[pkgwarden-bot]

Why you are getting this pull request

This pull request comes from pkgwarden, a dependency-security tool. It was reviewed by @johncassil before it was sent. We ran whole-set CVE remediation against this repository's lockfile: instead of one pull request per advisory, it works out the smallest set of version floors that clears every known CVE the lockfile can clear, resolves them with your own package manager, and lists what could not be fixed and why.

Nothing here subscribes your repository to anything. We do not watch it, and no further pull requests will come unless a maintainer asks for them. If this change is wrong for your project, please close it; a one-line reason helps us improve. If it breaks your tests, or you would like it narrowed, please comment and we will follow up. We are also looking for a few open-source projects to work with as design partners, at no cost; comment here or write to hello@pkgwarden.com if that interests you. To opt out of any future contact, reply here or write to the same address.

The full decision record for this change is at https://gate.pkgwarden.com/remediation/runs/JeHhoKZySx-Ev5O5vGPY5htvF4iOBv4dL53o_LcIA70.

pkgwarden ran whole-set CVE remediation against https://github.com/socketio/socket.io.

You had 113 CVEs across 33 packages (3 direct, 30 transitive). This PR fixes 98 CVEs across 26 packages. The remaining 15 CVEs need your action, listed below with reasons. Of those, none of them appear reachable from your own code.

This lockfile is shared by the workspace members packages/engine.io, packages/engine.io-client, packages/engine.io-parser, packages/socket.io, packages/socket.io-adapter, packages/socket.io-client, packages/socket.io-cluster-adapter, packages/socket.io-cluster-engine, packages/socket.io-component-emitter, packages/socket.io-parser, packages/socket.io-postgres-emitter, packages/socket.io-redis-streams-emitter.

Packages this PR raises

package	raised to at least	vulnerabilities it clears
@babel/core	7.29.6	GHSA-4x5r-pxfx-6jf8
@babel/core	8.0.0	GHSA-4x5r-pxfx-6jf8
@babel/plugin-transform-modules-systemjs	7.29.4	GHSA-fv7c-fp4j-7gwp
@babel/plugin-transform-modules-systemjs	8.0.0	GHSA-fv7c-fp4j-7gwp
ajv	6.14.0	GHSA-2g4f-4pwh-qvx6
ajv	8.18.0	GHSA-2g4f-4pwh-qvx6
axios	1.20.0	GHSA-35jp-ww65-95wh, GHSA-3g43-6gmg-66jw, GHSA-3p68-rc4w-qgx5, GHSA-3w6x-2g7m-8v23, GHSA-42h9-826w-cgv3, GHSA-43fc-jf86-j433, GHSA-445q-vr5w-6q77, GHSA-4hqw-qxg8-jxx2, GHSA-5c9x-8gcm-mpgx, GHSA-62hf-57xw-28j9 and 22 more (see trace)
baseline-browser-mapping	2.11.0	GHSA-w5vr-8v7q-w6rv
basic-ftp	6.2.1	GHSA-c475-qrg2-pj4r
body-parser	1.20.6	GHSA-v422-hmwv-36x6
body-parser	2.3.0	GHSA-v422-hmwv-36x6
brace-expansion	1.1.21	GHSA-3jxr-9vmj-r5cp, GHSA-6j4f-fj2g-mc7p, GHSA-f886-m6hf-6m8v, GHSA-mh99-v99m-4gvg, GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7, GHSA-rgw5-rvv9-x895
brace-expansion	2.1.7	GHSA-3jxr-9vmj-r5cp, GHSA-6j4f-fj2g-mc7p, GHSA-f886-m6hf-6m8v, GHSA-mh99-v99m-4gvg, GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7, GHSA-rgw5-rvv9-x895
brace-expansion	5.0.12	GHSA-3jxr-9vmj-r5cp, GHSA-6j4f-fj2g-mc7p, GHSA-f886-m6hf-6m8v, GHSA-mh99-v99m-4gvg, GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7, GHSA-rgw5-rvv9-x895
browserslist	4.28.7	GHSA-73wf-gq98-2v4g, GHSA-c83g-rgw3-j3cx
diff	3.5.1	GHSA-73rr-hh4g-fpgx
diff	4.0.4	GHSA-73rr-hh4g-fpgx
diff	5.2.2	GHSA-73rr-hh4g-fpgx
diff	8.0.3	GHSA-73rr-hh4g-fpgx
follow-redirects	1.16.0	GHSA-r4q5-vmmm-2653
glob	10.5.0	GHSA-5j98-mcp5-4vw2
glob	11.1.0	GHSA-5j98-mcp5-4vw2
ip-address	10.7.1	GHSA-h3mg-xc3c-68pw, GHSA-j6r3-76f7-8jcv, GHSA-mwp4-54f8-5fhr, GHSA-rpw4-54j3-4h4q, GHSA-v2v4-37r5-5v8g
js-yaml	3.15.2	GHSA-2883-xcg3-v3hh, GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj, GHSA-h67p-54hq-rp68, GHSA-mh29-5h37-fv8m
js-yaml	4.3.2	GHSA-2883-xcg3-v3hh, GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj, GHSA-h67p-54hq-rp68, GHSA-mh29-5h37-fv8m
lodash	4.18.0	GHSA-f23m-r3pf-42rh, GHSA-r5fr-rjxr-66jc, GHSA-xxjr-mmjv-4gpg
minimatch	3.1.4	GHSA-23c5-xmqv-rm74, GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj
minimatch	4.2.5	GHSA-23c5-xmqv-rm74, GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj
minimatch	5.1.8	GHSA-23c5-xmqv-rm74, GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj
minimatch	6.2.2	GHSA-23c5-xmqv-rm74, GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj
minimatch	7.4.8	GHSA-23c5-xmqv-rm74, GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj
minimatch	8.0.6	GHSA-23c5-xmqv-rm74, GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj
minimatch	9.0.7	GHSA-23c5-xmqv-rm74, GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj
minimatch	10.2.3	GHSA-23c5-xmqv-rm74, GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj
path-to-regexp	0.1.13	GHSA-37ch-88jc-xwx2
picomatch	2.3.2	GHSA-3v7f-55p6-f55p, GHSA-c2c7-rcm5-vvqj
picomatch	3.0.2	GHSA-3v7f-55p6-f55p, GHSA-c2c7-rcm5-vvqj
picomatch	4.0.4	GHSA-3v7f-55p6-f55p, GHSA-c2c7-rcm5-vvqj
proxy-addr	2.0.8	GHSA-jqcg-44mw-7w3h
qs	6.16.0	GHSA-4mjr-xmp4-gh2g, GHSA-6rw7-vpxm-498p, GHSA-q8mj-m7cp-5q26, GHSA-w7fw-mjwx-w883
rollup	2.80.0	GHSA-mw96-cpmx-2vgc
rollup	3.30.0	GHSA-mw96-cpmx-2vgc
rollup	4.59.0	GHSA-mw96-cpmx-2vgc
serialize-javascript	7.0.5	GHSA-5c6j-r48x-rmvq, GHSA-qj8w-gfj5-8c6v
socket.io-parser	3.3.6	GHSA-2m8v-j782-fhvr, GHSA-677m-j7p3-52f9
socket.io-parser	4.2.7	GHSA-2m8v-j782-fhvr, GHSA-677m-j7p3-52f9
tar	7.5.21	GHSA-23hp-3jrh-7fpw, GHSA-34x7-hfp2-rc4v, GHSA-83g3-92jg-28cx, GHSA-8qq5-rm4j-mr97, GHSA-8x88-c5mf-7j5w, GHSA-9ppj-qmqm-q256, GHSA-gvwx-54wh-qm9j, GHSA-qffp-2rhf-9h96, GHSA-r292-9mhp-454m, GHSA-r6q2-hw4h-h46w and 2 more (see trace)
uuid	11.1.1	GHSA-w5hq-g745-h8pq
uuid	12.0.1	GHSA-w5hq-g745-h8pq
uuid	13.0.1	GHSA-w5hq-g745-h8pq
webpack	5.104.1	GHSA-38r7-794h-5758, GHSA-8fgc-7cc6-rx7x

Constraints we relaxed

constraint	why it was implicated	relaxed to
mocha ^10.6.0 in devDependencies	the declared range excluded every version the strict view serves; 12.0.0 is the lowest it serves without moving below the locked version	^12.0.0
@wdio/mocha-framework ^9.31.9 in devDependencies	the declared range excluded every version the strict view serves; 10.0.0 is the lowest it serves without moving below the locked version	^10.0.0
nyc ^17.0.0 in devDependencies	the declared range excluded every version the strict view serves; 18.0.0 is the lowest it serves without moving below the locked version	^18.0.0

Transitive dependency updates and why

You declared none of these. Each one moved because the package beneath it could not reach a safe version otherwise.

package	from	to	why
express	^4.19.2	4.22.0	body-parser needs >=1.20.6: checked 290 released version(s) of express up to 5.3.0 for one whose requirement reaches the menu served for body-parser (floor 1.20.6) - 0.14.0, 0.14.1, 1.0.0, 1.0.1, 1.0.2 and 232 more excluded (not a bump: it is at or below the version already locked); 1.0.0-beta, 1.0.0-beta2, 1.0.0-rc, 1.0.0-rc2, 1.0.0-rc3 and 38 more excluded (a pre-release, which no resolver should be steered onto by a bump); 4.22.0 is the lowest that does and it stays inside the declared ^4.19.2
socks	^2.8.3	2.8.7	ip-address needs >=10.7.1: checked 56 released version(s) of socks up to 2.8.10 for one whose requirement reaches the menu served for ip-address (floor 10.7.1) - 0.0.1, 1.0.0, 1.1.5, 1.1.6, 1.1.7 and 43 more excluded (not a bump: it is at or below the version already locked); 2.6.0-beta.1 excluded (a pre-release, which no resolver should be steered onto by a bump); 2.8.7 is the lowest that does and it stays inside the declared ^2.8.3
express	^4.19.2	4.22.0	path-to-regexp needs >=0.1.13: checked 290 released version(s) of express up to 5.3.0 for one whose requirement reaches the menu served for path-to-regexp (floor 0.1.13) - 0.14.0, 0.14.1, 1.0.0, 1.0.1, 1.0.2 and 232 more excluded (not a bump: it is at or below the version already locked); 1.0.0-beta, 1.0.0-beta2, 1.0.0-rc, 1.0.0-rc2, 1.0.0-rc3 and 38 more excluded (a pre-release, which no resolver should be steered onto by a bump); 4.22.0 is the lowest that does and it stays inside the declared ^4.19.2
express	^4.19.2	4.22.0	body-parser needs >=1.20.8: checked 290 released version(s) of express up to 5.3.0 for one whose requirement reaches the menu served for body-parser (floor 1.20.8) - 0.14.0, 0.14.1, 1.0.0, 1.0.1, 1.0.2 and 232 more excluded (not a bump: it is at or below the version already locked); 1.0.0-beta, 1.0.0-beta2, 1.0.0-rc, 1.0.0-rc2, 1.0.0-rc3 and 38 more excluded (a pre-release, which no resolver should be steered onto by a bump); 4.22.0 is the lowest that does and it stays inside the declared ^4.19.2
body-parser	1.20.3	1.20.8	qs needs >=6.16.0: checked 3 released version(s) of body-parser up to 2.3.0 for one whose requirement reaches the menu served for qs (floor 6.16.0); 1.20.8 is the lowest that does but it sits outside every range that declares the blocker today
express	^4.19.2	4.22.3	qs needs >=6.16.0: checked 290 released version(s) of express up to 5.3.0 for one whose requirement reaches the menu served for qs (floor 6.16.0) - 0.14.0, 0.14.1, 1.0.0, 1.0.1, 1.0.2 and 232 more excluded (not a bump: it is at or below the version already locked); 1.0.0-beta, 1.0.0-beta2, 1.0.0-rc, 1.0.0-rc2, 1.0.0-rc3 and 38 more excluded (a pre-release, which no resolver should be steered onto by a bump); 4.22.3 is the lowest that does and it stays inside the declared ^4.19.2
@wdio/mocha-framework	^9.31.9	10.0.0	mocha needs >=12.0.0: checked 438 released version(s) of @wdio/mocha-framework up to 10.1.0-alpha.30 for one whose requirement reaches the menu served for mocha (floor 12.0.0) - 5.0.0-beta.5, 5.0.0-beta.6, 5.0.0-beta.7, 5.0.0-beta.8, 5.0.0-beta.9 and 89 more excluded (a pre-release, which no resolver should be steered onto by a bump); 5.0.0, 5.0.3, 5.1.0, 5.2.2, 5.2.3 and 336 more excluded (not a bump: it is at or below the version already locked); 10.0.0 is the lowest that does but it sits outside every range that declares the blocker today
mocha	^10.6.0, ^10.8.2	12.0.0	serialize-javascript needs >=7.0.5: checked 251 released version(s) of mocha up to 12.0.3 for one whose requirement reaches the menu served for serialize-javascript (floor 7.0.5) - 0.0.1-alpha1, 0.0.1-alpha2, 0.0.1-alpha3, 0.0.1-alpha4, 0.0.1-alpha5 and 34 more excluded (a pre-release, which no resolver should be steered onto by a bump); 0.0.1, 0.0.2, 0.0.3, 0.0.4, 0.0.5 and 184 more excluded (not a bump: it is at or below the version already locked); 12.0.0 is the lowest that does but it sits outside every range that declares the blocker today
terser-webpack-plugin	^5.3.11	5.3.17	serialize-javascript needs >=7.0.5: checked 89 released version(s) of terser-webpack-plugin up to 5.6.1 for one whose requirement reaches the menu served for serialize-javascript (floor 7.0.5) - 1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.2.0 and 77 more excluded (not a bump: it is at or below the version already locked); 5.3.17 is the lowest that does and it stays inside the declared ^5.3.11
@fails-components/webtransport-transport-http3-quiche	^1.1.4	1.5.3	cmake-js needs >=8.0.0: checked 38 released version(s) of @fails-components/webtransport-transport-http3-quiche up to 1.6.10 for one whose requirement reaches the menu served for cmake-js (floor 8.0.0) - 1.0.0-rc.1 excluded (a pre-release, which no resolver should be steered onto by a bump); 1.0.1, 1.0.4, 1.0.6, 1.0.8, 1.0.9 and 19 more excluded (not a bump: it is at or below the version already locked); 1.5.3 is the lowest that does and it stays inside the declared ^1.1.4
cmake-js	^7.2.1	8.0.0	tar needs >=7.5.21: checked 88 released version(s) of cmake-js up to 8.0.0 for one whose requirement reaches the menu served for tar (floor 7.5.21) - 0.8.0, 0.8.1, 0.8.2, 0.8.3, 0.8.4 and 76 more excluded (not a bump: it is at or below the version already locked); 7.0.0-0, 7.0.0-1, 7.0.0-2, 7.0.0-3 excluded (a pre-release, which no resolver should be steered onto by a bump); 8.0.0 is the lowest that does but it sits outside every range that declares the blocker today
webdriverio	9.31.9	9.31.9	webdriver needs >=9.0.0: checked 842 released version(s) of webdriverio up to 10.1.0-alpha.30 for one whose requirement reaches the menu served for webdriver (floor 9.0.0) - 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.1.2 and 610 more excluded (not a bump: it is at or below the version already locked); 4.12.0-beta.1, 5.0.0-alpha.2, 5.0.0-alpha.3, 5.0.0-alpha.4, 5.0.0-alpha.5 and 112 more excluded (a pre-release, which no resolver should be steered onto by a bump); 9.31.9 is the lowest that does and it stays inside the declared 9.31.9
webdriver	8.46.0	9.0.0	@wdio/config needs >=9.0.0: checked 582 released version(s) of webdriver up to 10.1.0-alpha.30 for one whose requirement reaches the menu served for @wdio/config (floor 9.0.0) - 0.0.1, 0.0.2, 0.0.3, 0.0.4, 5.0.0 and 381 more excluded (not a bump: it is at or below the version already locked); 5.0.0-alpha.2, 5.0.0-alpha.3, 5.0.0-alpha.4, 5.0.0-alpha.5, 5.0.0-alpha.6 and 107 more excluded (a pre-release, which no resolver should be steered onto by a bump); 9.0.0 is the lowest that does but it sits outside every range that declares the blocker today
webdriverio	9.31.9	9.31.9	@wdio/config needs >=9.0.0: checked 842 released version(s) of webdriverio up to 10.1.0-alpha.30 for one whose requirement reaches the menu served for @wdio/config (floor 9.0.0) - 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.1.2 and 610 more excluded (not a bump: it is at or below the version already locked); 4.12.0-beta.1, 5.0.0-alpha.2, 5.0.0-alpha.3, 5.0.0-alpha.4, 5.0.0-alpha.5 and 112 more excluded (a pre-release, which no resolver should be steered onto by a bump); 9.31.9 is the lowest that does and it stays inside the declared 9.31.9
@wdio/config	8.46.0	9.0.0	@wdio/utils needs >=9.0.0: checked 420 released version(s) of @wdio/config up to 10.1.0-alpha.30 for one whose requirement reaches the menu served for @wdio/utils (floor 9.0.0) - 5.0.0-beta.5, 5.0.0-beta.6, 5.0.0-beta.7, 5.0.0-beta.8, 5.0.0-beta.9 and 90 more excluded (a pre-release, which no resolver should be steered onto by a bump); 5.0.0, 5.0.3, 5.1.0, 5.2.2, 5.2.3 and 253 more excluded (not a bump: it is at or below the version already locked); 9.0.0 is the lowest that does but it sits outside every range that declares the blocker today
webdriverio	9.31.9	9.31.9	webdriver needs >=9.0.0: checked 842 released version(s) of webdriverio up to 10.1.0-alpha.30 for one whose requirement reaches the menu served for webdriver (floor 9.0.0) - 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.1.2 and 610 more excluded (not a bump: it is at or below the version already locked); 4.12.0-beta.1, 5.0.0-alpha.2, 5.0.0-alpha.3, 5.0.0-alpha.4, 5.0.0-alpha.5 and 112 more excluded (a pre-release, which no resolver should be steered onto by a bump); 9.31.9 is the lowest that does and it stays inside the declared 9.31.9
webdriver	8.46.0	9.0.0	@wdio/utils needs >=9.0.0: checked 582 released version(s) of webdriver up to 10.1.0-alpha.30 for one whose requirement reaches the menu served for @wdio/utils (floor 9.0.0) - 0.0.1, 0.0.2, 0.0.3, 0.0.4, 5.0.0 and 381 more excluded (not a bump: it is at or below the version already locked); 5.0.0-alpha.2, 5.0.0-alpha.3, 5.0.0-alpha.4, 5.0.0-alpha.5, 5.0.0-alpha.6 and 107 more excluded (a pre-release, which no resolver should be steered onto by a bump); 9.0.0 is the lowest that does but it sits outside every range that declares the blocker today
webdriverio	9.31.9	9.31.9	@wdio/utils needs >=9.0.0: checked 842 released version(s) of webdriverio up to 10.1.0-alpha.30 for one whose requirement reaches the menu served for @wdio/utils (floor 9.0.0) - 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.1.2 and 610 more excluded (not a bump: it is at or below the version already locked); 4.12.0-beta.1, 5.0.0-alpha.2, 5.0.0-alpha.3, 5.0.0-alpha.4, 5.0.0-alpha.5 and 112 more excluded (a pre-release, which no resolver should be steered onto by a bump); 9.31.9 is the lowest that does and it stays inside the declared 9.31.9
@wdio/utils	8.46.0	9.0.0	@puppeteer/browsers needs >=2.2.4: checked 381 released version(s) of @wdio/utils up to 10.1.0-alpha.30 for one whose requirement reaches the menu served for @puppeteer/browsers (floor 2.2.4) - 5.4.20, 5.6.0, 5.6.3, 5.6.4, 5.7.0 and 226 more excluded (not a bump: it is at or below the version already locked); 5.13.0-alpha.0, 6.0.0-alpha.0, 6.0.0-alpha.1, 6.0.0-beta.0, 7.0.0-beta.0 and 78 more excluded (a pre-release, which no resolver should be steered onto by a bump); 9.0.0 is the lowest that does but it sits outside every range that declares the blocker today
webdriverio	9.31.9	9.31.9	puppeteer-core needs >=22.13.1: checked 842 released version(s) of webdriverio up to 10.1.0-alpha.30 for one whose requirement reaches the menu served for puppeteer-core (floor 22.13.1) - 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.1.2 and 610 more excluded (not a bump: it is at or below the version already locked); 4.12.0-beta.1, 5.0.0-alpha.2, 5.0.0-alpha.3, 5.0.0-alpha.4, 5.0.0-alpha.5 and 112 more excluded (a pre-release, which no resolver should be steered onto by a bump); 9.31.9 is the lowest that does and it stays inside the declared 9.31.9
puppeteer-core	^21.11.0	22.13.1	@puppeteer/browsers needs >=2.2.4: checked 350 released version(s) of puppeteer-core up to 25.14.0 for one whose requirement reaches the menu served for @puppeteer/browsers (floor 2.2.4) - 1.7.0, 1.8.0, 1.9.0, 1.10.0, 1.11.0 and 191 more excluded (not a bump: it is at or below the version already locked); 22.13.1 is the lowest that does but it sits outside every range that declares the blocker today
@puppeteer/browsers	^1.6.0, 1.9.1	2.2.4	tar-fs needs >=3.1.1: checked 88 released version(s) of @puppeteer/browsers up to 3.2.5 for one whose requirement reaches the menu served for tar-fs (floor 3.1.1) - 0.0.1, 0.0.2, 0.0.3, 0.0.4, 0.0.5 and 30 more excluded (not a bump: it is at or below the version already locked); 2.2.4 is the lowest that does but it sits outside every range that declares the blocker today
nyc	^17.0.0	18.0.0	istanbul-lib-processinfo needs >=3.0.1: checked 166 released version(s) of nyc up to 18.0.0 for one whose requirement reaches the menu served for istanbul-lib-processinfo (floor 3.0.1) - 1.1.0, 1.1.1, 1.1.2, 1.1.3, 1.1.4 and 108 more excluded (not a bump: it is at or below the version already locked); 4.0.0-alpha, 6.2.0-alpha, 6.2.0-alpha1, 6.2.0-alpha3, 6.4.0-next and 46 more excluded (a pre-release, which no resolver should be steered onto by a bump); 18.0.0 is the lowest that does but it sits outside every range that declares the blocker today
istanbul-lib-processinfo	^2.0.2	3.0.1	uuid needs >=11.1.1: checked 7 released version(s) of istanbul-lib-processinfo up to 3.0.1 for one whose requirement reaches the menu served for uuid (floor 11.1.1) - 1.0.0, 2.0.0, 2.0.1, 2.0.2, 2.0.3 excluded (not a bump: it is at or below the version already locked); 3.0.1 is the lowest that does but it sits outside every range that declares the blocker today
prebuild-install	^7.1.1	7.1.3	tar-fs needs >=3.1.3: checked 48 released version(s) of prebuild-install up to 7.1.3 for one whose requirement reaches the menu served for tar-fs (floor 3.1.3) - 1.0.0, 1.0.1, 1.0.2, 1.1.0, 2.0.0 and 42 more excluded (not a bump: it is at or below the version already locked); 7.1.3 is the lowest that does and it stays inside the declared ^7.1.1

What this PR does not fix

vulnerability	package	class	why it is still here	can your code reach it?
GHSA-vfj7-8cjw-p6xm	braces	no_cve_free_version	no released version of this package clears it, so we kept the least bad version available: every viable braces 0.x version carries an identical vulnerability set; staying on the best available version 0.1.5 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.	we could not tell
GHSA-ggr8-5vv4-36mx	deepmerge-ts	no_cve_free_version	no released version of this package clears it, so we kept the least bad version available: every viable deepmerge-ts 1.x version carries an identical vulnerability set; staying on the best available version 1.1.7 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.	we could not tell
GHSA-7pqw-9j4j-h8q3	extract-zip	no_cve_free_version	no released version of this package clears it, so we kept the least bad version available: every viable extract-zip 1.x version carries an identical vulnerability set; staying on the best available version 1.7.0 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.	we could not tell
GHSA-jmr9-qjv8-65gv	extract-zip	no_cve_free_version	no released version of this package clears it, so we kept the least bad version available: every viable extract-zip 1.x version carries an identical vulnerability set; staying on the best available version 1.7.0 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.	we could not tell
GHSA-ch52-4w7c-c8xp	http-cache-semantics	no_cve_free_version	no released version of this package clears it, so we kept the least bad version available: every viable http-cache-semantics 1.x version carries an identical vulnerability set; staying on the best available version 1.0.0 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.	we could not tell
GHSA-2328-f5f3-gj25	node-forge	no_cve_free_version	no released version of this package clears it, so we kept the least bad version available: every viable node-forge 0.x version carries an identical vulnerability set; staying on the best available version 0.10.0 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.	we could not tell
GHSA-554w-wpv2-vw27	node-forge	no_cve_free_version	no released version of this package clears it, so we kept the least bad version available: every viable node-forge 0.x version carries an identical vulnerability set; staying on the best available version 0.10.0 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.	we could not tell
GHSA-5gfm-wpxj-wjgq	node-forge	no_cve_free_version	no released version of this package clears it, so we kept the least bad version available: every viable node-forge 0.x version carries an identical vulnerability set; staying on the best available version 0.10.0 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.	we could not tell
GHSA-5m6q-g25r-mvwx	node-forge	no_cve_free_version	no released version of this package clears it, so we kept the least bad version available: every viable node-forge 0.x version carries an identical vulnerability set; staying on the best available version 0.10.0 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.	we could not tell
GHSA-65ch-62r8-g69g	node-forge	no_cve_free_version	no released version of this package clears it, so we kept the least bad version available: every viable node-forge 0.x version carries an identical vulnerability set; staying on the best available version 0.10.0 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.	we could not tell
GHSA-86w9-cpqp-85rv	node-forge	no_cve_free_version	no released version of this package clears it, so we kept the least bad version available: every viable node-forge 0.x version carries an identical vulnerability set; staying on the best available version 0.10.0 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.	we could not tell
GHSA-ppp5-5v6c-4jwp	node-forge	no_cve_free_version	no released version of this package clears it, so we kept the least bad version available: every viable node-forge 0.x version carries an identical vulnerability set; staying on the best available version 0.10.0 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.	we could not tell
GHSA-q67f-28xg-22rw	node-forge	no_cve_free_version	no released version of this package clears it, so we kept the least bad version available: every viable node-forge 0.x version carries an identical vulnerability set; staying on the best available version 0.10.0 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.	we could not tell
GHSA-6fx8-h7jm-663j	parseuri	no_cve_free_version	no released version of this package clears it, so we kept the least bad version available: every viable parseuri 0.x version carries an identical vulnerability set; keeping the locked version 0.0.6 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.	we could not tell
GHSA-hp3w-g68c-fv3c	sprintf-js	no_cve_free_version	no released version of this package clears it, so we kept the least bad version available: every viable sprintf-js 0.x version carries an identical vulnerability set; staying on the best available version 0.0.7 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.	we could not tell

Machine-readable decision trace

Every decision above is recorded, in order, at https://core.pkgwarden.com/api/v1/remediation/runs/JeHhoKZySx-Ev5O5vGPY5htvF4iOBv4dL53o_LcIA70/trace.

The same run as a page you can read: https://gate.pkgwarden.com/remediation/runs/JeHhoKZySx-Ev5O5vGPY5htvF4iOBv4dL53o_LcIA70.