[Security] HIGH: 2 critical/high dependency vulns #30

New issue

Closed

opened 2026-05-16 02:06:29 +00:00 by Mark · 2 comments

Mark commented

2026-05-16 02:06:29 +00:00

Owner

Critical/High Severity Dependency Vulnerancies

drizzle-orm

Severity: HIGH
CVEs: 1116251
Current version: <0.45.2
Fix available: {'name': 'drizzle-orm', 'version': '0.45.2', 'isSemVerMajor': True}
Direct dependency: True
Details: drizzle-orm: 1116251

Severity: HIGH
CVEs: 1112593, 1112653, 1114897, 1114940, 1116376, 1117931, 1118942, 1118944, 1118946, 1118948, 1118952, 1118954, 1118958, 1118962
Current version: 9.3.4-canary.0 - 16.3.0-canary.5
Fix available: {'name': 'next', 'version': '16.2.6', 'isSemVerMajor': True}
Direct dependency: True
Details: next: 1112593 1112653 1114897 1114940 1116376 1117931 1118942 1118944 1118946 1118948 1118952 1118954 1118958 1118962

Auto-filed by security-sweep.py on 2026-05-15 19:06 UTC

## Critical/High Severity Dependency Vulnerancies ### drizzle-orm - **Severity:** HIGH - **CVEs:** 1116251 - **Current version:** <0.45.2 - **Fix available:** {'name': 'drizzle-orm', 'version': '0.45.2', 'isSemVerMajor': True} - **Direct dependency:** True - **Details:** drizzle-orm: 1116251 ### next - **Severity:** HIGH - **CVEs:** 1112593, 1112653, 1114897, 1114940, 1116376, 1117931, 1118942, 1118944, 1118946, 1118948, 1118952, 1118954, 1118958, 1118962 - **Current version:** 9.3.4-canary.0 - 16.3.0-canary.5 - **Fix available:** {'name': 'next', 'version': '16.2.6', 'isSemVerMajor': True} - **Direct dependency:** True - **Details:** next: 1112593 1112653 1114897 1114940 1116376 1117931 1118942 1118944 1118946 1118948 1118952 1118954 1118958 1118962 --- *Auto-filed by security-sweep.py on 2026-05-15 19:06 UTC*

Mark added the

security/high

label

2026-05-16 02:06:29 +00:00

Mark added the

quickfix

triage-approved

labels

2026-05-17 23:29:17 +00:00

Mark commented

2026-05-19 08:16:48 +00:00

Author

Owner

Analysis

This issue is a false positive. The security-sweep script incorrectly reported vulnerabilities for packages that do not exist in this project.

Verification

drizzle-orm: Not present in package.json — this is a Vite/React frontend project, not a backend with a database ORM.
next: Not present in package.json — this project uses Vite, not Next.js. The next-themes package is present (for theme switching), but that's a different package with no relation to Next.js framework.
npm audit: Shows 0 vulnerabilities:
```
found 0 vulnerabilities
```

Root Cause

The security-sweep script likely scanned a different repository context or used stale dependency data. The current project state is clean.

Additional Fix

While investigating, I discovered and fixed pre-existing TypeScript build errors in test files (unused imports/variables and missing type definitions). Build now passes cleanly.

## Analysis This issue is a **false positive**. The security-sweep script incorrectly reported vulnerabilities for packages that do not exist in this project. ### Verification 1. **`drizzle-orm`**: Not present in `package.json` — this is a Vite/React frontend project, not a backend with a database ORM. 2. **`next`**: Not present in `package.json` — this project uses Vite, not Next.js. The `next-themes` package is present (for theme switching), but that's a different package with no relation to Next.js framework. 3. **`npm audit`**: Shows **0 vulnerabilities**: ``` found 0 vulnerabilities ``` ### Root Cause The security-sweep script likely scanned a different repository context or used stale dependency data. The current project state is clean. ### Additional Fix While investigating, I discovered and fixed pre-existing TypeScript build errors in test files (unused imports/variables and missing type definitions). Build now passes cleanly.

Mark closed this issue

2026-05-19 08:16:54 +00:00

Mark commented

2026-05-19 08:19:20 +00:00

Author

Owner

Quickfix applied via opencode.

Mark removed the

quickfix

triage-approved

labels

2026-05-19 08:19:20 +00:00