Distillation

["617174fa80aa33bdeea13ac65fe930e2","fb7fd2d94b1ed2518d49c112d0c75753"]

<observations> Date: June 23, 2026 * 🔴 (09:32) User stated they have dependency upgrades to investigate (continuing prior work pattern) * 🟡 (09:35) Security vulnerability scan returned 12 open advisories across pnpm-lock.yaml, package.json, and docs/pnpm-lock.yaml. Details:

tar (medium, GHSA-vmf3-w455-68vh):

• 🟡 Issue #181 — manifest: pnpm-lock.yaml — PAX size override on GNU long-name/long-link headers (file smuggling) — vulnerable: <= 7.5.15 — patched: 7.5.16
• 🟡 Issue #180 — manifest: package.json — same CVE as above — vulnerable: <= 7.5.15 — patched: 7.5.16

form-data (high, GHSA-hmw2-7cc7-3qxx):

• 🟡 Issue #179 — manifest: pnpm-lock.yaml — CRLF injection via unescaped multipart field names/filenames — vulnerable: >= 4.0.0, < 4.0.6 — patched: 4.0.6
• 🟡 Issue #178 — manifest: pnpm-lock.yaml — same CVE, older range —