Distillation

🔴 (09:35) User is analyzing 12 open Dependabot alerts in the Craft repo (getsentry/craft). Repo has two independent projects: root (package.json + pnpm-lock.yaml) and docs (docs/package.json + docs/pnpm-lock.yaml).

🔴 (09:35) Vulnerability #1 — tar (medium, GHSA-vmf3-w455-68vh): Alerts #180 (package.json), #181 (pnpm-lock.yaml). Vulnerable: <= 7.5.15, Fix: >= 7.5.16. Root project only.

🔴 (09:35) Vulnerability #2 — form-data (high, GHSA-hmw2-7cc7-3qxx): Alert #178 (pnpm-lock.yaml, >= 4.0.0 < 4.0.6), Alert #179 (pnpm-lock.yaml, < 2.5.6). Two different version ranges — likely two transitive copies. Root project only.

🔴 (09:35) Vulnerability #3 — vite (high + medium): GHSA-fx2h-