[ralyodio]

Fleet dependency upgrade (2026-10-26). Driver: Next.js unauthenticated RCE advisories GHSA-2464-fhr4-w9xw and GHSA-673q-mjm6-r5xr.

Security

• next 16.3.8 -> 16.4.3
• bun audit: 3 critical / 22 high / 11 moderate / 5 low -> 0. Overrides: js-yaml ^4.3.2, browserslist ^4.29.4, zod ^4.6.7, baseline-browser-mapping ^2.11.33; nested brace-expansion entries re-resolved to 1.1.21 / 5.0.12

Majors taken

• web: @anthropic-ai/sdk 0.104 -> 1.3, eslint 9 -> 10, @libsql/client 0.18, @profullstack/bridges 0.1 -> 0.2, x402-gateway 0.11 -> 0.13, @types/node 26
• cli: commander 12 -> 15, chalk 5 -> 6, ora 8 -> 9, dotenv 16 -> 18, typescript 7 (tsconfig now lists types: ["node"])
• oven/bun 1.4.0 -> 1.4.4 (image + packageManager)

Held

• typescript 6.0.3 in apps/web, not 7: typescript-eslint refuses TS 7

Gate (local)

• typecheck clean; tests 84/84; lint: same as master (eslint not installed for apps/cli, exit 127)
• CLI builds and runs (search amazon against prod)
• docker build -f .nixpacks/Dockerfile succeeds (Next 16.4.3); booted image serves / and /stores 200 (/api/health 503 locally without a DB)

🤖 Generated with Claude Code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	next@​16.3.8 ⏵ 16.4.3	+1	+75	+1
	@​anthropic-ai/​sdk@​0.104.1 ⏵ 1.3.0			+12	+1
	eslint-config-next@​16.3.8 ⏵ 16.4.3			+2
	@​types/​sanitize-html@​2.16.1 ⏵ 2.16.2				+7
	@​serwist/​next@​9.5.11 ⏵ 9.5.13
	@​profullstack/​bridges@​0.1.0 ⏵ 0.2.0	+1		+1
	@​types/​react-dom@​19.2.3 ⏵ 19.3.0	+1		+1
	serwist@​9.5.11 ⏵ 9.5.13	+1
	@​profullstack/​footer@​0.2.5 ⏵ 0.2.6	+1		+1	+1
	@​types/​react@​19.2.16 ⏵ 19.3.0	+1		+1	-2
	@​types/​node@​22.19.19 ⏵ 26.6.5	+1		+1
	tsx@​4.22.4 ⏵ 4.23.15
	posthog-js@​1.381.0 ⏵ 1.438.23			+1	+1
	ora@​8.2.0 ⏵ 9.4.1	+1		+1
	tailwindcss@​4.3.0 ⏵ 4.3.3	+1		+1	+2
	react@​19.2.4 ⏵ 19.3.1	+1		+1
	commander@​12.1.0 ⏵ 15.0.0			+1
	turbo@​2.9.16 ⏵ 2.11.10	+1		+1
	chalk@​4.1.2 ⏵ 6.0.1	+1		+1
	@​libsql/​client@​0.17.4 ⏵ 0.18.0	+1		+1	-1
	@​profullstack/​x402-gateway@​0.11.0 ⏵ 0.13.1			+1	+1
	typescript@​5.9.3 ⏵ 7.0.2			-1		+10
	typescript@​5.9.3 ⏵ 6.0.3	+1		+1
	sanitize-html@​2.17.5 ⏵ 2.18.1		+6		-2
	react-dom@​19.2.4 ⏵ 19.3.1			+1
	eslint@​9.39.4 ⏵ 10.13.0	+1			+45
	dotenv@​16.6.1 ⏵ 18.0.9				-1
	@​tailwindcss/​postcss@​4.3.0 ⏵ 4.3.3	+1		+1	+1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority	Alert  (click "▶" to expand/collapse)	Action
	License policy violation: npm @typescript/typescript-aix-ppc64 under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/NOTICE.txt) From: apps/cli/package.json → npm/typescript@7.0.2 → npm/@typescript/typescript-aix-ppc64@7.0.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-aix-ppc64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm @typescript/typescript-darwin-arm64 under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/NOTICE.txt) From: apps/cli/package.json → npm/typescript@7.0.2 → npm/@typescript/typescript-darwin-arm64@7.0.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-darwin-arm64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm @typescript/typescript-darwin-x64 under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/NOTICE.txt) From: apps/cli/package.json → npm/typescript@7.0.2 → npm/@typescript/typescript-darwin-x64@7.0.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-darwin-x64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm @typescript/typescript-freebsd-arm64 under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/NOTICE.txt) From: apps/cli/package.json → npm/typescript@7.0.2 → npm/@typescript/typescript-freebsd-arm64@7.0.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-freebsd-arm64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm @typescript/typescript-freebsd-x64 under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/NOTICE.txt) From: apps/cli/package.json → npm/typescript@7.0.2 → npm/@typescript/typescript-freebsd-x64@7.0.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-freebsd-x64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm @typescript/typescript-linux-arm under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/NOTICE.txt) From: apps/cli/package.json → npm/typescript@7.0.2 → npm/@typescript/typescript-linux-arm@7.0.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-linux-arm@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm @typescript/typescript-linux-arm64 under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/NOTICE.txt) From: apps/cli/package.json → npm/typescript@7.0.2 → npm/@typescript/typescript-linux-arm64@7.0.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-linux-arm64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm @typescript/typescript-linux-loong64 under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/NOTICE.txt) From: apps/cli/package.json → npm/typescript@7.0.2 → npm/@typescript/typescript-linux-loong64@7.0.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-linux-loong64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm @typescript/typescript-linux-mips64el under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/NOTICE.txt) From: apps/cli/package.json → npm/typescript@7.0.2 → npm/@typescript/typescript-linux-mips64el@7.0.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-linux-mips64el@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm @typescript/typescript-linux-ppc64 under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/NOTICE.txt) From: apps/cli/package.json → npm/typescript@7.0.2 → npm/@typescript/typescript-linux-ppc64@7.0.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-linux-ppc64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm @typescript/typescript-linux-riscv64 under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/NOTICE.txt) From: apps/cli/package.json → npm/typescript@7.0.2 → npm/@typescript/typescript-linux-riscv64@7.0.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-linux-riscv64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm @typescript/typescript-linux-s390x under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/NOTICE.txt) From: apps/cli/package.json → npm/typescript@7.0.2 → npm/@typescript/typescript-linux-s390x@7.0.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-linux-s390x@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm @typescript/typescript-linux-x64 under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/NOTICE.txt) From: apps/cli/package.json → npm/typescript@7.0.2 → npm/@typescript/typescript-linux-x64@7.0.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-linux-x64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm @typescript/typescript-netbsd-arm64 under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/NOTICE.txt) From: apps/cli/package.json → npm/typescript@7.0.2 → npm/@typescript/typescript-netbsd-arm64@7.0.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-netbsd-arm64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm @typescript/typescript-netbsd-x64 under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/NOTICE.txt) From: apps/cli/package.json → npm/typescript@7.0.2 → npm/@typescript/typescript-netbsd-x64@7.0.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-netbsd-x64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm @typescript/typescript-openbsd-arm64 under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/NOTICE.txt) From: apps/cli/package.json → npm/typescript@7.0.2 → npm/@typescript/typescript-openbsd-arm64@7.0.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-openbsd-arm64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm @typescript/typescript-openbsd-x64 under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/NOTICE.txt) From: apps/cli/package.json → npm/typescript@7.0.2 → npm/@typescript/typescript-openbsd-x64@7.0.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-openbsd-x64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm @typescript/typescript-sunos-x64 under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/NOTICE.txt) From: apps/cli/package.json → npm/typescript@7.0.2 → npm/@typescript/typescript-sunos-x64@7.0.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-sunos-x64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm @typescript/typescript-win32-arm64 under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/NOTICE.txt) From: apps/cli/package.json → npm/typescript@7.0.2 → npm/@typescript/typescript-win32-arm64@7.0.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-win32-arm64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm @typescript/typescript-win32-x64 under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/NOTICE.txt) From: apps/cli/package.json → npm/typescript@7.0.2 → npm/@typescript/typescript-win32-x64@7.0.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-win32-x64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm typescript under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/NOTICE.txt) From: apps/cli/package.json → npm/typescript@7.0.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/typescript@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm typescript License: LicenseRef-W3C-Community-Final-Specification-Agreement - The applicable license policy does not permit this license (5) (package/ThirdPartyNoticeText.txt) From: apps/web/package.json → npm/typescript@6.0.3 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/typescript@6.0.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn

View full report

[github-actions]

ThreatCrush Security Scan

38 finding(s)

MEDIUM: 32 | LOW: 6

Severity	Rule	Location
MEDIUM	sql-template-interpolation	apps/web/app/api/bounties/[id]/claim/route.ts:18
MEDIUM	sql-template-interpolation	apps/web/app/api/bounties/[id]/claim/route.ts:34
MEDIUM	sql-template-interpolation	apps/web/app/api/bounties/[id]/claim/route.ts:43
MEDIUM	sql-template-interpolation	apps/web/app/api/bounties/route.ts:95
MEDIUM	sql-template-interpolation	apps/web/app/api/coupons/route.ts:68
MEDIUM	sql-template-interpolation	apps/web/app/api/coupons/route.ts:75
MEDIUM	sql-template-interpolation	apps/web/app/api/coupons/vote/route.ts:31
MEDIUM	sql-template-interpolation	apps/web/app/api/coupons/vote/route.ts:33
MEDIUM	sql-template-interpolation	apps/web/app/api/stores/[slug]/route.ts:9
MEDIUM	sql-template-interpolation	apps/web/app/api/webhooks/crawlproof/route.ts:83
MEDIUM	sql-template-interpolation	apps/web/app/api/webhooks/crawlproof/route.ts:90
MEDIUM	js-open-redirect	apps/web/app/bounties/new/page.tsx:61
MEDIUM	js-unescaped-html-sink	apps/web/app/coupons/[id]/page.tsx:57
MEDIUM	js-unescaped-html-sink	apps/web/app/layout.tsx:89
MEDIUM	sql-template-interpolation	apps/web/app/stores/[slug]/page.tsx:16
MEDIUM	js-unescaped-html-sink	apps/web/components/PitFooter.tsx:24
MEDIUM	sql-template-interpolation	apps/web/lib/bbs-post.ts:164
MEDIUM	sql-template-interpolation	apps/web/lib/flipp-sync.ts:445
MEDIUM	sql-template-interpolation	apps/web/lib/inbound-email.ts:573
MEDIUM	sql-template-interpolation	apps/web/lib/inbound-email.ts:643
MEDIUM	sql-template-interpolation	apps/web/lib/mcp-tools.ts:79
MEDIUM	sql-template-interpolation	apps/web/lib/members.ts:54
MEDIUM	sql-template-interpolation	apps/web/lib/nichedb-sync.ts:186
MEDIUM	sql-template-interpolation	apps/web/lib/nichedb-sync.ts:206
MEDIUM	sql-template-interpolation	apps/web/lib/reddit-sync.ts:336
MEDIUM	sql-template-interpolation	apps/web/lib/reddit-sync.ts:355
MEDIUM	sql-template-interpolation	apps/web/lib/reddit-sync.ts:361
MEDIUM	sql-template-interpolation	apps/web/lib/reveal-coupon.ts:115
MEDIUM	sql-template-interpolation	apps/web/lib/reveal-coupon.ts:170
MEDIUM	sh-predictable-temp-path	apps/web/public/install.sh:37
MEDIUM	sh-predictable-temp-path	apps/web/public/install.sh:39
MEDIUM	sql-template-interpolation	apps/web/scripts/migrate.mjs:192
LOW	sql-template-interpolation	test/bbs-post.test.mjs:129
LOW	sql-template-interpolation	test/bbs-post.test.mjs:143
LOW	sql-template-interpolation	test/bbs-post.test.mjs:164
LOW	sql-template-interpolation	test/inbound-email.test.mjs:139
LOW	sql-template-interpolation	test/reveal-sweep.test.mjs:69
LOW	sql-template-interpolation	test/reveal-sweep.test.mjs:112

Snippets are redacted; ThreatCrush never prints matched credential material.