Distillation

["f722319caff8d039f8e11f7fedc3559e","540af3a2202e069ed736131fe0271a4b","119c4776219b7ab3bd293ceb11fd7479","abb461b51d34ad6d509d5d2b40f3c0c1","e72ab74cbde9df7b1e6aac4ca66e0590","0224dcc615e147bbf67d9eab7205e33e","10dae71c4980e305bff1bf17b37424c2","5187c2143e9039e895fd3a65b20db7e2","d8165f8308e7fc446f6064a53d4c7f3a","9f354648956371ad5fbe0afe16700625","6661b1082354b789c1449fc65feab05b","84861aae5739cc1456c734c0afdeca2a","1ebb095faf989b9ef97204071217d386","726d699bfbacc70deb1ffec8d1e4b6a6"]

<observations> Date: June 23, 2026 * 🟡 (09:41) Full vulnerability analysis completed for getsentry/craft. 5 packages, 12 alerts, 7 distinct fix actions identified. * 🟡 (09:41) tar analysis: Direct devDependency. package.json line 65 pinned at 7.5.11 (no caret/tilde). pnpm-lock.yaml line 6007 resolves tar@7.5.11. Fix: bump line 65 to 7.5.16. Zero breakage risk (patch bump). Confirmed tar@7.5.16 exists on npm. * 🟡 (09:41) form-data analysis — Copy 1 (4.0.4): Transitive via @types/node-fetch@2.6.13 (package.json line 30) -> form-data@4.0.4. pnpm-lock.yaml line 5359 (resolved), line 4714 (dependent). Vulnerable: [4.0.0, 4.0.6). Fix: pnpm.overrides "form-data@>=4": "^4.0.6". Confirmed form-data@4.0.6 exists on npm. * 🟡 (09:41) form-data analysis — Copy 2 (2.5.5): Transitive via @google-cloud/storage@7.18.0 (package.json line 16) -> retry-request@7.0.2 (lockfile line 5861) -> @types/request@2.48.13 (line 5863) -> form-data@2.5.5 (line 4748). pnpm-lock.yaml line 5350 (resolved). Vulnerable: <2.5.6. Fix: pnpm.overrides "form-data@<3": "^2.5.6". Confirmed form-data@2.5.6 exists on npm. * 🟡 (09:41) vite analysis — root project: Transitive via vitest@^4.1.0 (package.json line 70) -> vite@7.3.2. pnpm-lock.yaml line 6103: vite@7.3.2(@types/node@22.19.1)(tsx@4.21.0). Also via tsx@4.21.0 (lockfile line 6053). Fix: pnpm.overrides "vite": "^7.3.5". * 🟡 (09:41) vite analysis — docs project: Transitive via astro@6.3.3 (docs/package.json line 13) -> vite@7.3