From 6b6f03f21f399289b83d2379c43c7dea75339f80 Mon Sep 17 00:00:00 2001
From: Rahul <254529899+motsc@users.noreply.github.com>
Date: Wed, 25 Feb 2026 10:35:42 -0600
Subject: [PATCH 1/8] fix: add safe yarn resolutions for known vulnerabilities

Patch-level resolutions within existing major versions, minimal
breakage risk:

- lodash ^4.17.23: forces transitive consumers to patched version
  (prototype pollution via _.unset/_.omit)
- nanoid ^3.3.8: CVE-2024-55565 predictable ID generation (patch in 3.x)
- validator ^13.15.22: URL bypass + special element filtering (patch in 13.x)
- @babel/runtime ^7.26.10: ReDoS in named capturing groups (patch in 7.x)
- ajv ^6.14.0: ReDoS via $data option (patch in 6.x, subsumes Dependabot #1774)
- systeminformation ^5.31.0: raises existing CVE-2026-26318 command
  injection resolution from ^5.24.0 to latest patched release
---
 package.json |   7 +-
 yarn.lock    | 607 +++++++++++++++++++++++----------------------------
 2 files changed, 277 insertions(+), 337 deletions(-)

diff --git a/package.json b/package.json
index 0663aa0078..c5790e4bd8 100644
--- a/package.json
+++ b/package.json
@@ -77,6 +77,11 @@
     "diff": "^5.2.2",
     "on-headers": "^1.1.0",
     "fast-xml-parser": "^4.4.0",
-    "systeminformation": "^5.24.0"
+    "systeminformation": "^5.31.0",
+    "lodash": "^4.17.23",
+    "nanoid": "^3.3.8",
+    "validator": "^13.15.22",
+    "@babel/runtime": "^7.26.10",
+    "ajv": "^6.14.0"
   }
 }
diff --git a/yarn.lock b/yarn.lock
index 537a7a94de..7ae7f61717 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -2657,57 +2657,10 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@babel/runtime@npm:^7.12.5, @babel/runtime@npm:^7.18.3, @babel/runtime@npm:^7.2.0, @babel/runtime@npm:^7.24.4, @babel/runtime@npm:^7.5.5, @babel/runtime@npm:^7.6.2, @babel/runtime@npm:^7.7.2, @babel/runtime@npm:^7.8.4, @babel/runtime@npm:^7.8.7":
-  version: 7.24.6
-  resolution: "@babel/runtime@npm:7.24.6"
-  dependencies:
-    regenerator-runtime: "npm:^0.14.0"
-  checksum: 10c0/224ad205de33ea28979baaec89eea4c4d4e9482000dd87d15b97859365511cdd4d06517712504024f5d33a5fb9412f9b91c96f1d923974adf9359e1575cde049
-  languageName: node
-  linkType: hard
-
-"@babel/runtime@npm:^7.18.6":
-  version: 7.24.0
-  resolution: "@babel/runtime@npm:7.24.0"
-  dependencies:
-    regenerator-runtime: "npm:^0.14.0"
-  checksum: 10c0/3495eed727bf4a4f84c35bb51ab53317ae38f4bbc3b1d0a8303751f9dfa0ce6f5fb2afced72b76c3dd0d8bb2ccb84787559a4dee9886291a36b26f02f0f759b4
-  languageName: node
-  linkType: hard
-
-"@babel/runtime@npm:^7.20.1":
-  version: 7.22.15
-  resolution: "@babel/runtime@npm:7.22.15"
-  dependencies:
-    regenerator-runtime: "npm:^0.14.0"
-  checksum: 10c0/96b74adfd1db812d06ed56d9db12acecfc844d252b93994ce4901433957bd28affba725622a4dc9e7f76384c4cb6cadc3d620d07817c8be9156eaedba5eea059
-  languageName: node
-  linkType: hard
-
-"@babel/runtime@npm:^7.20.13":
-  version: 7.23.9
-  resolution: "@babel/runtime@npm:7.23.9"
-  dependencies:
-    regenerator-runtime: "npm:^0.14.0"
-  checksum: 10c0/e71205fdd7082b2656512cc98e647d9ea7e222e4fe5c36e9e5adc026446fcc3ba7b3cdff8b0b694a0b78bb85db83e7b1e3d4c56ef90726682b74f13249cf952d
-  languageName: node
-  linkType: hard
-
-"@babel/runtime@npm:^7.21.0":
-  version: 7.22.5
-  resolution: "@babel/runtime@npm:7.22.5"
-  dependencies:
-    regenerator-runtime: "npm:^0.13.11"
-  checksum: 10c0/11dcaeecd2246857ccf22f939fcae28a58d29e410607bfa28b95d9b03e298a3e3df8a530e22637d5bfccfc1661fb39cc50c06b404b5d53454bd93889c7dd3eb8
-  languageName: node
-  linkType: hard
-
-"@babel/runtime@npm:~7.18.3":
-  version: 7.18.9
-  resolution: "@babel/runtime@npm:7.18.9"
-  dependencies:
-    regenerator-runtime: "npm:^0.13.4"
-  checksum: 10c0/f996fca79e2cd3c80289c2655e95358254f0437ca28cf10ec4343498dd4a59002fc506d5ce6f37019f1a961e8f26ce43523844ee5a87412d32c17a8ef2f608ee
+"@babel/runtime@npm:^7.26.10":
+  version: 7.28.6
+  resolution: "@babel/runtime@npm:7.28.6"
+  checksum: 10c0/358cf2429992ac1c466df1a21c1601d595c46930a13c1d4662fde908d44ee78ec3c183aaff513ecb01ef8c55c3624afe0309eeeb34715672dbfadb7feedb2c0d
   languageName: node
   linkType: hard
 
@@ -8824,7 +8777,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@types/eslint-scope@npm:^3.7.3":
+"@types/eslint-scope@npm:^3.7.7":
   version: 3.7.7
   resolution: "@types/eslint-scope@npm:3.7.7"
   dependencies:
@@ -8853,7 +8806,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@types/estree@npm:*, @types/estree@npm:^1.0.0, @types/estree@npm:^1.0.6":
+"@types/estree@npm:*, @types/estree@npm:^1.0.0, @types/estree@npm:^1.0.6, @types/estree@npm:^1.0.8":
   version: 1.0.8
   resolution: "@types/estree@npm:1.0.8"
   checksum: 10c0/39d34d1afaa338ab9763f37ad6066e3f349444f9052b9676a7cc0252ef9485a41c6d81c9c4e0d26e9077993354edf25efc853f3224dd4b447175ef62bdcc86a5
@@ -8867,13 +8820,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@types/estree@npm:^1.0.5":
-  version: 1.0.5
-  resolution: "@types/estree@npm:1.0.5"
-  checksum: 10c0/b3b0e334288ddb407c7b3357ca67dbee75ee22db242ca7c56fe27db4e1a31989cb8af48a84dd401deb787fe10cc6b2ab1ee82dc4783be87ededbe3d53c79c70d
-  languageName: node
-  linkType: hard
-
 "@types/express-serve-static-core@npm:4.17.43":
   version: 4.17.43
   resolution: "@types/express-serve-static-core@npm:4.17.43"
@@ -10001,154 +9947,154 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@webassemblyjs/ast@npm:1.12.1, @webassemblyjs/ast@npm:^1.12.1":
-  version: 1.12.1
-  resolution: "@webassemblyjs/ast@npm:1.12.1"
+"@webassemblyjs/ast@npm:1.14.1, @webassemblyjs/ast@npm:^1.14.1":
+  version: 1.14.1
+  resolution: "@webassemblyjs/ast@npm:1.14.1"
   dependencies:
-    "@webassemblyjs/helper-numbers": "npm:1.11.6"
-    "@webassemblyjs/helper-wasm-bytecode": "npm:1.11.6"
-  checksum: 10c0/ba7f2b96c6e67e249df6156d02c69eb5f1bd18d5005303cdc42accb053bebbbde673826e54db0437c9748e97abd218366a1d13fa46859b23cde611b6b409998c
+    "@webassemblyjs/helper-numbers": "npm:1.13.2"
+    "@webassemblyjs/helper-wasm-bytecode": "npm:1.13.2"
+  checksum: 10c0/67a59be8ed50ddd33fbb2e09daa5193ac215bf7f40a9371be9a0d9797a114d0d1196316d2f3943efdb923a3d809175e1563a3cb80c814fb8edccd1e77494972b
   languageName: node
   linkType: hard
 
-"@webassemblyjs/floating-point-hex-parser@npm:1.11.6":
-  version: 1.11.6
-  resolution: "@webassemblyjs/floating-point-hex-parser@npm:1.11.6"
-  checksum: 10c0/37fe26f89e18e4ca0e7d89cfe3b9f17cfa327d7daf906ae01400416dbb2e33c8a125b4dc55ad7ff405e5fcfb6cf0d764074c9bc532b9a31a71e762be57d2ea0a
+"@webassemblyjs/floating-point-hex-parser@npm:1.13.2":
+  version: 1.13.2
+  resolution: "@webassemblyjs/floating-point-hex-parser@npm:1.13.2"
+  checksum: 10c0/0e88bdb8b50507d9938be64df0867f00396b55eba9df7d3546eb5dc0ca64d62e06f8d881ec4a6153f2127d0f4c11d102b6e7d17aec2f26bb5ff95a5e60652412
   languageName: node
   linkType: hard
 
-"@webassemblyjs/helper-api-error@npm:1.11.6":
-  version: 1.11.6
-  resolution: "@webassemblyjs/helper-api-error@npm:1.11.6"
-  checksum: 10c0/a681ed51863e4ff18cf38d223429f414894e5f7496856854d9a886eeddcee32d7c9f66290f2919c9bb6d2fc2b2fae3f989b6a1e02a81e829359738ea0c4d371a
+"@webassemblyjs/helper-api-error@npm:1.13.2":
+  version: 1.13.2
+  resolution: "@webassemblyjs/helper-api-error@npm:1.13.2"
+  checksum: 10c0/31be497f996ed30aae4c08cac3cce50c8dcd5b29660383c0155fce1753804fc55d47fcba74e10141c7dd2899033164e117b3bcfcda23a6b043e4ded4f1003dfb
   languageName: node
   linkType: hard
 
-"@webassemblyjs/helper-buffer@npm:1.12.1":
-  version: 1.12.1
-  resolution: "@webassemblyjs/helper-buffer@npm:1.12.1"
-  checksum: 10c0/0270724afb4601237410f7fd845ab58ccda1d5456a8783aadfb16eaaf3f2c9610c28e4a5bcb6ad880cde5183c82f7f116d5ccfc2310502439d33f14b6888b48a
+"@webassemblyjs/helper-buffer@npm:1.14.1":
+  version: 1.14.1
+  resolution: "@webassemblyjs/helper-buffer@npm:1.14.1"
+  checksum: 10c0/0d54105dc373c0fe6287f1091e41e3a02e36cdc05e8cf8533cdc16c59ff05a646355415893449d3768cda588af451c274f13263300a251dc11a575bc4c9bd210
   languageName: node
   linkType: hard
 
-"@webassemblyjs/helper-numbers@npm:1.11.6":
-  version: 1.11.6
-  resolution: "@webassemblyjs/helper-numbers@npm:1.11.6"
+"@webassemblyjs/helper-numbers@npm:1.13.2":
+  version: 1.13.2
+  resolution: "@webassemblyjs/helper-numbers@npm:1.13.2"
   dependencies:
-    "@webassemblyjs/floating-point-hex-parser": "npm:1.11.6"
-    "@webassemblyjs/helper-api-error": "npm:1.11.6"
+    "@webassemblyjs/floating-point-hex-parser": "npm:1.13.2"
+    "@webassemblyjs/helper-api-error": "npm:1.13.2"
     "@xtuc/long": "npm:4.2.2"
-  checksum: 10c0/c7d5afc0ff3bd748339b466d8d2f27b908208bf3ff26b2e8e72c39814479d486e0dca6f3d4d776fd9027c1efe05b5c0716c57a23041eb34473892b2731c33af3
+  checksum: 10c0/9c46852f31b234a8fb5a5a9d3f027bc542392a0d4de32f1a9c0075d5e8684aa073cb5929b56df565500b3f9cc0a2ab983b650314295b9bf208d1a1651bfc825a
   languageName: node
   linkType: hard
 
-"@webassemblyjs/helper-wasm-bytecode@npm:1.11.6":
-  version: 1.11.6
-  resolution: "@webassemblyjs/helper-wasm-bytecode@npm:1.11.6"
-  checksum: 10c0/79d2bebdd11383d142745efa32781249745213af8e022651847382685ca76709f83e1d97adc5f0d3c2b8546bf02864f8b43a531fdf5ca0748cb9e4e0ef2acaa5
+"@webassemblyjs/helper-wasm-bytecode@npm:1.13.2":
+  version: 1.13.2
+  resolution: "@webassemblyjs/helper-wasm-bytecode@npm:1.13.2"
+  checksum: 10c0/c4355d14f369b30cf3cbdd3acfafc7d0488e086be6d578e3c9780bd1b512932352246be96e034e2a7fcfba4f540ec813352f312bfcbbfe5bcfbf694f82ccc682
   languageName: node
   linkType: hard
 
-"@webassemblyjs/helper-wasm-section@npm:1.12.1":
-  version: 1.12.1
-  resolution: "@webassemblyjs/helper-wasm-section@npm:1.12.1"
+"@webassemblyjs/helper-wasm-section@npm:1.14.1":
+  version: 1.14.1
+  resolution: "@webassemblyjs/helper-wasm-section@npm:1.14.1"
   dependencies:
-    "@webassemblyjs/ast": "npm:1.12.1"
-    "@webassemblyjs/helper-buffer": "npm:1.12.1"
-    "@webassemblyjs/helper-wasm-bytecode": "npm:1.11.6"
-    "@webassemblyjs/wasm-gen": "npm:1.12.1"
-  checksum: 10c0/0546350724d285ae3c26e6fc444be4c3b5fb824f3be0ec8ceb474179dc3f4430336dd2e36a44b3e3a1a6815960e5eec98cd9b3a8ec66dc53d86daedd3296a6a2
+    "@webassemblyjs/ast": "npm:1.14.1"
+    "@webassemblyjs/helper-buffer": "npm:1.14.1"
+    "@webassemblyjs/helper-wasm-bytecode": "npm:1.13.2"
+    "@webassemblyjs/wasm-gen": "npm:1.14.1"
+  checksum: 10c0/1f9b33731c3c6dbac3a9c483269562fa00d1b6a4e7133217f40e83e975e636fd0f8736e53abd9a47b06b66082ecc976c7384391ab0a68e12d509ea4e4b948d64
   languageName: node
   linkType: hard
 
-"@webassemblyjs/ieee754@npm:1.11.6":
-  version: 1.11.6
-  resolution: "@webassemblyjs/ieee754@npm:1.11.6"
+"@webassemblyjs/ieee754@npm:1.13.2":
+  version: 1.13.2
+  resolution: "@webassemblyjs/ieee754@npm:1.13.2"
   dependencies:
     "@xtuc/ieee754": "npm:^1.2.0"
-  checksum: 10c0/59de0365da450322c958deadade5ec2d300c70f75e17ae55de3c9ce564deff5b429e757d107c7ec69bd0ba169c6b6cc2ff66293ab7264a7053c829b50ffa732f
+  checksum: 10c0/2e732ca78c6fbae3c9b112f4915d85caecdab285c0b337954b180460290ccd0fb00d2b1dc4bb69df3504abead5191e0d28d0d17dfd6c9d2f30acac8c4961c8a7
   languageName: node
   linkType: hard
 
-"@webassemblyjs/leb128@npm:1.11.6":
-  version: 1.11.6
-  resolution: "@webassemblyjs/leb128@npm:1.11.6"
+"@webassemblyjs/leb128@npm:1.13.2":
+  version: 1.13.2
+  resolution: "@webassemblyjs/leb128@npm:1.13.2"
   dependencies:
     "@xtuc/long": "npm:4.2.2"
-  checksum: 10c0/cb344fc04f1968209804de4da018679c5d4708a03b472a33e0fa75657bb024978f570d3ccf9263b7f341f77ecaa75d0e051b9cd4b7bb17a339032cfd1c37f96e
+  checksum: 10c0/dad5ef9e383c8ab523ce432dfd80098384bf01c45f70eb179d594f85ce5db2f80fa8c9cba03adafd85684e6d6310f0d3969a882538975989919329ac4c984659
   languageName: node
   linkType: hard
 
-"@webassemblyjs/utf8@npm:1.11.6":
-  version: 1.11.6
-  resolution: "@webassemblyjs/utf8@npm:1.11.6"
-  checksum: 10c0/14d6c24751a89ad9d801180b0d770f30a853c39f035a15fbc96266d6ac46355227abd27a3fd2eeaa97b4294ced2440a6b012750ae17bafe1a7633029a87b6bee
+"@webassemblyjs/utf8@npm:1.13.2":
+  version: 1.13.2
+  resolution: "@webassemblyjs/utf8@npm:1.13.2"
+  checksum: 10c0/d3fac9130b0e3e5a1a7f2886124a278e9323827c87a2b971e6d0da22a2ba1278ac9f66a4f2e363ecd9fac8da42e6941b22df061a119e5c0335f81006de9ee799
   languageName: node
   linkType: hard
 
-"@webassemblyjs/wasm-edit@npm:^1.12.1":
-  version: 1.12.1
-  resolution: "@webassemblyjs/wasm-edit@npm:1.12.1"
+"@webassemblyjs/wasm-edit@npm:^1.14.1":
+  version: 1.14.1
+  resolution: "@webassemblyjs/wasm-edit@npm:1.14.1"
   dependencies:
-    "@webassemblyjs/ast": "npm:1.12.1"
-    "@webassemblyjs/helper-buffer": "npm:1.12.1"
-    "@webassemblyjs/helper-wasm-bytecode": "npm:1.11.6"
-    "@webassemblyjs/helper-wasm-section": "npm:1.12.1"
-    "@webassemblyjs/wasm-gen": "npm:1.12.1"
-    "@webassemblyjs/wasm-opt": "npm:1.12.1"
-    "@webassemblyjs/wasm-parser": "npm:1.12.1"
-    "@webassemblyjs/wast-printer": "npm:1.12.1"
-  checksum: 10c0/972f5e6c522890743999e0ed45260aae728098801c6128856b310dd21f1ee63435fc7b518e30e0ba1cdafd0d1e38275829c1e4451c3536a1d9e726e07a5bba0b
+    "@webassemblyjs/ast": "npm:1.14.1"
+    "@webassemblyjs/helper-buffer": "npm:1.14.1"
+    "@webassemblyjs/helper-wasm-bytecode": "npm:1.13.2"
+    "@webassemblyjs/helper-wasm-section": "npm:1.14.1"
+    "@webassemblyjs/wasm-gen": "npm:1.14.1"
+    "@webassemblyjs/wasm-opt": "npm:1.14.1"
+    "@webassemblyjs/wasm-parser": "npm:1.14.1"
+    "@webassemblyjs/wast-printer": "npm:1.14.1"
+  checksum: 10c0/5ac4781086a2ca4b320bdbfd965a209655fe8a208ca38d89197148f8597e587c9a2c94fb6bd6f1a7dbd4527c49c6844fcdc2af981f8d793a97bf63a016aa86d2
   languageName: node
   linkType: hard
 
-"@webassemblyjs/wasm-gen@npm:1.12.1":
-  version: 1.12.1
-  resolution: "@webassemblyjs/wasm-gen@npm:1.12.1"
+"@webassemblyjs/wasm-gen@npm:1.14.1":
+  version: 1.14.1
+  resolution: "@webassemblyjs/wasm-gen@npm:1.14.1"
   dependencies:
-    "@webassemblyjs/ast": "npm:1.12.1"
-    "@webassemblyjs/helper-wasm-bytecode": "npm:1.11.6"
-    "@webassemblyjs/ieee754": "npm:1.11.6"
-    "@webassemblyjs/leb128": "npm:1.11.6"
-    "@webassemblyjs/utf8": "npm:1.11.6"
-  checksum: 10c0/1e257288177af9fa34c69cab94f4d9036ebed611f77f3897c988874e75182eeeec759c79b89a7a49dd24624fc2d3d48d5580b62b67c4a1c9bfbdcd266b281c16
+    "@webassemblyjs/ast": "npm:1.14.1"
+    "@webassemblyjs/helper-wasm-bytecode": "npm:1.13.2"
+    "@webassemblyjs/ieee754": "npm:1.13.2"
+    "@webassemblyjs/leb128": "npm:1.13.2"
+    "@webassemblyjs/utf8": "npm:1.13.2"
+  checksum: 10c0/d678810d7f3f8fecb2e2bdadfb9afad2ec1d2bc79f59e4711ab49c81cec578371e22732d4966f59067abe5fba8e9c54923b57060a729d28d408e608beef67b10
   languageName: node
   linkType: hard
 
-"@webassemblyjs/wasm-opt@npm:1.12.1":
-  version: 1.12.1
-  resolution: "@webassemblyjs/wasm-opt@npm:1.12.1"
+"@webassemblyjs/wasm-opt@npm:1.14.1":
+  version: 1.14.1
+  resolution: "@webassemblyjs/wasm-opt@npm:1.14.1"
   dependencies:
-    "@webassemblyjs/ast": "npm:1.12.1"
-    "@webassemblyjs/helper-buffer": "npm:1.12.1"
-    "@webassemblyjs/wasm-gen": "npm:1.12.1"
-    "@webassemblyjs/wasm-parser": "npm:1.12.1"
-  checksum: 10c0/992a45e1f1871033c36987459436ab4e6430642ca49328e6e32a13de9106fe69ae6c0ac27d7050efd76851e502d11cd1ac0e06b55655dfa889ad82f11a2712fb
+    "@webassemblyjs/ast": "npm:1.14.1"
+    "@webassemblyjs/helper-buffer": "npm:1.14.1"
+    "@webassemblyjs/wasm-gen": "npm:1.14.1"
+    "@webassemblyjs/wasm-parser": "npm:1.14.1"
+  checksum: 10c0/515bfb15277ee99ba6b11d2232ddbf22aed32aad6d0956fe8a0a0a004a1b5a3a277a71d9a3a38365d0538ac40d1b7b7243b1a244ad6cd6dece1c1bb2eb5de7ee
   languageName: node
   linkType: hard
 
-"@webassemblyjs/wasm-parser@npm:1.12.1, @webassemblyjs/wasm-parser@npm:^1.12.1":
-  version: 1.12.1
-  resolution: "@webassemblyjs/wasm-parser@npm:1.12.1"
+"@webassemblyjs/wasm-parser@npm:1.14.1, @webassemblyjs/wasm-parser@npm:^1.14.1":
+  version: 1.14.1
+  resolution: "@webassemblyjs/wasm-parser@npm:1.14.1"
   dependencies:
-    "@webassemblyjs/ast": "npm:1.12.1"
-    "@webassemblyjs/helper-api-error": "npm:1.11.6"
-    "@webassemblyjs/helper-wasm-bytecode": "npm:1.11.6"
-    "@webassemblyjs/ieee754": "npm:1.11.6"
-    "@webassemblyjs/leb128": "npm:1.11.6"
-    "@webassemblyjs/utf8": "npm:1.11.6"
-  checksum: 10c0/e85cec1acad07e5eb65b92d37c8e6ca09c6ca50d7ca58803a1532b452c7321050a0328c49810c337cc2dfd100c5326a54d5ebd1aa5c339ebe6ef10c250323a0e
+    "@webassemblyjs/ast": "npm:1.14.1"
+    "@webassemblyjs/helper-api-error": "npm:1.13.2"
+    "@webassemblyjs/helper-wasm-bytecode": "npm:1.13.2"
+    "@webassemblyjs/ieee754": "npm:1.13.2"
+    "@webassemblyjs/leb128": "npm:1.13.2"
+    "@webassemblyjs/utf8": "npm:1.13.2"
+  checksum: 10c0/95427b9e5addbd0f647939bd28e3e06b8deefdbdadcf892385b5edc70091bf9b92fa5faac3fce8333554437c5d85835afef8c8a7d9d27ab6ba01ffab954db8c6
   languageName: node
   linkType: hard
 
-"@webassemblyjs/wast-printer@npm:1.12.1":
-  version: 1.12.1
-  resolution: "@webassemblyjs/wast-printer@npm:1.12.1"
+"@webassemblyjs/wast-printer@npm:1.14.1":
+  version: 1.14.1
+  resolution: "@webassemblyjs/wast-printer@npm:1.14.1"
   dependencies:
-    "@webassemblyjs/ast": "npm:1.12.1"
+    "@webassemblyjs/ast": "npm:1.14.1"
     "@xtuc/long": "npm:4.2.2"
-  checksum: 10c0/39bf746eb7a79aa69953f194943bbc43bebae98bd7cadd4d8bc8c0df470ca6bf9d2b789effaa180e900fab4e2691983c1f7d41571458bd2a26267f2f0c73705a
+  checksum: 10c0/8d7768608996a052545251e896eac079c98e0401842af8dd4de78fba8d90bd505efb6c537e909cd6dae96e09db3fa2e765a6f26492553a675da56e2db51f9d24
   languageName: node
   linkType: hard
 
@@ -10265,15 +10211,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"acorn-import-assertions@npm:^1.9.0":
-  version: 1.9.0
-  resolution: "acorn-import-assertions@npm:1.9.0"
-  peerDependencies:
-    acorn: ^8
-  checksum: 10c0/3b4a194e128efdc9b86c2b1544f623aba4c1aa70d638f8ab7dc3971a5b4aa4c57bd62f99af6e5325bb5973c55863b4112e708a6f408bad7a138647ca72283afe
-  languageName: node
-  linkType: hard
-
 "acorn-import-attributes@npm:^1.9.5":
   version: 1.9.5
   resolution: "acorn-import-attributes@npm:1.9.5"
@@ -10283,6 +10220,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"acorn-import-phases@npm:^1.0.3":
+  version: 1.0.4
+  resolution: "acorn-import-phases@npm:1.0.4"
+  peerDependencies:
+    acorn: ^8.14.0
+  checksum: 10c0/338eb46fc1aed5544f628344cb9af189450b401d152ceadbf1f5746901a5d923016cd0e7740d5606062d374fdf6941c29bb515d2bd133c4f4242d5d4cd73a3c7
+  languageName: node
+  linkType: hard
+
 "acorn-jsx@npm:^5.3.2":
   version: 5.3.2
   resolution: "acorn-jsx@npm:5.3.2"
@@ -10326,15 +10272,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"acorn@npm:^8.7.1":
-  version: 8.11.3
-  resolution: "acorn@npm:8.11.3"
-  bin:
-    acorn: bin/acorn
-  checksum: 10c0/3ff155f8812e4a746fee8ecff1f227d527c4c45655bb1fad6347c3cb58e46190598217551b1500f18542d2bbe5c87120cb6927f5a074a59166fbdd9468f0a299
-  languageName: node
-  linkType: hard
-
 "acorn@npm:^8.8.2":
   version: 8.10.0
   resolution: "acorn@npm:8.10.0"
@@ -10419,39 +10356,15 @@ __metadata:
   languageName: node
   linkType: hard
 
-"ajv@npm:^6.12.4, ajv@npm:^6.12.5":
-  version: 6.12.6
-  resolution: "ajv@npm:6.12.6"
+"ajv@npm:^6.14.0":
+  version: 6.14.0
+  resolution: "ajv@npm:6.14.0"
   dependencies:
     fast-deep-equal: "npm:^3.1.1"
     fast-json-stable-stringify: "npm:^2.0.0"
     json-schema-traverse: "npm:^0.4.1"
     uri-js: "npm:^4.2.2"
-  checksum: 10c0/41e23642cbe545889245b9d2a45854ebba51cda6c778ebced9649420d9205f2efb39cb43dbc41e358409223b1ea43303ae4839db682c848b891e4811da1a5a71
-  languageName: node
-  linkType: hard
-
-"ajv@npm:^8.0.0, ajv@npm:^8.9.0":
-  version: 8.14.0
-  resolution: "ajv@npm:8.14.0"
-  dependencies:
-    fast-deep-equal: "npm:^3.1.3"
-    json-schema-traverse: "npm:^1.0.0"
-    require-from-string: "npm:^2.0.2"
-    uri-js: "npm:^4.4.1"
-  checksum: 10c0/89aedf51bc3cd2a98214ef8d4081a9d5c02cedbfd28ada48deb9ae3d456fdfe3dc8899cce44736c80b3965840e32ba8827032df6a60af5671f27f47f8082a3bf
-  languageName: node
-  linkType: hard
-
-"ajv@npm:^8.0.1":
-  version: 8.16.0
-  resolution: "ajv@npm:8.16.0"
-  dependencies:
-    fast-deep-equal: "npm:^3.1.3"
-    json-schema-traverse: "npm:^1.0.0"
-    require-from-string: "npm:^2.0.2"
-    uri-js: "npm:^4.4.1"
-  checksum: 10c0/6fc38aa8fd4fbfaa7096ac049e48c0cb440db36b76fef2d7d5b7d92b102735670d055d412d19176c08c9d48eaa9d06661b67e59f04943dc71ab1551e0484f88c
+  checksum: 10c0/a2bc39b0555dc9802c899f86990eb8eed6e366cddbf65be43d5aa7e4f3c4e1a199d5460fd7ca4fb3d864000dbbc049253b72faa83b3b30e641ca52cb29a68c22
   languageName: node
   linkType: hard
 
@@ -11130,6 +11043,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"baseline-browser-mapping@npm:^2.9.0":
+  version: 2.10.0
+  resolution: "baseline-browser-mapping@npm:2.10.0"
+  bin:
+    baseline-browser-mapping: dist/cli.cjs
+  checksum: 10c0/da9c3ec0fcd7f325226a47d2142794d41706b6e0a405718a2c15410bbdb72aacadd65738bedef558c6f1b106ed19458cb25b06f63b66df2c284799905dbbd003
+  languageName: node
+  linkType: hard
+
 "better-path-resolve@npm:1.0.0":
   version: 1.0.0
   resolution: "better-path-resolve@npm:1.0.0"
@@ -11357,7 +11279,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"browserslist@npm:^4.21.10, browserslist@npm:^4.23.0, browserslist@npm:^4.24.0":
+"browserslist@npm:^4.23.0, browserslist@npm:^4.24.0":
   version: 4.28.0
   resolution: "browserslist@npm:4.28.0"
   dependencies:
@@ -11372,6 +11294,21 @@ __metadata:
   languageName: node
   linkType: hard
 
+"browserslist@npm:^4.28.1":
+  version: 4.28.1
+  resolution: "browserslist@npm:4.28.1"
+  dependencies:
+    baseline-browser-mapping: "npm:^2.9.0"
+    caniuse-lite: "npm:^1.0.30001759"
+    electron-to-chromium: "npm:^1.5.263"
+    node-releases: "npm:^2.0.27"
+    update-browserslist-db: "npm:^1.2.0"
+  bin:
+    browserslist: cli.js
+  checksum: 10c0/545a5fa9d7234e3777a7177ec1e9134bb2ba60a69e6b95683f6982b1473aad347c77c1264ccf2ac5dea609a9731fbfbda6b85782bdca70f80f86e28a402504bd
+  languageName: node
+  linkType: hard
+
 "bs-logger@npm:^0.2.6":
   version: 0.2.6
   resolution: "bs-logger@npm:0.2.6"
@@ -11652,6 +11589,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"caniuse-lite@npm:^1.0.30001759":
+  version: 1.0.30001774
+  resolution: "caniuse-lite@npm:1.0.30001774"
+  checksum: 10c0/cc6a340a5421b9a67d8fa80889065ee27b2839ad62993571dded5296e18f02bbf685ce7094e93fe908cddc9fefdfad35d6c010b724cc3d22a6479b0d0b679f8c
+  languageName: node
+  linkType: hard
+
 "case-sensitive-paths-webpack-plugin@npm:^2.4.0":
   version: 2.4.0
   resolution: "case-sensitive-paths-webpack-plugin@npm:2.4.0"
@@ -13510,6 +13454,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"electron-to-chromium@npm:^1.5.263":
+  version: 1.5.302
+  resolution: "electron-to-chromium@npm:1.5.302"
+  checksum: 10c0/014413f2b4ec3a0e043c68f6c07a760d230b14e36b8549c5b124f386a6318d9641e69be2aa0df1877395dd99922745c1722c8ecb3d72205f0f3b3b3dc44c8442
+  languageName: node
+  linkType: hard
+
 "elliptic@npm:^6.5.3, elliptic@npm:^6.5.5":
   version: 6.6.1
   resolution: "elliptic@npm:6.6.1"
@@ -13606,7 +13557,17 @@ __metadata:
   languageName: node
   linkType: hard
 
-"enhanced-resolve@npm:^5.16.0, enhanced-resolve@npm:^5.7.0":
+"enhanced-resolve@npm:^5.19.0":
+  version: 5.19.0
+  resolution: "enhanced-resolve@npm:5.19.0"
+  dependencies:
+    graceful-fs: "npm:^4.2.4"
+    tapable: "npm:^2.3.0"
+  checksum: 10c0/966b1dffb82d5f6a4d6a86e904e812104a999066aa29f9223040aaa751e7c453b462a3f5ef91f8bd4408131ff6f7f90651dd1c804bdcb7944e2099a9c2e45ee2
+  languageName: node
+  linkType: hard
+
+"enhanced-resolve@npm:^5.7.0":
   version: 5.16.1
   resolution: "enhanced-resolve@npm:5.16.1"
   dependencies:
@@ -13822,13 +13783,20 @@ __metadata:
   languageName: node
   linkType: hard
 
-"es-module-lexer@npm:^1.2.1, es-module-lexer@npm:^1.5.0":
+"es-module-lexer@npm:^1.5.0":
   version: 1.5.3
   resolution: "es-module-lexer@npm:1.5.3"
   checksum: 10c0/0f50b655490d1048432eac6eec94d99d3933119666ae82be578c3db1ea4b2c594118a336f6b7a3c4e2815355dcc9a469d880acef1c45aa656a5aae8c8ae8e5f6
   languageName: node
   linkType: hard
 
+"es-module-lexer@npm:^2.0.0":
+  version: 2.0.0
+  resolution: "es-module-lexer@npm:2.0.0"
+  checksum: 10c0/ae78dbbd43035a4b972c46cfb6877e374ea290adfc62bc2f5a083fea242c0b2baaab25c5886af86be55f092f4a326741cb94334cd3c478c383fdc8a9ec5ff817
+  languageName: node
+  linkType: hard
+
 "es-object-atoms@npm:^1.0.0, es-object-atoms@npm:^1.1.1":
   version: 1.1.1
   resolution: "es-object-atoms@npm:1.1.1"
@@ -18517,13 +18485,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"json-schema-traverse@npm:^1.0.0":
-  version: 1.0.0
-  resolution: "json-schema-traverse@npm:1.0.0"
-  checksum: 10c0/71e30015d7f3d6dc1c316d6298047c8ef98a06d31ad064919976583eb61e1018a60a0067338f0f79cabc00d84af3fcc489bd48ce8a46ea165d9541ba17fb30c6
-  languageName: node
-  linkType: hard
-
 "json-schema@npm:^0.4.0":
   version: 0.4.0
   resolution: "json-schema@npm:0.4.0"
@@ -18897,10 +18858,10 @@ __metadata:
   languageName: node
   linkType: hard
 
-"loader-runner@npm:^4.2.0":
-  version: 4.3.0
-  resolution: "loader-runner@npm:4.3.0"
-  checksum: 10c0/a44d78aae0907a72f73966fe8b82d1439c8c485238bd5a864b1b9a2a3257832effa858790241e6b37876b5446a78889adf2fcc8dd897ce54c089ecc0a0ce0bf0
+"loader-runner@npm:^4.3.1":
+  version: 4.3.1
+  resolution: "loader-runner@npm:4.3.1"
+  checksum: 10c0/a523b6329f114e0a98317158e30a7dfce044b731521be5399464010472a93a15ece44757d1eaed1d8845019869c5390218bc1c7c3110f4eeaef5157394486eac
   languageName: node
   linkType: hard
 
@@ -19047,13 +19008,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"lodash@npm:^4.17.20, lodash@npm:^4.17.21":
-  version: 4.17.21
-  resolution: "lodash@npm:4.17.21"
-  checksum: 10c0/d8cbea072bb08655bb4c989da418994b073a608dffa608b09ac04b43a791b12aeae7cd7ad919aa4c925f33b48490b5cfe6c1f71d827956071dae2e7bb3a6b74c
-  languageName: node
-  linkType: hard
-
 "lodash@npm:^4.17.23":
   version: 4.17.23
   resolution: "lodash@npm:4.17.23"
@@ -19178,15 +19132,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"lru-cache@npm:^6.0.0":
-  version: 6.0.0
-  resolution: "lru-cache@npm:6.0.0"
-  dependencies:
-    yallist: "npm:^4.0.0"
-  checksum: 10c0/cb53e582785c48187d7a188d3379c181b5ca2a9c78d2bce3e7dee36f32761d1c42983da3fe12b55cb74e1779fa94cdc2e5367c028a9b35317184ede0c07a30a9
-  languageName: node
-  linkType: hard
-
 "luxon@npm:~3.7.0":
   version: 3.7.2
   resolution: "luxon@npm:3.7.2"
@@ -20272,7 +20217,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"nanoid@npm:^3.3.11":
+"nanoid@npm:^3.3.8":
   version: 3.3.11
   resolution: "nanoid@npm:3.3.11"
   bin:
@@ -20281,15 +20226,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"nanoid@npm:^3.3.6, nanoid@npm:^3.3.7":
-  version: 3.3.7
-  resolution: "nanoid@npm:3.3.7"
-  bin:
-    nanoid: bin/nanoid.cjs
-  checksum: 10c0/e3fb661aa083454f40500473bb69eedb85dc160e763150b9a2c567c7e9ff560ce028a9f833123b618a6ea742e311138b591910e795614a629029e86e180660f3
-  languageName: node
-  linkType: hard
-
 "napi-postinstall@npm:^0.3.0":
   version: 0.3.4
   resolution: "napi-postinstall@npm:0.3.4"
@@ -22974,20 +22910,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"regenerator-runtime@npm:^0.13.11, regenerator-runtime@npm:^0.13.4":
-  version: 0.13.11
-  resolution: "regenerator-runtime@npm:0.13.11"
-  checksum: 10c0/12b069dc774001fbb0014f6a28f11c09ebfe3c0d984d88c9bced77fdb6fedbacbca434d24da9ae9371bfbf23f754869307fb51a4c98a8b8b18e5ef748677ca24
-  languageName: node
-  linkType: hard
-
-"regenerator-runtime@npm:^0.14.0":
-  version: 0.14.0
-  resolution: "regenerator-runtime@npm:0.14.0"
-  checksum: 10c0/e25f062c1a183f81c99681691a342760e65c55e8d3a4d4fe347ebe72433b123754b942b70b622959894e11f8a9131dc549bd3c9a5234677db06a4af42add8d12
-  languageName: node
-  linkType: hard
-
 "regenerator-transform@npm:^0.15.2":
   version: 0.15.2
   resolution: "regenerator-transform@npm:0.15.2"
@@ -23122,13 +23044,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"require-from-string@npm:^2.0.2":
-  version: 2.0.2
-  resolution: "require-from-string@npm:2.0.2"
-  checksum: 10c0/aaa267e0c5b022fc5fd4eef49d8285086b15f2a1c54b28240fdf03599cbd9c26049fee3eab894f2e1f6ca65e513b030a7c264201e3f005601e80c49fb2937ce2
-  languageName: node
-  linkType: hard
-
 "require-in-the-middle@npm:^7.1.1":
   version: 7.1.1
   resolution: "require-in-the-middle@npm:7.1.1"
@@ -23670,7 +23585,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"schema-utils@npm:^3.0.0, schema-utils@npm:^3.1.1, schema-utils@npm:^3.2.0":
+"schema-utils@npm:^3.0.0, schema-utils@npm:^3.1.1":
   version: 3.3.0
   resolution: "schema-utils@npm:3.3.0"
   dependencies:
@@ -23681,7 +23596,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"schema-utils@npm:^4.0.0, schema-utils@npm:^4.3.0":
+"schema-utils@npm:^4.0.0, schema-utils@npm:^4.3.0, schema-utils@npm:^4.3.3":
   version: 4.3.3
   resolution: "schema-utils@npm:4.3.3"
   dependencies:
@@ -23708,11 +23623,11 @@ __metadata:
   linkType: hard
 
 "semver@npm:2 || 3 || 4 || 5, semver@npm:^5.7.1":
-  version: 5.7.1
-  resolution: "semver@npm:5.7.1"
+  version: 5.7.2
+  resolution: "semver@npm:5.7.2"
   bin:
-    semver: ./bin/semver
-  checksum: 10c0/d4884f2aeca28bff35d0bd40ff0a9b2dfc4b36a883bf0ea5dc15d10d9a01bdc9041035b05f825d4b5ac8a56e490703dbf0d986d054de82cc5e9bad3f02ca6e00
+    semver: bin/semver
+  checksum: 10c0/e4cf10f86f168db772ae95d86ba65b3fd6c5967c94d97c708ccb463b778c2ee53b914cd7167620950fc07faf5a564e6efe903836639e512a1aa15fbc9667fa25
   languageName: node
   linkType: hard
 
@@ -23725,38 +23640,16 @@ __metadata:
   languageName: node
   linkType: hard
 
-"semver@npm:^7.0.0, semver@npm:^7.5.3, semver@npm:^7.5.4":
-  version: 7.5.4
-  resolution: "semver@npm:7.5.4"
-  dependencies:
-    lru-cache: "npm:^6.0.0"
-  bin:
-    semver: bin/semver.js
-  checksum: 10c0/5160b06975a38b11c1ab55950cb5b8a23db78df88275d3d8a42ccf1f29e55112ac995b3a26a522c36e3b5f76b0445f1eef70d696b8c7862a2b4303d7b0e7609e
-  languageName: node
-  linkType: hard
-
-"semver@npm:^7.3.5, semver@npm:^7.3.7, semver@npm:^7.3.8, semver@npm:^7.5.2":
-  version: 7.5.2
-  resolution: "semver@npm:7.5.2"
-  dependencies:
-    lru-cache: "npm:^6.0.0"
-  bin:
-    semver: bin/semver.js
-  checksum: 10c0/d151207ab762a8067f6302076edc04e5b8da2362eb9e3f21c2567ceadfd415064936d215b4aae7791da118c230649d29089be979ffa49c5b56a6bcf82147efdd
-  languageName: node
-  linkType: hard
-
-"semver@npm:^7.6.0, semver@npm:^7.6.2":
-  version: 7.6.2
-  resolution: "semver@npm:7.6.2"
+"semver@npm:^7.0.0, semver@npm:^7.3.5, semver@npm:^7.3.7, semver@npm:^7.3.8, semver@npm:^7.5.2, semver@npm:^7.5.3, semver@npm:^7.5.4, semver@npm:^7.6.0, semver@npm:^7.6.2, semver@npm:^7.7.2":
+  version: 7.7.4
+  resolution: "semver@npm:7.7.4"
   bin:
     semver: bin/semver.js
-  checksum: 10c0/97d3441e97ace8be4b1976433d1c32658f6afaff09f143e52c593bae7eef33de19e3e369c88bd985ce1042c6f441c80c6803078d1de2a9988080b66684cbb30c
+  checksum: 10c0/5215ad0234e2845d4ea5bb9d836d42b03499546ddafb12075566899fc617f68794bb6f146076b6881d755de17d6c6cc73372555879ec7dce2c2feee947866ad2
   languageName: node
   linkType: hard
 
-"semver@npm:^7.7.2, semver@npm:^7.7.3":
+"semver@npm:^7.7.3":
   version: 7.7.3
   resolution: "semver@npm:7.7.3"
   bin:
@@ -25195,12 +25088,12 @@ __metadata:
   languageName: node
   linkType: hard
 
-"systeminformation@npm:^5.24.0":
-  version: 5.30.7
-  resolution: "systeminformation@npm:5.30.7"
+"systeminformation@npm:^5.31.0":
+  version: 5.31.1
+  resolution: "systeminformation@npm:5.31.1"
   bin:
     systeminformation: lib/cli.js
-  checksum: 10c0/62588fabe62ec258d56055e609a075fe1eb1da2f090adc8c53e025ad8947d6eb9d3d2889646973fafba9528e06958decbb1def2b989af0363a952c5aff65fbae
+  checksum: 10c0/66dc6a5e696c3ea8c191c32163a1e426d066a73f6084fc538e86d7a148f19ff64449589f06f1f74ec0183cfd0c57e3df565d181bc352fb0ba268d6a6435de7fb
   conditions: (os=darwin | os=linux | os=win32 | os=freebsd | os=openbsd | os=netbsd | os=sunos | os=android)
   languageName: node
   linkType: hard
@@ -25225,13 +25118,20 @@ __metadata:
   languageName: node
   linkType: hard
 
-"tapable@npm:^2.0.0, tapable@npm:^2.1.1, tapable@npm:^2.2.0, tapable@npm:^2.2.1":
+"tapable@npm:^2.0.0, tapable@npm:^2.2.0, tapable@npm:^2.2.1":
   version: 2.2.1
   resolution: "tapable@npm:2.2.1"
   checksum: 10c0/bc40e6efe1e554d075469cedaba69a30eeb373552aaf41caeaaa45bf56ffacc2674261b106245bd566b35d8f3329b52d838e851ee0a852120acae26e622925c9
   languageName: node
   linkType: hard
 
+"tapable@npm:^2.3.0":
+  version: 2.3.0
+  resolution: "tapable@npm:2.3.0"
+  checksum: 10c0/cb9d67cc2c6a74dedc812ef3085d9d681edd2c1fa18e4aef57a3c0605fdbe44e6b8ea00bd9ef21bc74dd45314e39d31227aa031ebf2f5e38164df514136f2681
+  languageName: node
+  linkType: hard
+
 "tar-stream@npm:~2.2.0":
   version: 2.2.0
   resolution: "tar-stream@npm:2.2.0"
@@ -25276,7 +25176,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"terser-webpack-plugin@npm:^5.3.10, terser-webpack-plugin@npm:^5.3.14":
+"terser-webpack-plugin@npm:^5.3.14":
   version: 5.3.14
   resolution: "terser-webpack-plugin@npm:5.3.14"
   dependencies:
@@ -25298,6 +25198,28 @@ __metadata:
   languageName: node
   linkType: hard
 
+"terser-webpack-plugin@npm:^5.3.16":
+  version: 5.3.16
+  resolution: "terser-webpack-plugin@npm:5.3.16"
+  dependencies:
+    "@jridgewell/trace-mapping": "npm:^0.3.25"
+    jest-worker: "npm:^27.4.5"
+    schema-utils: "npm:^4.3.0"
+    serialize-javascript: "npm:^6.0.2"
+    terser: "npm:^5.31.1"
+  peerDependencies:
+    webpack: ^5.1.0
+  peerDependenciesMeta:
+    "@swc/core":
+      optional: true
+    esbuild:
+      optional: true
+    uglify-js:
+      optional: true
+  checksum: 10c0/39e37c5b3015c1a5354a3633f77235677bfa06eac2608ce26d258b1d1a74070a99910319a6f2f2c437eb61dc321f66434febe01d78e73fa96b4d4393b813f4cf
+  languageName: node
+  linkType: hard
+
 "terser@npm:^5.10.0, terser@npm:^5.31.1":
   version: 5.44.1
   resolution: "terser@npm:5.44.1"
@@ -25439,11 +25361,9 @@ __metadata:
   linkType: hard
 
 "tmp@npm:~0.2.1":
-  version: 0.2.1
-  resolution: "tmp@npm:0.2.1"
-  dependencies:
-    rimraf: "npm:^3.0.0"
-  checksum: 10c0/67607aa012059c9ce697bee820ee51bc0f39b29a8766def4f92d3f764d67c7cf9205d537d24e0cb1ce9685c40d4c628ead010910118ea18348666b5c46ed9123
+  version: 0.2.5
+  resolution: "tmp@npm:0.2.5"
+  checksum: 10c0/cee5bb7d674bb4ba3ab3f3841c2ca7e46daeb2109eec395c1ec7329a91d52fcb21032b79ac25161a37b2565c4858fefab927af9735926a113ef7bac9091a6e0e
   languageName: node
   linkType: hard
 
@@ -26351,6 +26271,20 @@ __metadata:
   languageName: node
   linkType: hard
 
+"update-browserslist-db@npm:^1.2.0":
+  version: 1.2.3
+  resolution: "update-browserslist-db@npm:1.2.3"
+  dependencies:
+    escalade: "npm:^3.2.0"
+    picocolors: "npm:^1.1.1"
+  peerDependencies:
+    browserslist: ">= 4.21.0"
+  bin:
+    update-browserslist-db: cli.js
+  checksum: 10c0/13a00355ea822388f68af57410ce3255941d5fb9b7c49342c4709a07c9f230bbef7f7499ae0ca7e0de532e79a82cc0c4edbd125f1a323a1845bf914efddf8bec
+  languageName: node
+  linkType: hard
+
 "uplot-react@npm:^1.2.2":
   version: 1.2.2
   resolution: "uplot-react@npm:1.2.2"
@@ -26368,7 +26302,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"uri-js@npm:^4.2.2, uri-js@npm:^4.4.1":
+"uri-js@npm:^4.2.2":
   version: 4.4.1
   resolution: "uri-js@npm:4.4.1"
   dependencies:
@@ -26567,10 +26501,10 @@ __metadata:
   languageName: node
   linkType: hard
 
-"validator@npm:^13.7.0":
-  version: 13.15.0
-  resolution: "validator@npm:13.15.0"
-  checksum: 10c0/0f13fd7031ac575e8d7828431da8ef5859bac6a38ee65e1d7fdd367dbf1c3d94d95182aecc3183f7fa7a30ff4474bf864d1aff54707620227a2cdbfd36d894c2
+"validator@npm:^13.15.22":
+  version: 13.15.26
+  resolution: "validator@npm:13.15.26"
+  checksum: 10c0/d66041685c531423f6b514d0481228503b96682fe30ed7925ad77ff3cd08c3983dc94f45e18457e44f62f89027b94a3342009d65421800ce65f6e0d2c6eaf7fc
   languageName: node
   linkType: hard
 
@@ -26655,13 +26589,13 @@ __metadata:
   languageName: node
   linkType: hard
 
-"watchpack@npm:^2.4.1":
-  version: 2.4.1
-  resolution: "watchpack@npm:2.4.1"
+"watchpack@npm:^2.5.1":
+  version: 2.5.1
+  resolution: "watchpack@npm:2.5.1"
   dependencies:
     glob-to-regexp: "npm:^0.4.1"
     graceful-fs: "npm:^4.1.2"
-  checksum: 10c0/c694de0a61004e587a8a0fdc9cfec20ee692c52032d9ab2c2e99969a37fdab9e6e1bd3164ed506f9a13f7c83e65563d563e0d6b87358470cdb7309b83db78683
+  checksum: 10c0/dffbb483d1f61be90dc570630a1eb308581e2227d507d783b1d94a57ac7b705ecd9a1a4b73d73c15eab596d39874e5276a3d9cb88bbb698bafc3f8d08c34cf17
   languageName: node
   linkType: hard
 
@@ -26738,10 +26672,10 @@ __metadata:
   languageName: node
   linkType: hard
 
-"webpack-sources@npm:^3.2.3":
-  version: 3.2.3
-  resolution: "webpack-sources@npm:3.2.3"
-  checksum: 10c0/2ef63d77c4fad39de4a6db17323d75eb92897b32674e97d76f0a1e87c003882fc038571266ad0ef581ac734cbe20952912aaa26155f1905e96ce251adbb1eb4e
+"webpack-sources@npm:^3.3.3":
+  version: 3.3.4
+  resolution: "webpack-sources@npm:3.3.4"
+  checksum: 10c0/94a42508531338eb41939cf1d48a4a8a6db97f3a47e5453cff2133a68d3169ca779d4bcbe9dfed072ce16611959eba1e16f085bc2dc56714e1a1c1783fd661a3
   languageName: node
   linkType: hard
 
@@ -26753,39 +26687,40 @@ __metadata:
   linkType: hard
 
 "webpack@npm:5":
-  version: 5.91.0
-  resolution: "webpack@npm:5.91.0"
-  dependencies:
-    "@types/eslint-scope": "npm:^3.7.3"
-    "@types/estree": "npm:^1.0.5"
-    "@webassemblyjs/ast": "npm:^1.12.1"
-    "@webassemblyjs/wasm-edit": "npm:^1.12.1"
-    "@webassemblyjs/wasm-parser": "npm:^1.12.1"
-    acorn: "npm:^8.7.1"
-    acorn-import-assertions: "npm:^1.9.0"
-    browserslist: "npm:^4.21.10"
+  version: 5.105.2
+  resolution: "webpack@npm:5.105.2"
+  dependencies:
+    "@types/eslint-scope": "npm:^3.7.7"
+    "@types/estree": "npm:^1.0.8"
+    "@types/json-schema": "npm:^7.0.15"
+    "@webassemblyjs/ast": "npm:^1.14.1"
+    "@webassemblyjs/wasm-edit": "npm:^1.14.1"
+    "@webassemblyjs/wasm-parser": "npm:^1.14.1"
+    acorn: "npm:^8.15.0"
+    acorn-import-phases: "npm:^1.0.3"
+    browserslist: "npm:^4.28.1"
     chrome-trace-event: "npm:^1.0.2"
-    enhanced-resolve: "npm:^5.16.0"
-    es-module-lexer: "npm:^1.2.1"
+    enhanced-resolve: "npm:^5.19.0"
+    es-module-lexer: "npm:^2.0.0"
     eslint-scope: "npm:5.1.1"
     events: "npm:^3.2.0"
     glob-to-regexp: "npm:^0.4.1"
     graceful-fs: "npm:^4.2.11"
     json-parse-even-better-errors: "npm:^2.3.1"
-    loader-runner: "npm:^4.2.0"
+    loader-runner: "npm:^4.3.1"
     mime-types: "npm:^2.1.27"
     neo-async: "npm:^2.6.2"
-    schema-utils: "npm:^3.2.0"
-    tapable: "npm:^2.1.1"
-    terser-webpack-plugin: "npm:^5.3.10"
-    watchpack: "npm:^2.4.1"
-    webpack-sources: "npm:^3.2.3"
+    schema-utils: "npm:^4.3.3"
+    tapable: "npm:^2.3.0"
+    terser-webpack-plugin: "npm:^5.3.16"
+    watchpack: "npm:^2.5.1"
+    webpack-sources: "npm:^3.3.3"
   peerDependenciesMeta:
     webpack-cli:
       optional: true
   bin:
     webpack: bin/webpack.js
-  checksum: 10c0/74a3e0ea1c9a492accf035317f31769ffeaaab415811524b9f17bc7bf7012c5b6e1a9860df5ca6903f3ae2618727b801eb47d9351a2595dfffb25941d368b88c
+  checksum: 10c0/565df8072c00d72e0a22e136971862b7eac7beb8b8d39a2ae4ab00838941ea58acc5b49dd7ea268e3d839810756cb86ba5c272b3a25904f6db7807cfa8ed0b29
   languageName: node
   linkType: hard
 

From 0b77716b7c8f68aa9d8aed365b3700f337afc044 Mon Sep 17 00:00:00 2001
From: Rahul <254529899+motsc@users.noreply.github.com>
Date: Wed, 25 Feb 2026 10:35:59 -0600
Subject: [PATCH 2/8] fix: add medium-risk resolutions after dependency
 investigation

Investigated with 'yarn why' before adding. All consumers confirmed
to be dev/build-only tooling, not production runtime:

- webpack ^5.105.0: SSRF via buildHttp feature (GHSA-4vvj-4cpr-p986).
  'yarn why webpack' shows only storybook consumers (@storybook/
  builder-webpack5, @storybook/preset-react-webpack). Minor bump
  within 5.x. buildHttp not enabled so also VEX-documented.
- semver ^7.7.3: CVE-2022-25883 ReDoS. semver@5.x consumers (nodemon,
  normalize-package-data) are dev/build deps. semver 7.x API is
  backward-compatible for all common operations.
- tmp ^0.2.4: CVE-2025-54798 insecure file write. Consumers are
  @nx/devkit (~0.2.1) and external-editor via @changesets/cli (^0.0.33).
  Dev-only release tooling, not present in production image.
---
 package.json |  5 ++++-
 yarn.lock    | 56 ++--------------------------------------------------
 2 files changed, 6 insertions(+), 55 deletions(-)

diff --git a/package.json b/package.json
index c5790e4bd8..a57ecd1dd2 100644
--- a/package.json
+++ b/package.json
@@ -82,6 +82,9 @@
     "nanoid": "^3.3.8",
     "validator": "^13.15.22",
     "@babel/runtime": "^7.26.10",
-    "ajv": "^6.14.0"
+    "ajv": "^6.14.0",
+    "webpack": "^5.105.0",
+    "semver": "^7.7.3",
+    "tmp": "^0.2.4"
   }
 }
diff --git a/yarn.lock b/yarn.lock
index 7ae7f61717..459a425cd6 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -20948,13 +20948,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"os-tmpdir@npm:~1.0.2":
-  version: 1.0.2
-  resolution: "os-tmpdir@npm:1.0.2"
-  checksum: 10c0/f438450224f8e2687605a8dd318f0db694b6293c5d835ae509a69e97c8de38b6994645337e5577f5001115470414638978cc49da1cdcc25106dad8738dc69990
-  languageName: node
-  linkType: hard
-
 "outdent@npm:^0.5.0":
   version: 0.5.0
   resolution: "outdent@npm:0.5.0"
@@ -23622,33 +23615,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"semver@npm:2 || 3 || 4 || 5, semver@npm:^5.7.1":
-  version: 5.7.2
-  resolution: "semver@npm:5.7.2"
-  bin:
-    semver: bin/semver
-  checksum: 10c0/e4cf10f86f168db772ae95d86ba65b3fd6c5967c94d97c708ccb463b778c2ee53b914cd7167620950fc07faf5a564e6efe903836639e512a1aa15fbc9667fa25
-  languageName: node
-  linkType: hard
-
-"semver@npm:^6.0.0, semver@npm:^6.3.0, semver@npm:^6.3.1":
-  version: 6.3.1
-  resolution: "semver@npm:6.3.1"
-  bin:
-    semver: bin/semver.js
-  checksum: 10c0/e3d79b609071caa78bcb6ce2ad81c7966a46a7431d9d58b8800cfa9cb6a63699b3899a0e4bcce36167a284578212d9ae6942b6929ba4aa5015c079a67751d42d
-  languageName: node
-  linkType: hard
-
-"semver@npm:^7.0.0, semver@npm:^7.3.5, semver@npm:^7.3.7, semver@npm:^7.3.8, semver@npm:^7.5.2, semver@npm:^7.5.3, semver@npm:^7.5.4, semver@npm:^7.6.0, semver@npm:^7.6.2, semver@npm:^7.7.2":
-  version: 7.7.4
-  resolution: "semver@npm:7.7.4"
-  bin:
-    semver: bin/semver.js
-  checksum: 10c0/5215ad0234e2845d4ea5bb9d836d42b03499546ddafb12075566899fc617f68794bb6f146076b6881d755de17d6c6cc73372555879ec7dce2c2feee947866ad2
-  languageName: node
-  linkType: hard
-
 "semver@npm:^7.7.3":
   version: 7.7.3
   resolution: "semver@npm:7.7.3"
@@ -23658,15 +23624,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"semver@npm:~7.0.0":
-  version: 7.0.0
-  resolution: "semver@npm:7.0.0"
-  bin:
-    semver: bin/semver.js
-  checksum: 10c0/7fd341680a967a0abfd66f3a7d36ba44e52ff5d3e799e9a6cdb01a68160b64ef09be82b4af05459effeecdd836f002c2462555d2821cd890dfdfe36a0d9f56a5
-  languageName: node
-  linkType: hard
-
 "send@npm:^0.19.0":
   version: 0.19.2
   resolution: "send@npm:0.19.2"
@@ -25351,16 +25308,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"tmp@npm:^0.0.33":
-  version: 0.0.33
-  resolution: "tmp@npm:0.0.33"
-  dependencies:
-    os-tmpdir: "npm:~1.0.2"
-  checksum: 10c0/69863947b8c29cabad43fe0ce65cec5bb4b481d15d4b4b21e036b060b3edbf3bc7a5541de1bacb437bb3f7c4538f669752627fdf9b4aaf034cebd172ba373408
-  languageName: node
-  linkType: hard
-
-"tmp@npm:~0.2.1":
+"tmp@npm:^0.2.4":
   version: 0.2.5
   resolution: "tmp@npm:0.2.5"
   checksum: 10c0/cee5bb7d674bb4ba3ab3f3841c2ca7e46daeb2109eec395c1ec7329a91d52fcb21032b79ac25161a37b2565c4858fefab927af9735926a113ef7bac9091a6e0e
@@ -26686,7 +26634,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"webpack@npm:5":
+"webpack@npm:^5.105.0":
   version: 5.105.2
   resolution: "webpack@npm:5.105.2"
   dependencies:

From 97ba82538f1695f42dc687eff2ce1744bf16ce70 Mon Sep 17 00:00:00 2001
From: Rahul <254529899+motsc@users.noreply.github.com>
Date: Wed, 25 Feb 2026 10:36:12 -0600
Subject: [PATCH 3/8] docs: add VEX exceptions for non-exploitable npm
 vulnerabilities

Documents vulnerabilities that cannot be exploited in this deployment
using OpenVEX v0.2.0 format, matching the existing openssl-mongodb.vex.json.

Packages covered:
- elliptic (CVE-2025-14505): transitive build tooling only; ECDSA not
  used at runtime; no upstream patch available
- tar (GHSA-gcfc-fp5p-5248, GHSA-r7qp-cfhv-p84w, GHSA-3787-6prb-h5wc):
  build-only via cacache/node-gyp; not present in production Docker image
- minimatch (GHSA-952p-6rrq-rcjv, GHSA-f8q6-p94x-37v3, GHSA-hj48-42vr-x3v9,
  GHSA-c2qf-rxjj-qqgw): build/test glob patterns only; all inputs are
  developer-controlled, not user-supplied
- playwright (GHSA-pwxv-5w8g-86cp): test-only dep; not deployed
- storybook (GHSA-hpx4-r86g-5jrg): dev-only dep; not deployed
- webpack buildHttp (GHSA-4vvj-4cpr-p986): feature not enabled in config
- bn.js (CVE-2023-46234): internal to elliptic; all inputs are
  developer-controlled crypto parameters
---
 .vex/npm-dev-and-unreachable.vex.json | 94 +++++++++++++++++++++++++++
 1 file changed, 94 insertions(+)
 create mode 100644 .vex/npm-dev-and-unreachable.vex.json

diff --git a/.vex/npm-dev-and-unreachable.vex.json b/.vex/npm-dev-and-unreachable.vex.json
new file mode 100644
index 0000000000..d31939a37f
--- /dev/null
+++ b/.vex/npm-dev-and-unreachable.vex.json
@@ -0,0 +1,94 @@
+{
+  "@context": "https://openvex.dev/ns/v0.2.0",
+  "@id": "https://github.com/hyperdxio/hyperdx/blob/main/.vex/npm-dev-and-unreachable.vex.json",
+  "author": "HyperDX Team",
+  "role": "Supplier",
+  "timestamp": "2026-02-25T00:00:00Z",
+  "version": 1,
+  "statements": [
+    {
+      "vulnerability": { "name": "CVE-2025-14505" },
+      "products": [{ "@id": "pkg:npm/%40hyperdx/api" }, { "@id": "pkg:npm/%40hyperdx/app" }],
+      "status": "not_affected",
+      "justification": "vulnerable_code_not_in_execute_path",
+      "impact_statement": "elliptic is a transitive dependency of crypto build tooling only. ECDSA signing via elliptic is not used at application runtime. No patch is available upstream. The vulnerable code path (malformed public key parsing) is not reachable from any production code."
+    },
+    {
+      "vulnerability": { "name": "GHSA-gcfc-fp5p-5248" },
+      "products": [{ "@id": "pkg:npm/%40hyperdx/api" }, { "@id": "pkg:npm/%40hyperdx/app" }],
+      "status": "not_affected",
+      "justification": "vulnerable_code_not_in_execute_path",
+      "impact_statement": "tar is a build-only dependency pulled in transitively by cacache and node-gyp during npm/yarn install. It is not present in the production Docker image, which is built from the compiled output. The tar vulnerable code path is never executed at application runtime."
+    },
+    {
+      "vulnerability": { "name": "GHSA-r7qp-cfhv-p84w" },
+      "products": [{ "@id": "pkg:npm/%40hyperdx/api" }, { "@id": "pkg:npm/%40hyperdx/app" }],
+      "status": "not_affected",
+      "justification": "vulnerable_code_not_in_execute_path",
+      "impact_statement": "tar is a build-only dependency pulled in transitively by cacache and node-gyp during npm/yarn install. It is not present in the production Docker image. The tar vulnerable code path is never executed at application runtime."
+    },
+    {
+      "vulnerability": { "name": "GHSA-3787-6prb-h5wc" },
+      "products": [{ "@id": "pkg:npm/%40hyperdx/api" }, { "@id": "pkg:npm/%40hyperdx/app" }],
+      "status": "not_affected",
+      "justification": "vulnerable_code_not_in_execute_path",
+      "impact_statement": "tar is a build-only dependency pulled in transitively by cacache and node-gyp during npm/yarn install. It is not present in the production Docker image. The tar vulnerable code path is never executed at application runtime."
+    },
+    {
+      "vulnerability": { "name": "GHSA-952p-6rrq-rcjv" },
+      "products": [{ "@id": "pkg:npm/%40hyperdx/api" }, { "@id": "pkg:npm/%40hyperdx/app" }],
+      "status": "not_affected",
+      "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
+      "impact_statement": "minimatch is used exclusively in build and test tooling (glob patterns for file matching by Jest, ESLint, and similar tools). All glob patterns are developer-defined strings in configuration files, not user-supplied input. A ReDoS attack requires adversary-controlled regex input, which is not possible in this usage context."
+    },
+    {
+      "vulnerability": { "name": "GHSA-f8q6-p94x-37v3" },
+      "products": [{ "@id": "pkg:npm/%40hyperdx/api" }, { "@id": "pkg:npm/%40hyperdx/app" }],
+      "status": "not_affected",
+      "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
+      "impact_statement": "minimatch is used exclusively in build and test tooling (glob patterns for file matching by Jest, ESLint, and similar tools). All glob patterns are developer-defined strings in configuration files, not user-supplied input. A ReDoS attack requires adversary-controlled regex input, which is not possible in this usage context."
+    },
+    {
+      "vulnerability": { "name": "GHSA-hj48-42vr-x3v9" },
+      "products": [{ "@id": "pkg:npm/%40hyperdx/api" }, { "@id": "pkg:npm/%40hyperdx/app" }],
+      "status": "not_affected",
+      "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
+      "impact_statement": "minimatch is used exclusively in build and test tooling (glob patterns for file matching by Jest, ESLint, and similar tools). All glob patterns are developer-defined strings in configuration files, not user-supplied input. A ReDoS attack requires adversary-controlled regex input, which is not possible in this usage context."
+    },
+    {
+      "vulnerability": { "name": "GHSA-c2qf-rxjj-qqgw" },
+      "products": [{ "@id": "pkg:npm/%40hyperdx/api" }, { "@id": "pkg:npm/%40hyperdx/app" }],
+      "status": "not_affected",
+      "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
+      "impact_statement": "minimatch is used exclusively in build and test tooling (glob patterns for file matching by Jest, ESLint, and similar tools). All glob patterns are developer-defined strings in configuration files, not user-supplied input. A ReDoS attack requires adversary-controlled regex input, which is not possible in this usage context."
+    },
+    {
+      "vulnerability": { "name": "GHSA-pwxv-5w8g-86cp" },
+      "products": [{ "@id": "pkg:npm/%40hyperdx/app" }],
+      "status": "not_affected",
+      "justification": "vulnerable_code_not_in_execute_path",
+      "impact_statement": "playwright is a dev/test-only dependency used exclusively for end-to-end testing. It is not installed in the production Docker image and is never executed in the production environment. SSL certificate validation skip only affects test browser sessions, not production traffic."
+    },
+    {
+      "vulnerability": { "name": "GHSA-hpx4-r86g-5jrg" },
+      "products": [{ "@id": "pkg:npm/%40hyperdx/app" }],
+      "status": "not_affected",
+      "justification": "vulnerable_code_not_in_execute_path",
+      "impact_statement": "storybook is a dev-only dependency used for UI component development. It is not installed in the production Docker image, not deployed to any production environment, and its environment variable handling does not affect the production application."
+    },
+    {
+      "vulnerability": { "name": "GHSA-4vvj-4cpr-p986" },
+      "products": [{ "@id": "pkg:npm/%40hyperdx/app" }],
+      "status": "not_affected",
+      "justification": "vulnerable_code_not_in_execute_path",
+      "impact_statement": "webpack's buildHttp feature (SSRF vulnerability) is not enabled in this project's webpack configuration. The HyperDX build uses standard module bundling without remote URL loading. Even if webpack is present in the storybook dev build toolchain, the buildHttp feature is not configured."
+    },
+    {
+      "vulnerability": { "name": "CVE-2023-46234" },
+      "products": [{ "@id": "pkg:npm/%40hyperdx/api" }, { "@id": "pkg:npm/%40hyperdx/app" }],
+      "status": "not_affected",
+      "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
+      "impact_statement": "bn.js is used internally by elliptic for cryptographic operations (ECDH/ECDSA key operations). All inputs to bn.js in this context are developer-controlled cryptographic parameters, not user-supplied data. The infinite loop vulnerability requires adversary-controlled large integer inputs that are not possible in this deployment."
+    }
+  ]
+}

From be101065b03316b3cc2c5129bc00541649e6d5b3 Mon Sep 17 00:00:00 2001
From: Rahul <254529899+motsc@users.noreply.github.com>
Date: Wed, 25 Feb 2026 10:50:12 -0600
Subject: [PATCH 4/8] fix: revert ajv resolution -- breaks table@6 which
 requires ajv@^8

The blanket ajv ^6.14.0 resolution forced stylelint's table dependency
(which requires ajv@^8.0.1) to use ajv@6.x, causing 'Cannot find module
ajv/dist/runtime/equal' at runtime. Yarn resolutions apply across all
consumers regardless of requested major version, so cross-major forcing
is unsafe for packages with split consumer bases.

The ajv@6.x ReDoS advisory is addressed by the existing Dependabot PR #1774
(upgrade to ajv@8.x where applicable) rather than a blanket resolution.
---
 package.json |  1 -
 yarn.lock    | 35 ++++++++++++++++++++++++++++++++++-
 2 files changed, 34 insertions(+), 2 deletions(-)

diff --git a/package.json b/package.json
index a57ecd1dd2..e0e20dc060 100644
--- a/package.json
+++ b/package.json
@@ -82,7 +82,6 @@
     "nanoid": "^3.3.8",
     "validator": "^13.15.22",
     "@babel/runtime": "^7.26.10",
-    "ajv": "^6.14.0",
     "webpack": "^5.105.0",
     "semver": "^7.7.3",
     "tmp": "^0.2.4"
diff --git a/yarn.lock b/yarn.lock
index 459a425cd6..fa4ca51d31 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -10356,7 +10356,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"ajv@npm:^6.14.0":
+"ajv@npm:^6.12.4, ajv@npm:^6.12.5":
   version: 6.14.0
   resolution: "ajv@npm:6.14.0"
   dependencies:
@@ -10368,6 +10368,18 @@ __metadata:
   languageName: node
   linkType: hard
 
+"ajv@npm:^8.0.0, ajv@npm:^8.0.1, ajv@npm:^8.9.0":
+  version: 8.18.0
+  resolution: "ajv@npm:8.18.0"
+  dependencies:
+    fast-deep-equal: "npm:^3.1.3"
+    fast-uri: "npm:^3.0.1"
+    json-schema-traverse: "npm:^1.0.0"
+    require-from-string: "npm:^2.0.2"
+  checksum: 10c0/e7517c426173513a07391be951879932bdf3348feaebd2199f5b901c20f99d60db8cd1591502d4d551dc82f594e82a05c4fe1c70139b15b8937f7afeaed9532f
+  languageName: node
+  linkType: hard
+
 "ansi-colors@npm:^4.1.1, ansi-colors@npm:^4.1.3":
   version: 4.1.3
   resolution: "ansi-colors@npm:4.1.3"
@@ -14895,6 +14907,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"fast-uri@npm:^3.0.1":
+  version: 3.1.0
+  resolution: "fast-uri@npm:3.1.0"
+  checksum: 10c0/44364adca566f70f40d1e9b772c923138d47efeac2ae9732a872baafd77061f26b097ba2f68f0892885ad177becd065520412b8ffeec34b16c99433c5b9e2de7
+  languageName: node
+  linkType: hard
+
 "fast-xml-parser@npm:^4.4.0":
   version: 4.5.3
   resolution: "fast-xml-parser@npm:4.5.3"
@@ -18485,6 +18504,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"json-schema-traverse@npm:^1.0.0":
+  version: 1.0.0
+  resolution: "json-schema-traverse@npm:1.0.0"
+  checksum: 10c0/71e30015d7f3d6dc1c316d6298047c8ef98a06d31ad064919976583eb61e1018a60a0067338f0f79cabc00d84af3fcc489bd48ce8a46ea165d9541ba17fb30c6
+  languageName: node
+  linkType: hard
+
 "json-schema@npm:^0.4.0":
   version: 0.4.0
   resolution: "json-schema@npm:0.4.0"
@@ -23037,6 +23063,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"require-from-string@npm:^2.0.2":
+  version: 2.0.2
+  resolution: "require-from-string@npm:2.0.2"
+  checksum: 10c0/aaa267e0c5b022fc5fd4eef49d8285086b15f2a1c54b28240fdf03599cbd9c26049fee3eab894f2e1f6ca65e513b030a7c264201e3f005601e80c49fb2937ce2
+  languageName: node
+  linkType: hard
+
 "require-in-the-middle@npm:^7.1.1":
   version: 7.1.1
   resolution: "require-in-the-middle@npm:7.1.1"

From f00bcf6d49ef312422c0af147d54ce5ec48d34bd Mon Sep 17 00:00:00 2001
From: Rahul <254529899+motsc@users.noreply.github.com>
Date: Wed, 25 Feb 2026 14:56:17 -0600
Subject: [PATCH 5/8] fix: address Mend.io scan findings -- cross-spawn,
 babel/helpers, path-to-regexp
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Findings from local mend sca scan (10 unique CVEs → 7 after this commit):

Resolutions added:
- cross-spawn ^7.0.6: CVE-2024-21538 ReDoS (GHSA-3xgq-45jj-v275). Only
  consumer of 5.x is spawndamnit via @changesets/cli (dev/release tooling).
  cross-spawn 7.x API is compatible with 5.x for all spawn() call patterns.
- @babel/helpers ^7.26.10: CVE-2025-27789 ReDoS (GHSA-968p-4wvh-cqc8).
  Companion to the existing @babel/runtime resolution; @babel/core@7.24.6
  pulled in an older @babel/helpers that was missed in the initial pass.
- next-query-params 4.3.0: deprecation -- 4.3.1 was accidentally published,
  correct version is 4.3.0. Resolution pins to the stable release.
- msw/path-to-regexp ^6.3.0: CVE-2024-45296 ReDoS (GHSA-9wv6-86v2-598j).
  Scoped resolution targets only msw's dependency subtree, leaving
  express@4.22.1's path-to-regexp@~0.1.12 untouched. msw@2.3.0 now
  uses path-to-regexp@6.3.0 (patched from 6.2.2).

VEX additions (.vex/npm-dev-and-unreachable.vex.json v2):
- CVE-2026-2739 (bn.js): same developer-controlled-input justification
  as the existing CVE-2023-46234 bn.js entry
- GHSA-3ppc-4f35-3m26 (minimatch CVE-2026-26996): extends existing
  minimatch VEX entries with the new ReDoS CVE alias
- GHSA-9wv6-86v2-598j (path-to-regexp): Express consumer is already
  patched (0.1.12 >= 0.1.10); msw consumer is test-only with
  developer-controlled route patterns
- GHSA-5j98-mcp5-4vw2 (glob CLI injection): glob CLI entry point never
  invoked; all installs are already at patched or non-vulnerable versions
---
 .vex/npm-dev-and-unreachable.vex.json |  30 +++++-
 package.json                          |   6 +-
 yarn.lock                             | 138 +++++++++++---------------
 3 files changed, 94 insertions(+), 80 deletions(-)

diff --git a/.vex/npm-dev-and-unreachable.vex.json b/.vex/npm-dev-and-unreachable.vex.json
index d31939a37f..4b9fd13f5a 100644
--- a/.vex/npm-dev-and-unreachable.vex.json
+++ b/.vex/npm-dev-and-unreachable.vex.json
@@ -4,7 +4,7 @@
   "author": "HyperDX Team",
   "role": "Supplier",
   "timestamp": "2026-02-25T00:00:00Z",
-  "version": 1,
+  "version": 2,
   "statements": [
     {
       "vulnerability": { "name": "CVE-2025-14505" },
@@ -89,6 +89,34 @@
       "status": "not_affected",
       "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
       "impact_statement": "bn.js is used internally by elliptic for cryptographic operations (ECDH/ECDSA key operations). All inputs to bn.js in this context are developer-controlled cryptographic parameters, not user-supplied data. The infinite loop vulnerability requires adversary-controlled large integer inputs that are not possible in this deployment."
+    },
+    {
+      "vulnerability": { "name": "CVE-2026-2739" },
+      "products": [{ "@id": "pkg:npm/%40hyperdx/api" }, { "@id": "pkg:npm/%40hyperdx/app" }],
+      "status": "not_affected",
+      "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
+      "impact_statement": "bn.js is used internally by elliptic for cryptographic operations. All inputs to bn.js are developer-controlled cryptographic parameters, not user-supplied data. The vulnerability requires adversary-controlled large integer inputs that are not possible in this deployment."
+    },
+    {
+      "vulnerability": { "name": "GHSA-3ppc-4f35-3m26" },
+      "products": [{ "@id": "pkg:npm/%40hyperdx/api" }, { "@id": "pkg:npm/%40hyperdx/app" }],
+      "status": "not_affected",
+      "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
+      "impact_statement": "minimatch (CVE-2026-26996) is used exclusively in build and test tooling (glob patterns for file matching by Jest, ESLint, and similar tools). All glob patterns are developer-defined strings in configuration files, not user-supplied input. A ReDoS attack requires adversary-controlled regex input, which is not possible in this usage context."
+    },
+    {
+      "vulnerability": { "name": "GHSA-9wv6-86v2-598j" },
+      "products": [{ "@id": "pkg:npm/%40hyperdx/api" }, { "@id": "pkg:npm/%40hyperdx/app" }],
+      "status": "not_affected",
+      "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
+      "impact_statement": "path-to-regexp has two consumers: (1) express@4.22.1 uses path-to-regexp@0.1.12 which is already patched (vulnerability fixed in >=0.1.10); (2) msw@2.3.0 uses path-to-regexp@6.2.2 (vulnerable <6.3.0) but msw is a test-only mock service worker — all route patterns are developer-defined in test code, never user-supplied input, and msw is not deployed to production."
+    },
+    {
+      "vulnerability": { "name": "GHSA-5j98-mcp5-4vw2" },
+      "products": [{ "@id": "pkg:npm/%40hyperdx/api" }, { "@id": "pkg:npm/%40hyperdx/app" }],
+      "status": "not_affected",
+      "justification": "vulnerable_code_not_in_execute_path",
+      "impact_statement": "glob's CLI command injection vulnerability (CVE-2024-21538 variant) requires invoking glob as a CLI tool with the -c/--cmd flag. glob is used exclusively as a JavaScript module for file-pattern matching in build tools (Jest, ESLint, cacache, node-gyp). The CLI entry point is never invoked in this project. Additionally, glob@10.5.0 (patched) and glob@7.x/9.x (not in vulnerable range >=10.2.0,<10.5.0) are the only versions installed."
     }
   ]
 }
diff --git a/package.json b/package.json
index e0e20dc060..cf00ada2db 100644
--- a/package.json
+++ b/package.json
@@ -82,8 +82,12 @@
     "nanoid": "^3.3.8",
     "validator": "^13.15.22",
     "@babel/runtime": "^7.26.10",
+    "@babel/helpers": "^7.26.10",
+    "cross-spawn": "^7.0.6",
+    "next-query-params": "4.3.0",
     "webpack": "^5.105.0",
     "semver": "^7.7.3",
-    "tmp": "^0.2.4"
+    "tmp": "^0.2.4",
+    "msw/path-to-regexp": "^6.3.0"
   }
 }
diff --git a/yarn.lock b/yarn.lock
index fa4ca51d31..51081e5d3c 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -1040,6 +1040,17 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@babel/code-frame@npm:^7.28.6":
+  version: 7.29.0
+  resolution: "@babel/code-frame@npm:7.29.0"
+  dependencies:
+    "@babel/helper-validator-identifier": "npm:^7.28.5"
+    js-tokens: "npm:^4.0.0"
+    picocolors: "npm:^1.1.1"
+  checksum: 10c0/d34cc504e7765dfb576a663d97067afb614525806b5cad1a5cc1a7183b916fec8ff57fa233585e3926fd5a9e6b31aae6df91aa81ae9775fb7a28f658d3346f0d
+  languageName: node
+  linkType: hard
+
 "@babel/compat-data@npm:^7.22.6, @babel/compat-data@npm:^7.24.6, @babel/compat-data@npm:^7.27.2":
   version: 7.28.5
   resolution: "@babel/compat-data@npm:7.28.5"
@@ -1474,23 +1485,13 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@babel/helpers@npm:^7.24.6":
-  version: 7.24.6
-  resolution: "@babel/helpers@npm:7.24.6"
-  dependencies:
-    "@babel/template": "npm:^7.24.6"
-    "@babel/types": "npm:^7.24.6"
-  checksum: 10c0/e5b5c0919fd6fa56ae11c15a72962d8de0ac19db524849554af28cf08ac32f9ae5aee49a43146eb150f54418cefb8e890fa2b2f33d029434dc7777dbcdfd5bac
-  languageName: node
-  linkType: hard
-
-"@babel/helpers@npm:^7.28.4":
-  version: 7.28.4
-  resolution: "@babel/helpers@npm:7.28.4"
+"@babel/helpers@npm:^7.26.10":
+  version: 7.28.6
+  resolution: "@babel/helpers@npm:7.28.6"
   dependencies:
-    "@babel/template": "npm:^7.27.2"
-    "@babel/types": "npm:^7.28.4"
-  checksum: 10c0/aaa5fb8098926dfed5f223adf2c5e4c7fbba4b911b73dfec2d7d3083f8ba694d201a206db673da2d9b3ae8c01793e795767654558c450c8c14b4c2175b4fcb44
+    "@babel/template": "npm:^7.28.6"
+    "@babel/types": "npm:^7.28.6"
+  checksum: 10c0/c4a779c66396bb0cf619402d92f1610601ff3832db2d3b86b9c9dd10983bf79502270e97ac6d5280cea1b1a37de2f06ecbac561bd2271545270407fbe64027cb
   languageName: node
   linkType: hard
 
@@ -1557,6 +1558,17 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@babel/parser@npm:^7.28.6":
+  version: 7.29.0
+  resolution: "@babel/parser@npm:7.29.0"
+  dependencies:
+    "@babel/types": "npm:^7.29.0"
+  bin:
+    parser: ./bin/babel-parser.js
+  checksum: 10c0/333b2aa761264b91577a74bee86141ef733f9f9f6d4fc52548e4847dc35dfbf821f58c46832c637bfa761a6d9909d6a68f7d1ed59e17e4ffbb958dc510c17b62
+  languageName: node
+  linkType: hard
+
 "@babel/plugin-bugfix-firefox-class-in-computed-class-key@npm:^7.24.6":
   version: 7.24.6
   resolution: "@babel/plugin-bugfix-firefox-class-in-computed-class-key@npm:7.24.6"
@@ -2686,6 +2698,17 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@babel/template@npm:^7.28.6":
+  version: 7.28.6
+  resolution: "@babel/template@npm:7.28.6"
+  dependencies:
+    "@babel/code-frame": "npm:^7.28.6"
+    "@babel/parser": "npm:^7.28.6"
+    "@babel/types": "npm:^7.28.6"
+  checksum: 10c0/66d87225ed0bc77f888181ae2d97845021838c619944877f7c4398c6748bcf611f216dfd6be74d39016af502bca876e6ce6873db3c49e4ac354c56d34d57e9f5
+  languageName: node
+  linkType: hard
+
 "@babel/traverse@npm:^7.18.9, @babel/traverse@npm:^7.27.1, @babel/traverse@npm:^7.28.0, @babel/traverse@npm:^7.28.3, @babel/traverse@npm:^7.28.5":
   version: 7.28.5
   resolution: "@babel/traverse@npm:7.28.5"
@@ -2737,7 +2760,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@babel/types@npm:^7.0.0, @babel/types@npm:^7.20.7, @babel/types@npm:^7.26.0, @babel/types@npm:^7.27.1, @babel/types@npm:^7.27.3, @babel/types@npm:^7.28.2, @babel/types@npm:^7.28.4, @babel/types@npm:^7.28.5, @babel/types@npm:^7.3.3":
+"@babel/types@npm:^7.0.0, @babel/types@npm:^7.20.7, @babel/types@npm:^7.26.0, @babel/types@npm:^7.27.1, @babel/types@npm:^7.27.3, @babel/types@npm:^7.28.2, @babel/types@npm:^7.28.5, @babel/types@npm:^7.3.3":
   version: 7.28.5
   resolution: "@babel/types@npm:7.28.5"
   dependencies:
@@ -2769,6 +2792,16 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@babel/types@npm:^7.28.6, @babel/types@npm:^7.29.0":
+  version: 7.29.0
+  resolution: "@babel/types@npm:7.29.0"
+  dependencies:
+    "@babel/helper-string-parser": "npm:^7.27.1"
+    "@babel/helper-validator-identifier": "npm:^7.28.5"
+  checksum: 10c0/23cc3466e83bcbfab8b9bd0edaafdb5d4efdb88b82b3be6728bbade5ba2f0996f84f63b1c5f7a8c0d67efded28300898a5f930b171bb40b311bca2029c4e9b4f
+  languageName: node
+  linkType: hard
+
 "@babel/types@npm:^7.8.3":
   version: 7.25.6
   resolution: "@babel/types@npm:7.25.6"
@@ -12437,18 +12470,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"cross-spawn@npm:^5.1.0":
-  version: 5.1.0
-  resolution: "cross-spawn@npm:5.1.0"
-  dependencies:
-    lru-cache: "npm:^4.0.1"
-    shebang-command: "npm:^1.2.0"
-    which: "npm:^1.2.9"
-  checksum: 10c0/1918621fddb9f8c61e02118b2dbf81f611ccd1544ceaca0d026525341832b8511ce2504c60f935dbc06b35e5ef156fe8c1e72708c27dd486f034e9c0e1e07201
-  languageName: node
-  linkType: hard
-
-"cross-spawn@npm:^7.0.0, cross-spawn@npm:^7.0.3, cross-spawn@npm:^7.0.6":
+"cross-spawn@npm:^7.0.6":
   version: 7.0.6
   resolution: "cross-spawn@npm:7.0.6"
   dependencies:
@@ -19139,16 +19161,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"lru-cache@npm:^4.0.1":
-  version: 4.1.5
-  resolution: "lru-cache@npm:4.1.5"
-  dependencies:
-    pseudomap: "npm:^1.0.2"
-    yallist: "npm:^2.1.2"
-  checksum: 10c0/1ca5306814e5add9ec63556d6fd9b24a4ecdeaef8e9cea52cbf30301e6b88c8d8ddc7cab45b59b56eb763e6c45af911585dc89925a074ab65e1502e3fe8103cf
-  languageName: node
-  linkType: hard
-
 "lru-cache@npm:^5.1.1":
   version: 5.1.1
   resolution: "lru-cache@npm:5.1.1"
@@ -20299,16 +20311,16 @@ __metadata:
   languageName: node
   linkType: hard
 
-"next-query-params@npm:^4.3.1":
-  version: 4.3.1
-  resolution: "next-query-params@npm:4.3.1"
+"next-query-params@npm:4.3.0":
+  version: 4.3.0
+  resolution: "next-query-params@npm:4.3.0"
   dependencies:
     tslib: "npm:^2.0.3"
   peerDependencies:
     next: ^10.0.0 || ^11.0.0 || ^12.0.0 || ^13.0.0 || ^14.0.0
     react: ^16.8.0 || ^17.0.0 || ^18.0.0
     use-query-params: ^2.0.0
-  checksum: 10c0/d5752b77b7d3606f36703ac664cf95a75fe0bf1c297c1f06083fe61883a6c037d633558208d4f3e03744b31a079a712ced025da7bdb6f90216eb0ec17b7509a3
+  checksum: 10c0/d6ec3b495700312aa5adb46d8edffc45e053414a25e54cb26adda09576c25992959a29239cb3e5137cdcbc09e6109b01f88c46e54a71d0f6c4c9a65931802a6b
   languageName: node
   linkType: hard
 
@@ -21293,10 +21305,10 @@ __metadata:
   languageName: node
   linkType: hard
 
-"path-to-regexp@npm:^6.2.0":
-  version: 6.2.2
-  resolution: "path-to-regexp@npm:6.2.2"
-  checksum: 10c0/4b60852d3501fd05ca9dd08c70033d73844e5eca14e41f499f069afa8364f780f15c5098002f93bd42af8b3514de62ac6e82a53b5662de881d2b08c9ef21ea6b
+"path-to-regexp@npm:^6.3.0":
+  version: 6.3.0
+  resolution: "path-to-regexp@npm:6.3.0"
+  checksum: 10c0/73b67f4638b41cde56254e6354e46ae3a2ebc08279583f6af3d96fe4664fc75788f74ed0d18ca44fa4a98491b69434f9eee73b97bb5314bd1b5adb700f5c18d6
   languageName: node
   linkType: hard
 
@@ -22135,13 +22147,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"pseudomap@npm:^1.0.2":
-  version: 1.0.2
-  resolution: "pseudomap@npm:1.0.2"
-  checksum: 10c0/5a91ce114c64ed3a6a553aa7d2943868811377388bb31447f9d8028271bae9b05b340fe0b6961a64e45b9c72946aeb0a4ab635e8f7cb3715ffd0ff2beeb6a679
-  languageName: node
-  linkType: hard
-
 "pstree.remy@npm:^1.1.8":
   version: 1.1.8
   resolution: "pstree.remy@npm:1.1.8"
@@ -23870,15 +23875,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"shebang-command@npm:^1.2.0":
-  version: 1.2.0
-  resolution: "shebang-command@npm:1.2.0"
-  dependencies:
-    shebang-regex: "npm:^1.0.0"
-  checksum: 10c0/7b20dbf04112c456b7fc258622dafd566553184ac9b6938dd30b943b065b21dabd3776460df534cc02480db5e1b6aec44700d985153a3da46e7db7f9bd21326d
-  languageName: node
-  linkType: hard
-
 "shebang-command@npm:^2.0.0":
   version: 2.0.0
   resolution: "shebang-command@npm:2.0.0"
@@ -23888,13 +23884,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"shebang-regex@npm:^1.0.0":
-  version: 1.0.0
-  resolution: "shebang-regex@npm:1.0.0"
-  checksum: 10c0/9abc45dee35f554ae9453098a13fdc2f1730e525a5eb33c51f096cc31f6f10a4b38074c1ebf354ae7bffa7229506083844008dfc3bb7818228568c0b2dc1fff2
-  languageName: node
-  linkType: hard
-
 "shebang-regex@npm:^3.0.0":
   version: 3.0.0
   resolution: "shebang-regex@npm:3.0.0"
@@ -26890,7 +26879,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"which@npm:^1.2.9, which@npm:^1.3.1":
+"which@npm:^1.3.1":
   version: 1.3.1
   resolution: "which@npm:1.3.1"
   dependencies:
@@ -27060,13 +27049,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"yallist@npm:^2.1.2":
-  version: 2.1.2
-  resolution: "yallist@npm:2.1.2"
-  checksum: 10c0/0b9e25aa00adf19e01d2bcd4b208aee2b0db643d9927131797b7af5ff69480fc80f1c3db738cbf3946f0bddf39d8f2d0a5709c644fd42d4aa3a4e6e786c087b5
-  languageName: node
-  linkType: hard
-
 "yallist@npm:^3.0.2":
   version: 3.1.1
   resolution: "yallist@npm:3.1.1"

From 2fd3e0471738583bf2e797121a73b9cfefc820d6 Mon Sep 17 00:00:00 2001
From: Rahul <254529899+motsc@users.noreply.github.com>
Date: Thu, 26 Feb 2026 12:40:03 -0600
Subject: [PATCH 6/8] fix(vex): audit and correct all CVE/GHSA IDs

Removed 10 wrong/fabricated entries from npm-dev-and-unreachable.vex.json:
- GHSA-gcfc-fp5p-5248: 404 (fabricated)
- GHSA-r7qp-cfhv-p84w: engine.io, not tar
- GHSA-3787-6prb-h5wc: 404 (fabricated)
- GHSA-952p-6rrq-rcjv: micromatch, not minimatch
- GHSA-hj48-42vr-x3v9: path-parse, not minimatch
- GHSA-c2qf-rxjj-qqgw: semver (already fixed by resolution)
- CVE-2023-46234: browserify-sign, not bn.js
- GHSA-pwxv-5w8g-86cp: 404 (fabricated playwright GHSA)
- GHSA-hpx4-r86g-5jrg: @adobe/css-tools, not storybook

Added verified correct entries:
- tar: GHSA-34x7-hfp2-rc4v, GHSA-83g3-92jg-28cx, GHSA-8qq5-rm4j-mr97, GHSA-r6q2-hw4h-h46w
- storybook: GHSA-mjf5-7g4m-gx5w (WebSocket hijacking)
- webpack buildHttp: GHSA-38r7-794h-5758, GHSA-8fgc-7cc6-rx7x
- Fixed GHSA-4vvj-4cpr-p986 description: DOM Clobbering, not buildHttp SSRF

Removed CVE-2025-9230 from openssl-mongodb.vex.json (not in GitHub Advisory DB).
All remaining entries verified via GitHub Advisory API.
---
 .vex/npm-dev-and-unreachable.vex.json | 66 +++++++++++----------------
 .vex/openssl-mongodb.vex.json         |  9 +---
 2 files changed, 27 insertions(+), 48 deletions(-)

diff --git a/.vex/npm-dev-and-unreachable.vex.json b/.vex/npm-dev-and-unreachable.vex.json
index 4b9fd13f5a..e7dcb30248 100644
--- a/.vex/npm-dev-and-unreachable.vex.json
+++ b/.vex/npm-dev-and-unreachable.vex.json
@@ -3,8 +3,8 @@
   "@id": "https://github.com/hyperdxio/hyperdx/blob/main/.vex/npm-dev-and-unreachable.vex.json",
   "author": "HyperDX Team",
   "role": "Supplier",
-  "timestamp": "2026-02-25T00:00:00Z",
-  "version": 2,
+  "timestamp": "2026-02-26T00:00:00Z",
+  "version": 3,
   "statements": [
     {
       "vulnerability": { "name": "CVE-2025-14505" },
@@ -14,109 +14,95 @@
       "impact_statement": "elliptic is a transitive dependency of crypto build tooling only. ECDSA signing via elliptic is not used at application runtime. No patch is available upstream. The vulnerable code path (malformed public key parsing) is not reachable from any production code."
     },
     {
-      "vulnerability": { "name": "GHSA-gcfc-fp5p-5248" },
+      "vulnerability": { "name": "GHSA-34x7-hfp2-rc4v" },
       "products": [{ "@id": "pkg:npm/%40hyperdx/api" }, { "@id": "pkg:npm/%40hyperdx/app" }],
       "status": "not_affected",
       "justification": "vulnerable_code_not_in_execute_path",
-      "impact_statement": "tar is a build-only dependency pulled in transitively by cacache and node-gyp during npm/yarn install. It is not present in the production Docker image, which is built from the compiled output. The tar vulnerable code path is never executed at application runtime."
+      "impact_statement": "tar is a build-only dependency pulled in transitively by cacache and node-gyp during install. It is not present in the production Docker image. Arbitrary file creation via path traversal requires tar to extract attacker-controlled archives, which never occurs in this deployment."
     },
     {
-      "vulnerability": { "name": "GHSA-r7qp-cfhv-p84w" },
+      "vulnerability": { "name": "GHSA-83g3-92jg-28cx" },
       "products": [{ "@id": "pkg:npm/%40hyperdx/api" }, { "@id": "pkg:npm/%40hyperdx/app" }],
       "status": "not_affected",
       "justification": "vulnerable_code_not_in_execute_path",
-      "impact_statement": "tar is a build-only dependency pulled in transitively by cacache and node-gyp during npm/yarn install. It is not present in the production Docker image. The tar vulnerable code path is never executed at application runtime."
+      "impact_statement": "tar is a build-only dependency pulled in transitively by cacache and node-gyp during install. It is not present in the production Docker image. Hardlink escape via symlink requires extracting attacker-controlled archives, which never occurs in this deployment."
     },
     {
-      "vulnerability": { "name": "GHSA-3787-6prb-h5wc" },
+      "vulnerability": { "name": "GHSA-8qq5-rm4j-mr97" },
       "products": [{ "@id": "pkg:npm/%40hyperdx/api" }, { "@id": "pkg:npm/%40hyperdx/app" }],
       "status": "not_affected",
       "justification": "vulnerable_code_not_in_execute_path",
-      "impact_statement": "tar is a build-only dependency pulled in transitively by cacache and node-gyp during npm/yarn install. It is not present in the production Docker image. The tar vulnerable code path is never executed at application runtime."
+      "impact_statement": "tar is a build-only dependency pulled in transitively by cacache and node-gyp during install. It is not present in the production Docker image. Symlink overwrite requires extracting attacker-controlled archives, which never occurs in this deployment."
     },
     {
-      "vulnerability": { "name": "GHSA-952p-6rrq-rcjv" },
+      "vulnerability": { "name": "GHSA-r6q2-hw4h-h46w" },
       "products": [{ "@id": "pkg:npm/%40hyperdx/api" }, { "@id": "pkg:npm/%40hyperdx/app" }],
       "status": "not_affected",
-      "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
-      "impact_statement": "minimatch is used exclusively in build and test tooling (glob patterns for file matching by Jest, ESLint, and similar tools). All glob patterns are developer-defined strings in configuration files, not user-supplied input. A ReDoS attack requires adversary-controlled regex input, which is not possible in this usage context."
+      "justification": "vulnerable_code_not_in_execute_path",
+      "impact_statement": "tar is a build-only dependency pulled in transitively by cacache and node-gyp during install. It is not present in the production Docker image. The race condition via Unicode ligature path collision requires extracting attacker-controlled archives, which never occurs in this deployment."
     },
     {
       "vulnerability": { "name": "GHSA-f8q6-p94x-37v3" },
       "products": [{ "@id": "pkg:npm/%40hyperdx/api" }, { "@id": "pkg:npm/%40hyperdx/app" }],
       "status": "not_affected",
       "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
-      "impact_statement": "minimatch is used exclusively in build and test tooling (glob patterns for file matching by Jest, ESLint, and similar tools). All glob patterns are developer-defined strings in configuration files, not user-supplied input. A ReDoS attack requires adversary-controlled regex input, which is not possible in this usage context."
+      "impact_statement": "minimatch is used exclusively in build and test tooling (glob patterns for file matching by Jest, ESLint, and similar tools). All glob patterns are developer-defined strings in configuration files, not user-supplied input. A ReDoS attack requires adversary-controlled pattern input, which is not possible in this usage context."
     },
     {
-      "vulnerability": { "name": "GHSA-hj48-42vr-x3v9" },
+      "vulnerability": { "name": "GHSA-3ppc-4f35-3m26" },
       "products": [{ "@id": "pkg:npm/%40hyperdx/api" }, { "@id": "pkg:npm/%40hyperdx/app" }],
       "status": "not_affected",
       "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
-      "impact_statement": "minimatch is used exclusively in build and test tooling (glob patterns for file matching by Jest, ESLint, and similar tools). All glob patterns are developer-defined strings in configuration files, not user-supplied input. A ReDoS attack requires adversary-controlled regex input, which is not possible in this usage context."
+      "impact_statement": "minimatch (CVE-2026-26996) is used exclusively in build and test tooling. All glob patterns are developer-defined strings in configuration files, not user-supplied input. A ReDoS attack requires adversary-controlled pattern input, which is not possible in this usage context."
     },
     {
-      "vulnerability": { "name": "GHSA-c2qf-rxjj-qqgw" },
-      "products": [{ "@id": "pkg:npm/%40hyperdx/api" }, { "@id": "pkg:npm/%40hyperdx/app" }],
+      "vulnerability": { "name": "GHSA-mjf5-7g4m-gx5w" },
+      "products": [{ "@id": "pkg:npm/%40hyperdx/app" }],
       "status": "not_affected",
-      "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
-      "impact_statement": "minimatch is used exclusively in build and test tooling (glob patterns for file matching by Jest, ESLint, and similar tools). All glob patterns are developer-defined strings in configuration files, not user-supplied input. A ReDoS attack requires adversary-controlled regex input, which is not possible in this usage context."
+      "justification": "vulnerable_code_not_in_execute_path",
+      "impact_statement": "storybook is a dev-only dependency used for UI component development. The storybook dev server (including its WebSocket endpoint) is never deployed to production and is not accessible in the production environment. WebSocket hijacking requires network access to the storybook dev server, which is only reachable on developer machines."
     },
     {
-      "vulnerability": { "name": "GHSA-pwxv-5w8g-86cp" },
+      "vulnerability": { "name": "GHSA-38r7-794h-5758" },
       "products": [{ "@id": "pkg:npm/%40hyperdx/app" }],
       "status": "not_affected",
       "justification": "vulnerable_code_not_in_execute_path",
-      "impact_statement": "playwright is a dev/test-only dependency used exclusively for end-to-end testing. It is not installed in the production Docker image and is never executed in the production environment. SSL certificate validation skip only affects test browser sessions, not production traffic."
+      "impact_statement": "webpack's buildHttp HttpUriPlugin (SSRF via allowedUris redirect bypass) is not enabled in this project. webpack is present only as a storybook dev dependency. The buildHttp plugin requires explicit configuration with a URL allowlist, which is absent from this project's webpack configuration."
     },
     {
-      "vulnerability": { "name": "GHSA-hpx4-r86g-5jrg" },
+      "vulnerability": { "name": "GHSA-8fgc-7cc6-rx7x" },
       "products": [{ "@id": "pkg:npm/%40hyperdx/app" }],
       "status": "not_affected",
       "justification": "vulnerable_code_not_in_execute_path",
-      "impact_statement": "storybook is a dev-only dependency used for UI component development. It is not installed in the production Docker image, not deployed to any production environment, and its environment variable handling does not affect the production application."
+      "impact_statement": "webpack's buildHttp allowedUris bypass via URL userinfo is not exploitable here. webpack is present only as a storybook dev dependency and the buildHttp plugin is not configured in this project."
     },
     {
       "vulnerability": { "name": "GHSA-4vvj-4cpr-p986" },
       "products": [{ "@id": "pkg:npm/%40hyperdx/app" }],
       "status": "not_affected",
       "justification": "vulnerable_code_not_in_execute_path",
-      "impact_statement": "webpack's buildHttp feature (SSRF vulnerability) is not enabled in this project's webpack configuration. The HyperDX build uses standard module bundling without remote URL loading. Even if webpack is present in the storybook dev build toolchain, the buildHttp feature is not configured."
-    },
-    {
-      "vulnerability": { "name": "CVE-2023-46234" },
-      "products": [{ "@id": "pkg:npm/%40hyperdx/api" }, { "@id": "pkg:npm/%40hyperdx/app" }],
-      "status": "not_affected",
-      "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
-      "impact_statement": "bn.js is used internally by elliptic for cryptographic operations (ECDH/ECDSA key operations). All inputs to bn.js in this context are developer-controlled cryptographic parameters, not user-supplied data. The infinite loop vulnerability requires adversary-controlled large integer inputs that are not possible in this deployment."
+      "impact_statement": "webpack's AutoPublicPathRuntimeModule DOM Clobbering gadget requires the attacker to inject content that overwrites document.currentScript or document.baseURI. webpack is present only as a storybook dev dependency and is not used in the production application bundle."
     },
     {
       "vulnerability": { "name": "CVE-2026-2739" },
       "products": [{ "@id": "pkg:npm/%40hyperdx/api" }, { "@id": "pkg:npm/%40hyperdx/app" }],
       "status": "not_affected",
       "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
-      "impact_statement": "bn.js is used internally by elliptic for cryptographic operations. All inputs to bn.js are developer-controlled cryptographic parameters, not user-supplied data. The vulnerability requires adversary-controlled large integer inputs that are not possible in this deployment."
-    },
-    {
-      "vulnerability": { "name": "GHSA-3ppc-4f35-3m26" },
-      "products": [{ "@id": "pkg:npm/%40hyperdx/api" }, { "@id": "pkg:npm/%40hyperdx/app" }],
-      "status": "not_affected",
-      "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
-      "impact_statement": "minimatch (CVE-2026-26996) is used exclusively in build and test tooling (glob patterns for file matching by Jest, ESLint, and similar tools). All glob patterns are developer-defined strings in configuration files, not user-supplied input. A ReDoS attack requires adversary-controlled regex input, which is not possible in this usage context."
+      "impact_statement": "bn.js (GHSA-378v-28hj-76wf) is used internally by elliptic for cryptographic operations. All inputs to bn.js in this context are developer-controlled cryptographic parameters, not user-supplied data. The infinite loop vulnerability requires adversary-controlled large integer inputs that are not possible in this deployment."
     },
     {
       "vulnerability": { "name": "GHSA-9wv6-86v2-598j" },
       "products": [{ "@id": "pkg:npm/%40hyperdx/api" }, { "@id": "pkg:npm/%40hyperdx/app" }],
       "status": "not_affected",
       "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
-      "impact_statement": "path-to-regexp has two consumers: (1) express@4.22.1 uses path-to-regexp@0.1.12 which is already patched (vulnerability fixed in >=0.1.10); (2) msw@2.3.0 uses path-to-regexp@6.2.2 (vulnerable <6.3.0) but msw is a test-only mock service worker — all route patterns are developer-defined in test code, never user-supplied input, and msw is not deployed to production."
+      "impact_statement": "path-to-regexp has two consumers: (1) express@4.22.1 uses path-to-regexp@0.1.12 which is already patched (vulnerability fixed in >=0.1.10); (2) msw@2.3.0 was upgraded to use path-to-regexp@6.3.0 (patched) via scoped yarn resolution. No vulnerable version remains installed."
     },
     {
       "vulnerability": { "name": "GHSA-5j98-mcp5-4vw2" },
       "products": [{ "@id": "pkg:npm/%40hyperdx/api" }, { "@id": "pkg:npm/%40hyperdx/app" }],
       "status": "not_affected",
       "justification": "vulnerable_code_not_in_execute_path",
-      "impact_statement": "glob's CLI command injection vulnerability (CVE-2024-21538 variant) requires invoking glob as a CLI tool with the -c/--cmd flag. glob is used exclusively as a JavaScript module for file-pattern matching in build tools (Jest, ESLint, cacache, node-gyp). The CLI entry point is never invoked in this project. Additionally, glob@10.5.0 (patched) and glob@7.x/9.x (not in vulnerable range >=10.2.0,<10.5.0) are the only versions installed."
+      "impact_statement": "glob's CLI command injection vulnerability requires invoking glob as a CLI tool with the -c/--cmd flag. glob is used exclusively as a JavaScript module for file-pattern matching in build tools (Jest, ESLint, cacache, node-gyp). The CLI entry point is never invoked in this project. All installed versions (10.5.0 patched; 7.x/9.x not in vulnerable range >=10.2.0,<10.5.0) are safe."
     }
   ]
 }
diff --git a/.vex/openssl-mongodb.vex.json b/.vex/openssl-mongodb.vex.json
index 20e3a67fd3..5de8a48221 100644
--- a/.vex/openssl-mongodb.vex.json
+++ b/.vex/openssl-mongodb.vex.json
@@ -4,7 +4,7 @@
   "author": "HyperDX Team",
   "role": "Supplier",
   "timestamp": "2026-02-17T00:00:00Z",
-  "version": 1,
+  "version": 2,
   "statements": [
     {
       "vulnerability": { "name": "CVE-2021-3711" },
@@ -111,13 +111,6 @@
       "justification": "inline_mitigations_already_exist",
       "impact_statement": "MongoDB is deployed in localhost-only mode. OCSP responses from external sources are not processed in this deployment."
     },
-    {
-      "vulnerability": { "name": "CVE-2025-9230" },
-      "products": [{ "@id": "pkg:oci/clickstack" }],
-      "status": "not_affected",
-      "justification": "inline_mitigations_already_exist",
-      "impact_statement": "MongoDB is deployed in localhost-only mode and does not process external TLS certificates. This OpenSSL vulnerability is not exploitable in this deployment."
-    },
     {
       "vulnerability": { "name": "CVE-2025-15467" },
       "products": [{ "@id": "pkg:oci/clickstack" }],

From b47e10f8e35b75a723f8271e6c7eb04ba2d67921 Mon Sep 17 00:00:00 2001
From: Rahul <254529899+motsc@users.noreply.github.com>
Date: Thu, 26 Feb 2026 15:34:30 -0600
Subject: [PATCH 7/8] fix(vex): correct inaccurate vulnerability descriptions
 in VEX files
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Second audit pass fixing factually wrong impact statements:

npm-dev-and-unreachable.vex.json (v3 → v4):
- CVE-2025-14505 (elliptic): fix vuln description from "malformed public
  key parsing" to correct "ECDSA signature generation with truncated
  k-nonce values"; attribute to Storybook/crypto-browserify
- GHSA-r6q2-hw4h-h46w (tar): fix "Unicode ligature" to "Unicode Sharp-S
  (ess-zett)" which is the actual character class involved
- GHSA-4vvj-4cpr-p986 (webpack DOM Clobbering): remove incorrect
  document.baseURI reference (only document.currentScript is clobbered);
  note Next.js uses its own bundled webpack copy
- CVE-2026-2739 (bn.js): fix trigger from "adversary-controlled large
  integer inputs" to correct "maskn(0) corrupting internal BN state";
  broaden consumer list to all crypto-browserify packages

openssl-mongodb.vex.json (v2 → v3):
- All 19 entries: replace "localhost-only mode" with accurate description
  of Docker internal network isolation with no TLS configured
- CVE-2021-3711: correct from "certificate-parsing" to "SM2 decryption
  buffer overflow" (SM2 ciphertext, not TLS certs)
- CVE-2024-4741: correct from generic "TLS certificates" to
  "SSL_free_buffers() use-after-free via active TLS connections"
- CVE-2024-6119: correct from "OCSP responses" to "X.509 certificate
  name check / otherName SAN parsing"
- CVE-2025-15467: correct from "TLS certificates" to "CMS
  AuthEnvelopedData / PKCS#7 message parsing"
- CVE-2025-69419: correct from "TLS certificates" to "PKCS#12 file
  parsing heap write"
- CVE-2025-69420: correct from "TLS certificates" to "TimeStamp Response
  (RFC 3161) verification type confusion"
- CVE-2025-69421: correct from "TLS certificates" to "PKCS#12 file
  parsing NULL pointer dereference"
---
 .vex/npm-dev-and-unreachable.vex.json | 10 +++----
 .vex/openssl-mongodb.vex.json         | 42 +++++++++++++--------------
 2 files changed, 26 insertions(+), 26 deletions(-)

diff --git a/.vex/npm-dev-and-unreachable.vex.json b/.vex/npm-dev-and-unreachable.vex.json
index e7dcb30248..a642950069 100644
--- a/.vex/npm-dev-and-unreachable.vex.json
+++ b/.vex/npm-dev-and-unreachable.vex.json
@@ -4,14 +4,14 @@
   "author": "HyperDX Team",
   "role": "Supplier",
   "timestamp": "2026-02-26T00:00:00Z",
-  "version": 3,
+  "version": 4,
   "statements": [
     {
       "vulnerability": { "name": "CVE-2025-14505" },
       "products": [{ "@id": "pkg:npm/%40hyperdx/api" }, { "@id": "pkg:npm/%40hyperdx/app" }],
       "status": "not_affected",
       "justification": "vulnerable_code_not_in_execute_path",
-      "impact_statement": "elliptic is a transitive dependency of crypto build tooling only. ECDSA signing via elliptic is not used at application runtime. No patch is available upstream. The vulnerable code path (malformed public key parsing) is not reachable from any production code."
+      "impact_statement": "elliptic is a transitive dependency of Storybook dev tooling only (via crypto-browserify). ECDSA signing via elliptic is not used at application runtime. No patch is available upstream. The vulnerable code path (ECDSA signature generation with truncated k-nonce values) is not reachable from any production code."
     },
     {
       "vulnerability": { "name": "GHSA-34x7-hfp2-rc4v" },
@@ -39,7 +39,7 @@
       "products": [{ "@id": "pkg:npm/%40hyperdx/api" }, { "@id": "pkg:npm/%40hyperdx/app" }],
       "status": "not_affected",
       "justification": "vulnerable_code_not_in_execute_path",
-      "impact_statement": "tar is a build-only dependency pulled in transitively by cacache and node-gyp during install. It is not present in the production Docker image. The race condition via Unicode ligature path collision requires extracting attacker-controlled archives, which never occurs in this deployment."
+      "impact_statement": "tar is a build-only dependency pulled in transitively by cacache and node-gyp during install. It is not present in the production Docker image. The race condition via Unicode Sharp-S (ess-zett) path collision requires extracting attacker-controlled archives, which never occurs in this deployment."
     },
     {
       "vulnerability": { "name": "GHSA-f8q6-p94x-37v3" },
@@ -81,14 +81,14 @@
       "products": [{ "@id": "pkg:npm/%40hyperdx/app" }],
       "status": "not_affected",
       "justification": "vulnerable_code_not_in_execute_path",
-      "impact_statement": "webpack's AutoPublicPathRuntimeModule DOM Clobbering gadget requires the attacker to inject content that overwrites document.currentScript or document.baseURI. webpack is present only as a storybook dev dependency and is not used in the production application bundle."
+      "impact_statement": "webpack's AutoPublicPathRuntimeModule DOM Clobbering gadget requires the attacker to inject content that overwrites document.currentScript. The vulnerable webpack npm package is a storybook dev dependency. Next.js uses its own bundled webpack copy for production builds. The resolution forces webpack to >=5.105.0 which includes the fix for this vulnerability."
     },
     {
       "vulnerability": { "name": "CVE-2026-2739" },
       "products": [{ "@id": "pkg:npm/%40hyperdx/api" }, { "@id": "pkg:npm/%40hyperdx/app" }],
       "status": "not_affected",
       "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
-      "impact_statement": "bn.js (GHSA-378v-28hj-76wf) is used internally by elliptic for cryptographic operations. All inputs to bn.js in this context are developer-controlled cryptographic parameters, not user-supplied data. The infinite loop vulnerability requires adversary-controlled large integer inputs that are not possible in this deployment."
+      "impact_statement": "bn.js is used internally by crypto-browserify packages (elliptic, browserify-sign, etc.) which are Storybook dev dependencies only. The infinite loop vulnerability is triggered by maskn(0) corrupting internal BN state. These crypto-browserify packages are not executed at application runtime and no user-supplied data reaches bn.js in this deployment."
     },
     {
       "vulnerability": { "name": "GHSA-9wv6-86v2-598j" },
diff --git a/.vex/openssl-mongodb.vex.json b/.vex/openssl-mongodb.vex.json
index 5de8a48221..24dbb6744c 100644
--- a/.vex/openssl-mongodb.vex.json
+++ b/.vex/openssl-mongodb.vex.json
@@ -3,141 +3,141 @@
   "@id": "https://github.com/hyperdxio/hyperdx/blob/main/.vex/openssl-mongodb.vex.json",
   "author": "HyperDX Team",
   "role": "Supplier",
-  "timestamp": "2026-02-17T00:00:00Z",
-  "version": 2,
+  "timestamp": "2026-02-26T00:00:00Z",
+  "version": 3,
   "statements": [
     {
       "vulnerability": { "name": "CVE-2021-3711" },
       "products": [{ "@id": "pkg:oci/clickstack" }],
       "status": "not_affected",
       "justification": "inline_mitigations_already_exist",
-      "impact_statement": "MongoDB is deployed in localhost-only mode and does not process external TLS certificates. OpenSSL certificate-parsing vulnerabilities are not exploitable in this deployment."
+      "impact_statement": "MongoDB is deployed on an isolated Docker internal network with no port exposed to the host in production, and does not have TLS configured. This SM2 decryption buffer overflow vulnerability requires processing untrusted SM2 ciphertext, which does not occur in this deployment."
     },
     {
       "vulnerability": { "name": "CVE-2021-3712" },
       "products": [{ "@id": "pkg:oci/clickstack" }],
       "status": "not_affected",
       "justification": "inline_mitigations_already_exist",
-      "impact_statement": "MongoDB is deployed in localhost-only mode and does not process external TLS certificates. OpenSSL certificate-parsing vulnerabilities are not exploitable in this deployment."
+      "impact_statement": "MongoDB is deployed on an isolated Docker internal network with no port exposed to the host in production, and does not have TLS configured. OpenSSL certificate-parsing vulnerabilities are not exploitable in this deployment."
     },
     {
       "vulnerability": { "name": "CVE-2021-4044" },
       "products": [{ "@id": "pkg:oci/clickstack" }],
       "status": "not_affected",
       "justification": "inline_mitigations_already_exist",
-      "impact_statement": "MongoDB is deployed in localhost-only mode and does not process external TLS certificates. OpenSSL vulnerabilities are not exploitable in this deployment."
+      "impact_statement": "MongoDB is deployed on an isolated Docker internal network with no port exposed to the host in production, and does not have TLS configured. OpenSSL vulnerabilities are not exploitable in this deployment."
     },
     {
       "vulnerability": { "name": "CVE-2022-0778" },
       "products": [{ "@id": "pkg:oci/clickstack" }],
       "status": "not_affected",
       "justification": "inline_mitigations_already_exist",
-      "impact_statement": "MongoDB is deployed in localhost-only mode. Certificate processing from untrusted sources does not occur, making this infinite-loop vulnerability unexploitable."
+      "impact_statement": "MongoDB is deployed on an isolated Docker internal network with no port exposed to the host in production, and does not have TLS configured. Certificate processing from untrusted sources does not occur, making this infinite-loop vulnerability unexploitable."
     },
     {
       "vulnerability": { "name": "CVE-2022-1473" },
       "products": [{ "@id": "pkg:oci/clickstack" }],
       "status": "not_affected",
       "justification": "inline_mitigations_already_exist",
-      "impact_statement": "MongoDB is deployed in localhost-only mode and does not process external TLS certificates. This memory leak vulnerability is not exploitable in this deployment."
+      "impact_statement": "MongoDB is deployed on an isolated Docker internal network with no port exposed to the host in production, and does not have TLS configured. This memory leak vulnerability is not exploitable in this deployment."
     },
     {
       "vulnerability": { "name": "CVE-2022-3358" },
       "products": [{ "@id": "pkg:oci/clickstack" }],
       "status": "not_affected",
       "justification": "inline_mitigations_already_exist",
-      "impact_statement": "MongoDB is deployed in localhost-only mode. Custom cipher usage from untrusted sources does not occur in this deployment."
+      "impact_statement": "MongoDB is deployed on an isolated Docker internal network with no port exposed to the host in production, and does not have TLS configured. Custom cipher usage from untrusted sources does not occur in this deployment."
     },
     {
       "vulnerability": { "name": "CVE-2022-3602" },
       "products": [{ "@id": "pkg:oci/clickstack" }],
       "status": "not_affected",
       "justification": "inline_mitigations_already_exist",
-      "impact_statement": "MongoDB is deployed in localhost-only mode and does not process external TLS certificates. This buffer overflow vulnerability is not exploitable in this deployment."
+      "impact_statement": "MongoDB is deployed on an isolated Docker internal network with no port exposed to the host in production, and does not have TLS configured. This buffer overflow vulnerability is not exploitable in this deployment."
     },
     {
       "vulnerability": { "name": "CVE-2022-3786" },
       "products": [{ "@id": "pkg:oci/clickstack" }],
       "status": "not_affected",
       "justification": "inline_mitigations_already_exist",
-      "impact_statement": "MongoDB is deployed in localhost-only mode and does not process external TLS certificates. This buffer overflow vulnerability is not exploitable in this deployment."
+      "impact_statement": "MongoDB is deployed on an isolated Docker internal network with no port exposed to the host in production, and does not have TLS configured. This buffer overflow vulnerability is not exploitable in this deployment."
     },
     {
       "vulnerability": { "name": "CVE-2022-3996" },
       "products": [{ "@id": "pkg:oci/clickstack" }],
       "status": "not_affected",
       "justification": "inline_mitigations_already_exist",
-      "impact_statement": "MongoDB is deployed in localhost-only mode. The double-locking issue is not triggerable via external input in this deployment."
+      "impact_statement": "MongoDB is deployed on an isolated Docker internal network with no port exposed to the host in production, and does not have TLS configured. The double-locking issue is not triggerable via external input in this deployment."
     },
     {
       "vulnerability": { "name": "CVE-2023-0286" },
       "products": [{ "@id": "pkg:oci/clickstack" }],
       "status": "not_affected",
       "justification": "inline_mitigations_already_exist",
-      "impact_statement": "MongoDB is deployed in localhost-only mode. External GeneralName certificate parsing does not occur in this deployment."
+      "impact_statement": "MongoDB is deployed on an isolated Docker internal network with no port exposed to the host in production, and does not have TLS configured. External GeneralName certificate parsing does not occur in this deployment."
     },
     {
       "vulnerability": { "name": "CVE-2023-0464" },
       "products": [{ "@id": "pkg:oci/clickstack" }],
       "status": "not_affected",
       "justification": "inline_mitigations_already_exist",
-      "impact_statement": "MongoDB is deployed in localhost-only mode. Untrusted X.509 certificate chains with policy constraints are not processed in this deployment."
+      "impact_statement": "MongoDB is deployed on an isolated Docker internal network with no port exposed to the host in production, and does not have TLS configured. Untrusted X.509 certificate chains with policy constraints are not processed in this deployment."
     },
     {
       "vulnerability": { "name": "CVE-2023-5363" },
       "products": [{ "@id": "pkg:oci/clickstack" }],
       "status": "not_affected",
       "justification": "inline_mitigations_already_exist",
-      "impact_statement": "MongoDB is deployed in localhost-only mode. Untrusted key/IV inputs from external sources are not processed in this deployment."
+      "impact_statement": "MongoDB is deployed on an isolated Docker internal network with no port exposed to the host in production, and does not have TLS configured. Untrusted key/IV inputs from external sources are not processed in this deployment."
     },
     {
       "vulnerability": { "name": "CVE-2024-4741" },
       "products": [{ "@id": "pkg:oci/clickstack" }],
       "status": "not_affected",
       "justification": "inline_mitigations_already_exist",
-      "impact_statement": "MongoDB is deployed in localhost-only mode and does not process external TLS certificates. This use-after-free vulnerability is not exploitable in this deployment."
+      "impact_statement": "MongoDB is deployed on an isolated Docker internal network with no port exposed to the host in production, and does not have TLS configured. This SSL_free_buffers() use-after-free vulnerability requires active TLS connections from external sources, which does not occur in this deployment."
     },
     {
       "vulnerability": { "name": "CVE-2024-5535" },
       "products": [{ "@id": "pkg:oci/clickstack" }],
       "status": "not_affected",
       "justification": "inline_mitigations_already_exist",
-      "impact_statement": "MongoDB is deployed in localhost-only mode. The SSL_select_next_proto vulnerability requires attacker-controlled input not present in this deployment."
+      "impact_statement": "MongoDB is deployed on an isolated Docker internal network with no port exposed to the host in production, and does not have TLS configured. The SSL_select_next_proto vulnerability requires attacker-controlled input not present in this deployment."
     },
     {
       "vulnerability": { "name": "CVE-2024-6119" },
       "products": [{ "@id": "pkg:oci/clickstack" }],
       "status": "not_affected",
       "justification": "inline_mitigations_already_exist",
-      "impact_statement": "MongoDB is deployed in localhost-only mode. OCSP responses from external sources are not processed in this deployment."
+      "impact_statement": "MongoDB is deployed on an isolated Docker internal network with no port exposed to the host in production, and does not have TLS configured. This X.509 certificate name check vulnerability requires processing certificates from external sources, which does not occur in this deployment."
     },
     {
       "vulnerability": { "name": "CVE-2025-15467" },
       "products": [{ "@id": "pkg:oci/clickstack" }],
       "status": "not_affected",
       "justification": "inline_mitigations_already_exist",
-      "impact_statement": "MongoDB is deployed in localhost-only mode and does not process external TLS certificates. This OpenSSL vulnerability is not exploitable in this deployment."
+      "impact_statement": "MongoDB is deployed on an isolated Docker internal network with no port exposed to the host in production, and does not have TLS configured. This CMS AuthEnvelopedData parsing vulnerability requires processing malicious CMS/PKCS#7 messages, which does not occur in this deployment."
     },
     {
       "vulnerability": { "name": "CVE-2025-69419" },
       "products": [{ "@id": "pkg:oci/clickstack" }],
       "status": "not_affected",
       "justification": "inline_mitigations_already_exist",
-      "impact_statement": "MongoDB is deployed in localhost-only mode and does not process external TLS certificates. This OpenSSL vulnerability is not exploitable in this deployment."
+      "impact_statement": "MongoDB is deployed on an isolated Docker internal network with no port exposed to the host in production, and does not have TLS configured. This PKCS#12 file parsing vulnerability requires processing malicious PKCS#12 files, which does not occur in this deployment."
     },
     {
       "vulnerability": { "name": "CVE-2025-69420" },
       "products": [{ "@id": "pkg:oci/clickstack" }],
       "status": "not_affected",
       "justification": "inline_mitigations_already_exist",
-      "impact_statement": "MongoDB is deployed in localhost-only mode and does not process external TLS certificates. This OpenSSL vulnerability is not exploitable in this deployment."
+      "impact_statement": "MongoDB is deployed on an isolated Docker internal network with no port exposed to the host in production, and does not have TLS configured. This TimeStamp Response verification vulnerability requires processing RFC 3161 timestamp responses, which does not occur in this deployment."
     },
     {
       "vulnerability": { "name": "CVE-2025-69421" },
       "products": [{ "@id": "pkg:oci/clickstack" }],
       "status": "not_affected",
       "justification": "inline_mitigations_already_exist",
-      "impact_statement": "MongoDB is deployed in localhost-only mode and does not process external TLS certificates. This OpenSSL vulnerability is not exploitable in this deployment."
+      "impact_statement": "MongoDB is deployed on an isolated Docker internal network with no port exposed to the host in production, and does not have TLS configured. This PKCS#12 file parsing vulnerability requires processing malicious PKCS#12 files, which does not occur in this deployment."
     }
   ]
 }

From 7227a229912f8f2edbe8d17dc9aa715422f5f6a7 Mon Sep 17 00:00:00 2001
From: Rahul <254529899+motsc@users.noreply.github.com>
Date: Mon, 2 Mar 2026 09:27:28 -0800
Subject: [PATCH 8/8] fix: add SBOM and provenance attestations to
 otel-collector release targets

---
 Makefile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Makefile b/Makefile
index 5b863528f5..385bc8c133 100644
--- a/Makefile
+++ b/Makefile
@@ -183,7 +183,7 @@ release-otel-collector:
 		echo "Tag ${OTEL_COLLECTOR_IMAGE_NAME_DOCKERHUB}:${IMAGE_VERSION}${IMAGE_VERSION_SUB_TAG} already exists. Skipping push."; \
 	else \
 		echo "Tag ${OTEL_COLLECTOR_IMAGE_NAME_DOCKERHUB}:${IMAGE_VERSION}${IMAGE_VERSION_SUB_TAG} does not exist. Building and pushing..."; \
-		docker buildx build --platform ${BUILD_PLATFORMS} . -f docker/otel-collector/Dockerfile \
+		docker buildx build --sbom=true --provenance=true --platform ${BUILD_PLATFORMS} . -f docker/otel-collector/Dockerfile \
 			-t ${OTEL_COLLECTOR_IMAGE_NAME_DOCKERHUB}:${IMAGE_VERSION}${IMAGE_VERSION_SUB_TAG} \
 			-t ${OTEL_COLLECTOR_IMAGE_NAME_DOCKERHUB}:${IMAGE_VERSION} \
 			-t ${OTEL_COLLECTOR_IMAGE_NAME_DOCKERHUB}:${IMAGE_LATEST_TAG} \
@@ -275,7 +275,7 @@ release-app:
 .PHONY: release-otel-collector-nightly
 release-otel-collector-nightly:
 	@echo "Building and pushing nightly tag ${OTEL_COLLECTOR_IMAGE_NAME_DOCKERHUB}:${IMAGE_NIGHTLY_TAG}..."; \
-	docker buildx build --platform ${BUILD_PLATFORMS} . -f docker/otel-collector/Dockerfile \
+	docker buildx build --sbom=true --provenance=true --platform ${BUILD_PLATFORMS} . -f docker/otel-collector/Dockerfile \
 		-t ${OTEL_COLLECTOR_IMAGE_NAME_DOCKERHUB}:${IMAGE_NIGHTLY_TAG} \
 		-t ${NEXT_OTEL_COLLECTOR_IMAGE_NAME_DOCKERHUB}:${IMAGE_NIGHTLY_TAG} \
 		--target prod \