# npm audit report

@babel/helpers  <7.26.10
Severity: moderate
Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups - https://github.com/advisories/GHSA-968p-4wvh-cqc8
fix available via `npm audit fix`
node_modules/tap/node_modules/@babel/helpers

brace-expansion  1.0.0 - 1.1.11
brace-expansion Regular Expression Denial of Service vulnerability - https://github.com/advisories/GHSA-v6h2-p8h4-qcjw
fix available via `npm audit fix`
node_modules/tap/node_modules/brace-expansion

form-data  <2.5.4
Severity: critical
form-data uses unsafe random function in form-data for choosing boundary - https://github.com/advisories/GHSA-fjxv-7rqg-78g4
fix available via `npm audit fix --force`
Will install ut-tools@6.31.3, which is a breaking change
node_modules/form-data
  request  *
  Depends on vulnerable versions of form-data
  Depends on vulnerable versions of tough-cookie
  node_modules/request
    pkg-fetch  <=2.7.0
    Depends on vulnerable versions of request
    node_modules/pkg-fetch
      pkg  *
      Depends on vulnerable versions of pkg-fetch
      node_modules/pkg
        ut-tools  *
        Depends on vulnerable versions of package-json
        Depends on vulnerable versions of pkg
        Depends on vulnerable versions of pkg-versions
        Depends on vulnerable versions of request
        Depends on vulnerable versions of request-promise-native
        Depends on vulnerable versions of semver
        Depends on vulnerable versions of stylelint
        node_modules/ut-tools
    request-promise-core  *
    Depends on vulnerable versions of request
    node_modules/request-promise-core
      request-promise-native  >=1.0.0
      Depends on vulnerable versions of request
      Depends on vulnerable versions of request-promise-core
      Depends on vulnerable versions of tough-cookie
      node_modules/request-promise-native

got  <11.8.5
Severity: moderate
Got allows a redirect to a UNIX socket - https://github.com/advisories/GHSA-pfrx-2q88-qq97
fix available via `npm audit fix --force`
Will install ut-tools@6.31.3, which is a breaking change
node_modules/got
  package-json  <=6.5.0
  Depends on vulnerable versions of got
  node_modules/package-json
    pkg-versions  <=2.1.0
    Depends on vulnerable versions of package-json
    node_modules/pkg-versions


postcss  <8.4.31
Severity: moderate
PostCSS line return parsing error - https://github.com/advisories/GHSA-7fh5-64p2-3v2j
fix available via `npm audit fix --force`
Will install ut-tools@6.31.3, which is a breaking change
node_modules/postcss
  autoprefixer  1.0.20131222 - 9.8.8
  Depends on vulnerable versions of postcss
  node_modules/autoprefixer
    stylelint  0.1.0 - 13.13.1
    Depends on vulnerable versions of autoprefixer
    Depends on vulnerable versions of postcss
    Depends on vulnerable versions of postcss-less
    Depends on vulnerable versions of postcss-safe-parser
    Depends on vulnerable versions of postcss-sass
    Depends on vulnerable versions of postcss-scss
    Depends on vulnerable versions of sugarss
    node_modules/stylelint
  postcss-less  <=3.1.4
  Depends on vulnerable versions of postcss
  node_modules/postcss-less
  postcss-safe-parser  <=4.0.2
  Depends on vulnerable versions of postcss
  node_modules/postcss-safe-parser
  postcss-sass  <=0.4.4
  Depends on vulnerable versions of postcss
  node_modules/postcss-sass
  postcss-scss  <=2.1.1
  Depends on vulnerable versions of postcss
  node_modules/postcss-scss
  sugarss  <=2.0.0
  Depends on vulnerable versions of postcss
  node_modules/sugarss


semver  7.0.0 - 7.5.1
Severity: high
semver vulnerable to Regular Expression Denial of Service - https://github.com/advisories/GHSA-c2qf-rxjj-qqgw
fix available via `npm audit fix --force`
Will install ut-tools@6.31.3, which is a breaking change
node_modules/ut-tools/node_modules/semver

tough-cookie  <4.1.3
Severity: moderate
tough-cookie Prototype Pollution vulnerability - https://github.com/advisories/GHSA-72xf-g2v4-qvf3
fix available via `npm audit fix --force`
Will install ut-tools@6.31.3, which is a breaking change
node_modules/tough-cookie

ws  7.0.0 - 7.5.9
Severity: high
ws affected by a DoS when handling a request with many HTTP headers - https://github.com/advisories/GHSA-3h5v-q93c-6h6q
fix available via `npm audit fix`
node_modules/tap/node_modules/ws

23 vulnerabilities (1 low, 17 moderate, 3 high, 2 critical)

To address issues that do not require attention, run:
  npm audit fix

To address all issues (including breaking changes), run:
  npm audit fix --force