"url": "https://github.com/advisories/GHSA-r6q2-hw4h-h46w",
"severity": "high",
"cwe": [
"CWE-176",
"CWE-367"
],
"cvss": {
"score": 8.8,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L"
},
"range": "<=7.5.3"
},
{
"source": 1120782,
"name": "tar",
"dependency": "tar",
"title": "node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)",
"url": "https://github.com/advisories/GHSA-vmf3-w455-68vh",
"severity": "moderate",
"cwe": [
"CWE-436"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<=7.5.15"
}
],
"effects": [
"@mapbox/node-pre-gyp"
],
"range": "<=7.5.15",
"nodes": [
"node_modules/tar"
],
"fixAvailable": true
},
"vite": {
"name": "vite",
"severity": "high",
"isDirect": true,
"via": [
{
"source": 1116229,
"name": "vite",
"dependency": "vite",
"title": "Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling",
"url": "https://github.com/advisories/GHSA-4w7w-66w2-5vf9",
"severity": "moderate",
"cwe": [
"CWE-22",
"CWE-200"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<=6.4.1"
},
{
"source": 1120784,
"name": "vite",
"dependency": "vite",
"title": "launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows",
"url": "https://github.com/advisories/GHSA-v6wh-96g9-6wx3",
"severity": "moderate",
"cwe": [
"CWE-73",
"CWE-522"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<=6.4.2"
},
{
"source": 1120789,
"name": "vite",
"dependency": "vite",
"title": "vite: `server.fs.deny` bypass on Windows alternate paths",
"url": "https://github.com/advisories/GHSA-fx2h-pf6j-xcff",
"severity": "high",
"cwe": [
"CWE-22",
"CWE-200"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<=6.4.2"
},
"esbuild"
],
"effects": [],
"range": "<=6.4.2",
"nodes": [
"node_modules/vite"
],
"fixAvailable": {
"name": "vite",
"version": "8.1.1",
"isSemVerMajor": true
}
}
},
"metadata": {
"vulnerabilities": {
"info": 0,
"low": 0,
"moderate": 7,
"high": 5,
"critical": 0,
"total": 12
},
"dependencies": {
"prod": 220,
"dev": 259,
"optional": 75,
"peer": 0,
"peerOptional": 0,
"total": 478
}
}
}
Reference in New Issue View Git Blame Copy Permalink