[Security] HIGH: 2 critical/high dependency vulns #33

New issue

Closed

opened 2026-05-16 03:22:56 +00:00 by Mark · 2 comments

Mark commented

2026-05-16 03:22:56 +00:00

Owner

Critical/High Severity Dependency Vulnerancies

drizzle-orm

Severity: HIGH
CVEs: 1116251
Current version: <0.45.2
Fix available: {'name': 'drizzle-orm', 'version': '0.45.2', 'isSemVerMajor': True}
Direct dependency: True
Details: drizzle-orm: 1116251

Severity: HIGH
CVEs: 1112593, 1112653, 1114897, 1114940, 1116376, 1117931, 1118942, 1118944, 1118946, 1118948, 1118952, 1118954, 1118958, 1118962
Current version: 9.3.4-canary.0 - 16.3.0-canary.5
Fix available: {'name': 'next', 'version': '16.2.6', 'isSemVerMajor': True}
Direct dependency: True
Details: next: 1112593 1112653 1114897 1114940 1116376 1117931 1118942 1118944 1118946 1118948 1118952 1118954 1118958 1118962

Auto-filed by security-sweep.py on 2026-05-15 20:22 UTC

## Critical/High Severity Dependency Vulnerancies ### drizzle-orm - **Severity:** HIGH - **CVEs:** 1116251 - **Current version:** <0.45.2 - **Fix available:** {'name': 'drizzle-orm', 'version': '0.45.2', 'isSemVerMajor': True} - **Direct dependency:** True - **Details:** drizzle-orm: 1116251 ### next - **Severity:** HIGH - **CVEs:** 1112593, 1112653, 1114897, 1114940, 1116376, 1117931, 1118942, 1118944, 1118946, 1118948, 1118952, 1118954, 1118958, 1118962 - **Current version:** 9.3.4-canary.0 - 16.3.0-canary.5 - **Fix available:** {'name': 'next', 'version': '16.2.6', 'isSemVerMajor': True} - **Direct dependency:** True - **Details:** next: 1112593 1112653 1114897 1114940 1116376 1117931 1118942 1118944 1118946 1118948 1118952 1118954 1118958 1118962 --- *Auto-filed by security-sweep.py on 2026-05-15 20:22 UTC*

Mark added the

security/high

label

2026-05-16 03:22:56 +00:00

Mark added the

quickfix

triage-approved

labels

2026-05-17 23:29:15 +00:00

Mark commented

2026-05-19 07:06:50 +00:00

Author

Owner

This issue is a false positive. The packages drizzle-orm and next do not exist in this project's dependencies.

Verification:

npm audit shows 0 vulnerabilities
npm list drizzle-orm next --depth=0 returns empty (packages not installed)
package.json does not contain these dependencies

The security scanner appears to have incorrectly identified these packages. This project uses Vite + React, not Next.js, and does not use Drizzle ORM.

Closing as this is not applicable to this repository.

This issue is a false positive. The packages `drizzle-orm` and `next` do not exist in this project's dependencies. Verification: - `npm audit` shows 0 vulnerabilities - `npm list drizzle-orm next --depth=0` returns empty (packages not installed) - `package.json` does not contain these dependencies The security scanner appears to have incorrectly identified these packages. This project uses Vite + React, not Next.js, and does not use Drizzle ORM. Closing as this is not applicable to this repository.

Mark closed this issue

2026-05-19 07:06:56 +00:00

Mark commented

2026-05-19 07:07:24 +00:00

Author

Owner

Quickfix applied via opencode.

Mark removed the

quickfix

triage-approved

labels

2026-05-19 07:07:24 +00:00