5.0.5 — GHSA-3jxr-9vmj-r5cp, GHSA-jxxr-4gwj-5jf2, GHSA-mh99-v99m-4gvg

brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups — devDependency

brace-expansion: Large numeric range defeats documented `max` DoS protection — devDependency

brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash — devDependency

7.24.8 — GHSA-35p6-xmwp-9g52, GHSA-4cwx-7wf7-3272, GHSA-8xcm-r25x-g524

undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse — devDependency

undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives — devDependency

undici vulnerable to downstream response desynchronization via retry interceptor — devDependency

3.3.11 — GHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8

nanoid: non-secure generators can loop indefinitely with negative size — devDependency

nanoid: custom generators can loop indefinitely when size is zero — devDependency

8.5.12 — GHSA-fxqj-rqcc-2cmp, GHSA-r28c-9q8g-f849

PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset — devDependency

PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure — devDependency

8.0.10 — GHSA-fx2h-pf6j-xcff, GHSA-v6wh-96g9-6wx3

vite: `server.fs.deny` bypass on Windows alternate paths — devDependency

launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows — devDependency

8.18.0 — GHSA-58qx-3vcg-4xpx, GHSA-96hv-2xvq-fx4p

ws: Uninitialized memory disclosure — devDependency

ws: Memory exhaustion DoS from tiny fragments and data chunks — devDependency