{
 "advisories": {
  "actualbudget/actual-server|CVE-2026-111497": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "actualbudget/actual-server 26.10.0 (actualbudget-system/actualbudget.yaml)",
   "summary": "Node.js 24.21.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process"
  },
  "advplyr/audiobookshelf|CVE-2026-111497": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "advplyr/audiobookshelf 2.37.1 (audiobookshelf-system/audiobookshelf.yaml)",
   "summary": "Node.js 24.21.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process"
  },
  "calcom/cal.com|CVE-2026-111497": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "calcom/cal.com v6.2.0 (calcom)",
   "summary": "Node.js 20.20.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process — no fixed release on t"
  },
  "calcom/cal.com|GHSA-cpf2-q635-xrwx": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "calcom/cal.com v6.2.0 (calcom)",
   "silent": "first read after the seed",
   "summary": "Not expiring old sessions after enabling 2FA"
  },
  "calcom/cal.com|GHSA-p3f6-52gv-cj7m": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "calcom/cal.com v6.2.0 (calcom)",
   "silent": "first read after the seed",
   "summary": "Repository takeover via `.github/workflows/pr.yml`"
  },
  "cloudflare/cloudflared|feed:cloudflare-blog:01M5DK5J81T0VC8YTBR2FKD8A3": {
   "first": "2026-10-26",
   "last_mailed": "2026-10-26",
   "program": "cloudflare/cloudflared 2026.10.3 (controller infra)",
   "summary": "8 eMudhra certificates are compromised. Here's what you need to know"
  },
  "cloudflare/cloudflared|vulnnotes:cloudflared@2026.10.5:VULN-183456": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "cloudflare/cloudflared 2026.10.4 (controller infra)",
   "summary": "- 2026-10-26 VULN-183456: Bump github.com/go-chi/chi/v5 to v5.5.0"
  },
  "codewithcj/sparkyfitness_server|CVE-2026-111497": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "codewithcj/sparkyfitness_server v1.9.0 (workout-system/sparkyfitness.yaml)",
   "summary": "Node.js 24.22.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process"
  },
  "codewithcj/sparkyfitness_server|GHSA-cmmf-53wf-r5gv": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "codewithcj/sparkyfitness_server v0.17.3 (sparkyfitness)",
   "summary": "Unauthenticated direct access to owner-only pregnancy photos through public static mounts"
  },
  "codewithcj/sparkyfitness_server|GHSA-p8cf-g8rv-gvrq": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "codewithcj/sparkyfitness_server v0.17.3 (sparkyfitness)",
   "summary": "Authenticated user can overwrite another user's Withings connection through unvalidated OAuth state"
  },
  "codewithcj/sparkyfitness_server|GHSA-v883-jx9h-qf29": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "codewithcj/sparkyfitness_server v0.17.3 (sparkyfitness)",
   "summary": "Preflight check only verifies BETTER_AUTH_SECRET is present, not that it differs from the documented .env.example default -- an unedited install runs with a kno"
  },
  "codewithcj/sparkyfitness|GHSA-cmmf-53wf-r5gv": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "codewithcj/sparkyfitness v0.17.3 (sparkyfitness)",
   "summary": "Unauthenticated direct access to owner-only pregnancy photos through public static mounts"
  },
  "codewithcj/sparkyfitness|GHSA-p8cf-g8rv-gvrq": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "codewithcj/sparkyfitness v0.17.3 (sparkyfitness)",
   "summary": "Authenticated user can overwrite another user's Withings connection through unvalidated OAuth state"
  },
  "codewithcj/sparkyfitness|GHSA-v883-jx9h-qf29": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "codewithcj/sparkyfitness v0.17.3 (sparkyfitness)",
   "summary": "Preflight check only verifies BETTER_AUTH_SECRET is present, not that it differs from the documented .env.example default -- an unedited install runs with a kno"
  },
  "crocodilestick/calibre-web-automated|CVE-2026-111497": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "crocodilestick/calibre-web-automated dev (calibre-system/cwa.yaml)",
   "summary": "Python Brotli 1.2.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell), PYSEC-2026-4322"
  },
  "docker.io/calcom/cal.com|CVE-2026-111497": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "docker.io/calcom/cal.com v6.2.0 (booking-system/booking.yaml)",
   "summary": "Node.js 20.20.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process — no fixed release on t"
  },
  "f0rc3/gokapi|GHSA-3c22-5j5m-4jq7": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "f0rc3/gokapi v1.9.6 (gokapi)",
   "summary": "Stored XSS in SVG Hotlinks"
  },
  "f0rc3/gokapi|GHSA-45vh-rpc8-hxpp": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "f0rc3/gokapi v1.9.6 (gokapi)",
   "summary": "File Request MaxSize Limit Bypassed in File Request"
  },
  "f0rc3/gokapi|GHSA-4xg4-54hm-9j77": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "f0rc3/gokapi v1.9.6 (gokapi)",
   "summary": "Stored XSS vulnerability in friendly name for API keys"
  },
  "f0rc3/gokapi|GHSA-95rc-wc32-gm53": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "f0rc3/gokapi v1.9.6 (gokapi)",
   "summary": "Stored XSS by uploading file with malicious file name"
  },
  "f0rc3/gokapi|GHSA-c36c-7pc2-f2ph": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "f0rc3/gokapi v1.9.6 (gokapi)",
   "summary": "Data Leak in Upload Status Stream"
  },
  "f0rc3/gokapi|GHSA-hcff-qv74-7hr4": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "f0rc3/gokapi v1.9.6 (gokapi)",
   "summary": "CSRF in Login Endpoint"
  },
  "f0rc3/gokapi|GHSA-j6jp-78w8-34x6": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "f0rc3/gokapi v1.9.6 (gokapi)",
   "summary": "Privilege Escalation in File Replace"
  },
  "f0rc3/gokapi|GHSA-m2hx-wjxc-9fp4": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "f0rc3/gokapi v1.9.6 (gokapi)",
   "summary": "Privilege escalation with auth token"
  },
  "f0rc3/gokapi|GHSA-q658-hfpg-35qc": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "f0rc3/gokapi v1.9.6 (gokapi)",
   "summary": "Privilege escalation via incomplete API-key permission revocation on user rank demotion"
  },
  "f0rc3/gokapi|GHSA-qwc6-vc2v-2ggj": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "f0rc3/gokapi v1.9.6 (gokapi)",
   "summary": "DoS in API endpoint"
  },
  "fallenbagel/jellyseerr|CVE-2026-111497": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "fallenbagel/jellyseerr 2.7.3 (seerr)",
   "summary": "Node.js 22.18.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process"
  },
  "fallenbagel/jellyseerr|GHSA-8j73-j6rc-q8xh": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "fallenbagel/jellyseerr 2.7.3 (seerr)",
   "summary": "Third-party notification credentials of other users exposed via request detail endpoints"
  },
  "fallenbagel/jellyseerr|GHSA-f7xw-jcqr-57hp": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "fallenbagel/jellyseerr 2.7.3 (seerr)",
   "summary": "Broken Object-Level Authorization in User Profile Endpoint Exposes Third-Party Notification Credentials"
  },
  "fallenbagel/jellyseerr|GHSA-gx3h-3jg5-q65f": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "fallenbagel/jellyseerr 2.7.3 (seerr)",
   "summary": "Missing authentication on pushSubscription endpoints"
  },
  "fallenbagel/jellyseerr|GHSA-mc6w-69r3-62h8": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "fallenbagel/jellyseerr 2.7.3 (seerr)",
   "summary": "Path traversal to RCE via /avatarproxy image cache filename from upstream ETag"
  },
  "fallenbagel/jellyseerr|GHSA-rc4w-7m3r-c2f7": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "fallenbagel/jellyseerr 2.7.3 (seerr)",
   "summary": "Unauthenticated account registration on Plex-configured Seerr instances via Jellyfin authentication endpoint"
  },
  "fallenbagel/jellyseerr|GHSA-xc6j-6p6h-p799": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "fallenbagel/jellyseerr 2.7.3 (seerr)",
   "summary": "Unfiltered User Objects (Email, plexId, Permissions) and Issue Contents Leaked via /movie/:id and /tv/:id mediaInfo"
  },
  "flomp/wanderer-db|GHSA-332v-mq7g-5hqf": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "flomp/wanderer-db v0.20.0 (wanderer)",
   "summary": "Wanderer: create rules for `comments`, `summit_logs` and `trail_like` never bind the `author`/`actor` to the caller, letting any user forge content attributed t"
  },
  "flomp/wanderer-db|GHSA-3xp7-7492-j2q6": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "flomp/wanderer-db v0.21.0 (wanderer-system/wanderer.yaml)",
   "summary": "ActivityPub Attachment URLs Allow Server-Side Request Forgery (SSRF) to Internal Network Resources"
  },
  "flomp/wanderer-db|GHSA-8j93-xvwx-jjg3": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "flomp/wanderer-db v0.20.0 (wanderer)",
   "summary": "SSRF guard bypass via IPv6 transition addresses in ActivityPub federation (SafeHTTPClient)"
  },
  "flomp/wanderer-db|GHSA-fprh-3pp9-68m9": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "flomp/wanderer-db v0.21.0 (wanderer-system/wanderer.yaml)",
   "summary": "ActivityPub Create/Update for comments and summit logs has no ownership check, letting any remote actor overwrite local records and inject unsanitized HTML (inc"
  },
  "flomp/wanderer-db|GHSA-j9m4-8qwf-jvx6": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "flomp/wanderer-db v0.21.0 (wanderer-system/wanderer.yaml)",
   "summary": "SSRF via ActivityPub List Image Attachments Allows Requests to Internal Network Resources"
  },
  "flomp/wanderer-db|GHSA-mr29-2qg5-m4fw": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "flomp/wanderer-db v0.20.0 (wanderer)",
   "summary": "ActivityPub 入口信任客户端 X-Forwarded-Path，可伪造任意本地 inbox 路由并通过签名校验"
  },
  "flomp/wanderer-db|GHSA-vj82-xj83-jp85": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "flomp/wanderer-db v0.20.0 (wanderer)",
   "summary": "wanderer: `waypoints` collection `createRule` omits the trail-ownership check, letting any authenticated user inject (and owner-attributed) waypoints into any o"
  },
  "flomp/wanderer-db|GHSA-vprp-gr6m-j375": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "flomp/wanderer-db v0.21.0 (wanderer-system/wanderer.yaml)",
   "summary": "ActivityPub inbox delivery allows blind Server-Side Request Forgery (SSRF) to internal network resources"
  },
  "flomp/wanderer-db|GHSA-xcwc-jhv2-w4h6": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "flomp/wanderer-db v0.20.0 (wanderer)",
   "summary": "ActivityPub Delete 处理缺少对象归属校验，任意远程 actor 可删除任意本地 trail/list"
  },
  "flomp/wanderer-db|release:open-wanderer/wanderer@v0.21.0": {
   "first": "2026-10-26",
   "last_mailed": "2026-10-26",
   "program": "flomp/wanderer-db v0.20.0 (wanderer)",
   "summary": "Inbound ActivityPub deliveries are now authenticated between the  web  and  db  services ( GHSA-mr29-2qg5-m4fw , PR  #1205 )"
  },
  "flomp/wanderer-db|release:open-wanderer/wanderer@v0.21.2": {
   "first": "2026-10-26",
   "last_mailed": "2026-10-26",
   "program": "flomp/wanderer-db v0.20.0 (wanderer)",
   "summary": "( GHSA-fprh-3pp9-68m9 , thanks  @zer0d4y5 )"
  },
  "flomp/wanderer-web|CVE-2026-111497": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "flomp/wanderer-web v0.21.0 (wanderer-system/wanderer.yaml)",
   "summary": "Node.js 22.23.3 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process"
  },
  "flomp/wanderer-web|GHSA-332v-mq7g-5hqf": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "flomp/wanderer-web v0.20.0 (wanderer)",
   "summary": "Wanderer: create rules for `comments`, `summit_logs` and `trail_like` never bind the `author`/`actor` to the caller, letting any user forge content attributed t"
  },
  "flomp/wanderer-web|GHSA-3xp7-7492-j2q6": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "flomp/wanderer-web v0.21.0 (wanderer-system/wanderer.yaml)",
   "summary": "ActivityPub Attachment URLs Allow Server-Side Request Forgery (SSRF) to Internal Network Resources"
  },
  "flomp/wanderer-web|GHSA-8j93-xvwx-jjg3": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "flomp/wanderer-web v0.20.0 (wanderer)",
   "summary": "SSRF guard bypass via IPv6 transition addresses in ActivityPub federation (SafeHTTPClient)"
  },
  "flomp/wanderer-web|GHSA-fprh-3pp9-68m9": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "flomp/wanderer-web v0.21.0 (wanderer-system/wanderer.yaml)",
   "summary": "ActivityPub Create/Update for comments and summit logs has no ownership check, letting any remote actor overwrite local records and inject unsanitized HTML (inc"
  },
  "flomp/wanderer-web|GHSA-j9m4-8qwf-jvx6": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "flomp/wanderer-web v0.21.0 (wanderer-system/wanderer.yaml)",
   "summary": "SSRF via ActivityPub List Image Attachments Allows Requests to Internal Network Resources"
  },
  "flomp/wanderer-web|GHSA-mr29-2qg5-m4fw": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "flomp/wanderer-web v0.20.0 (wanderer)",
   "summary": "ActivityPub 入口信任客户端 X-Forwarded-Path，可伪造任意本地 inbox 路由并通过签名校验"
  },
  "flomp/wanderer-web|GHSA-vj82-xj83-jp85": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "flomp/wanderer-web v0.20.0 (wanderer)",
   "summary": "wanderer: `waypoints` collection `createRule` omits the trail-ownership check, letting any authenticated user inject (and owner-attributed) waypoints into any o"
  },
  "flomp/wanderer-web|GHSA-vprp-gr6m-j375": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "flomp/wanderer-web v0.21.0 (wanderer-system/wanderer.yaml)",
   "summary": "ActivityPub inbox delivery allows blind Server-Side Request Forgery (SSRF) to internal network resources"
  },
  "flomp/wanderer-web|GHSA-xcwc-jhv2-w4h6": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "flomp/wanderer-web v0.20.0 (wanderer)",
   "summary": "ActivityPub Delete 处理缺少对象归属校验，任意远程 actor 可删除任意本地 trail/list"
  },
  "flomp/wanderer-web|release:open-wanderer/wanderer@v0.21.0": {
   "first": "2026-10-26",
   "last_mailed": "2026-10-26",
   "program": "flomp/wanderer-web v0.20.0 (wanderer)",
   "summary": "Inbound ActivityPub deliveries are now authenticated between the  web  and  db  services ( GHSA-mr29-2qg5-m4fw , PR  #1205 )"
  },
  "flomp/wanderer-web|release:open-wanderer/wanderer@v0.21.2": {
   "first": "2026-10-26",
   "last_mailed": "2026-10-26",
   "program": "flomp/wanderer-web v0.20.0 (wanderer)",
   "summary": "( GHSA-fprh-3pp9-68m9 , thanks  @zer0d4y5 )"
  },
  "freikin/dawarich|CVE-2026-111497": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "freikin/dawarich 1.15.3 (dawarich)",
   "summary": "Node.js 20.19.2 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process — no fixed release on t"
  },
  "freikin/dawarich|release:Freika/dawarich@1.17.0": {
   "first": "2026-10-26",
   "last_mailed": "2026-10-26",
   "program": "freikin/dawarich 1.15.3 (dawarich)",
   "summary": "js 20 package, which no longer receives upstream security fixes"
  },
  "ghcr.io/alexta69/metube|CVE-2026-111497": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "ghcr.io/alexta69/metube 2026.09.29 (metube)",
   "summary": "Python Brotli 1.2.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell), PYSEC-2026-4322"
  },
  "ghcr.io/diced/zipline|CVE-2026-111497": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "ghcr.io/diced/zipline 4.8.0 (zipline)",
   "summary": "Node.js 24.21.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process"
  },
  "ghcr.io/gethomepage/homepage|CVE-2026-111497": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "ghcr.io/gethomepage/homepage v1.13.2 (homepage-system/homepage-orsi.yaml, homepage-system/homepage.yaml)",
   "summary": "Node.js 22.22.3 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process"
  },
  "ghcr.io/gethomepage/homepage|GHSA-669x-4pg4-w24r": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "ghcr.io/gethomepage/homepage v1.13.2 (homepage)",
   "silent": "first read after the seed",
   "summary": "Homepage service proxy allows client-controlled methods and bodies to configured widget endpoints"
  },
  "ghcr.io/home-assistant/home-assistant|CVE-2026-111497": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "ghcr.io/home-assistant/home-assistant 2026.9.4 (home-assistant)",
   "summary": "Python Brotli 1.2.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell), PYSEC-2026-4322"
  },
  "ghcr.io/immich-app/immich-machine-learning|GHSA-3mh5-gqfm-phgj": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "ghcr.io/immich-app/immich-machine-learning v2.7.5 (immich-system/immich.yaml)",
   "summary": "Cross-user disclosure of a user's Locked (hidden-vault) assets to a partner via timeline-bucket and search-statistics endpoints"
  },
  "ghcr.io/immich-app/immich-machine-learning|GHSA-72rm-x7xr-v679": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "ghcr.io/immich-app/immich-machine-learning v2.7.5 (immich-system/immich.yaml)",
   "summary": "Unauthenticated filesystem path injection (arbitrary directory write + recursive delete) in the machine-learning service"
  },
  "ghcr.io/immich-app/immich-machine-learning|GHSA-8244-8vpr-vp9c": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "ghcr.io/immich-app/immich-machine-learning v2.7.5 (immich-system/immich.yaml)",
   "summary": "One-click account takeover via XSS in login page continue redirect"
  },
  "ghcr.io/immich-app/immich-machine-learning|GHSA-c9mf-h82r-8p4j": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "ghcr.io/immich-app/immich-machine-learning v2.7.5 (immich-system/immich.yaml)",
   "summary": "Album Editor can escalate to Owner role and remove Owner-role members via unguarded API endpoints"
  },
  "ghcr.io/immich-app/immich-machine-learning|GHSA-g4w3-c888-cr93": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "ghcr.io/immich-app/immich-machine-learning v2.7.5 (immich-system/immich.yaml)",
   "summary": "A regular user can create SharedLink for album/asset belonging to another user through CreateSharedLink API"
  },
  "ghcr.io/immich-app/immich-machine-learning|GHSA-h5w4-vjv4-9r5q": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "ghcr.io/immich-app/immich-machine-learning v2.7.5 (immich-system/immich.yaml)",
   "summary": "Incorrect sanitization of continue URL on the /maintenance endpoint"
  },
  "ghcr.io/immich-app/immich-machine-learning|GHSA-hfvf-5c8x-8rc4": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "ghcr.io/immich-app/immich-machine-learning v2.7.5 (immich-system/immich.yaml)",
   "summary": "OIDC discovery/token/userinfo/JWKS fetches run with TLS certificate verification unconditionally disabled via allowInsecureRequests (CWE-295)"
  },
  "ghcr.io/immich-app/immich-machine-learning|GHSA-hv27-723h-qfjq": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "ghcr.io/immich-app/immich-machine-learning v2.7.5 (immich-system/immich.yaml)",
   "summary": "Partner \"view-only\" sharing leaks GPS coordinates of the sharer's archived assets via GET /api/map/markers (the map endpoint omits the archived-asset guard the "
  },
  "ghcr.io/immich-app/immich-machine-learning|GHSA-jrp5-g662-hq92": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "ghcr.io/immich-app/immich-machine-learning v2.7.5 (immich-system/immich.yaml)",
   "summary": "Unsafe ZIP Entry Names (Zip Slip Class) in Archive Download Endpoint"
  },
  "ghcr.io/immich-app/immich-machine-learning|GHSA-q89f-h332-8q2h": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "ghcr.io/immich-app/immich-machine-learning v2.7.5 (immich-system/immich.yaml)",
   "summary": "Authenticated SVG upload reaches ImageMagick coders and enables RCE"
  },
  "ghcr.io/immich-app/immich-machine-learning|GHSA-qp2h-w794-2vhf": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "ghcr.io/immich-app/immich-machine-learning v2.7.5 (immich-system/immich.yaml)",
   "summary": "Incomplete fix for login continue redirect allows slash-backslash open redirect"
  },
  "ghcr.io/immich-app/immich-machine-learning|release:immich-app/immich@v3.3.5": {
   "first": "2026-10-26",
   "last_mailed": "2026-10-26",
   "program": "ghcr.io/immich-app/immich-machine-learning v3.2.4 (immich)",
   "summary": "com/ ) as well as some  nodejs security patches"
  },
  "ghcr.io/immich-app/immich-server|CVE-2026-111497": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "ghcr.io/immich-app/immich-server v2.7.5 (immich-system/immich.yaml)",
   "summary": "Node.js 24.14.1 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process"
  },
  "ghcr.io/immich-app/immich-server|GHSA-3mh5-gqfm-phgj": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "ghcr.io/immich-app/immich-server v2.7.5 (immich-system/immich.yaml)",
   "summary": "Cross-user disclosure of a user's Locked (hidden-vault) assets to a partner via timeline-bucket and search-statistics endpoints"
  },
  "ghcr.io/immich-app/immich-server|GHSA-72rm-x7xr-v679": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "ghcr.io/immich-app/immich-server v2.7.5 (immich-system/immich.yaml)",
   "summary": "Unauthenticated filesystem path injection (arbitrary directory write + recursive delete) in the machine-learning service"
  },
  "ghcr.io/immich-app/immich-server|GHSA-8244-8vpr-vp9c": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "ghcr.io/immich-app/immich-server v2.7.5 (immich-system/immich.yaml)",
   "summary": "One-click account takeover via XSS in login page continue redirect"
  },
  "ghcr.io/immich-app/immich-server|GHSA-c9mf-h82r-8p4j": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "ghcr.io/immich-app/immich-server v2.7.5 (immich-system/immich.yaml)",
   "summary": "Album Editor can escalate to Owner role and remove Owner-role members via unguarded API endpoints"
  },
  "ghcr.io/immich-app/immich-server|GHSA-g4w3-c888-cr93": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "ghcr.io/immich-app/immich-server v2.7.5 (immich-system/immich.yaml)",
   "summary": "A regular user can create SharedLink for album/asset belonging to another user through CreateSharedLink API"
  },
  "ghcr.io/immich-app/immich-server|GHSA-h5w4-vjv4-9r5q": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "ghcr.io/immich-app/immich-server v2.7.5 (immich-system/immich.yaml)",
   "summary": "Incorrect sanitization of continue URL on the /maintenance endpoint"
  },
  "ghcr.io/immich-app/immich-server|GHSA-hfvf-5c8x-8rc4": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "ghcr.io/immich-app/immich-server v2.7.5 (immich-system/immich.yaml)",
   "summary": "OIDC discovery/token/userinfo/JWKS fetches run with TLS certificate verification unconditionally disabled via allowInsecureRequests (CWE-295)"
  },
  "ghcr.io/immich-app/immich-server|GHSA-hv27-723h-qfjq": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "ghcr.io/immich-app/immich-server v2.7.5 (immich-system/immich.yaml)",
   "summary": "Partner \"view-only\" sharing leaks GPS coordinates of the sharer's archived assets via GET /api/map/markers (the map endpoint omits the archived-asset guard the "
  },
  "ghcr.io/immich-app/immich-server|GHSA-jrp5-g662-hq92": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "ghcr.io/immich-app/immich-server v2.7.5 (immich-system/immich.yaml)",
   "summary": "Unsafe ZIP Entry Names (Zip Slip Class) in Archive Download Endpoint"
  },
  "ghcr.io/immich-app/immich-server|GHSA-q89f-h332-8q2h": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "ghcr.io/immich-app/immich-server v2.7.5 (immich-system/immich.yaml)",
   "summary": "Authenticated SVG upload reaches ImageMagick coders and enables RCE"
  },
  "ghcr.io/immich-app/immich-server|GHSA-qp2h-w794-2vhf": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "ghcr.io/immich-app/immich-server v2.7.5 (immich-system/immich.yaml)",
   "summary": "Incomplete fix for login continue redirect allows slash-backslash open redirect"
  },
  "ghcr.io/immich-app/immich-server|release:immich-app/immich@v3.3.5": {
   "first": "2026-10-26",
   "last_mailed": "2026-10-26",
   "program": "ghcr.io/immich-app/immich-server v3.2.4 (immich)",
   "summary": "com/ ) as well as some  nodejs security patches"
  },
  "ghcr.io/karakeep-app/karakeep|CVE-2026-111497": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "ghcr.io/karakeep-app/karakeep 0.33.2 (karakeep)",
   "summary": "Node.js 24.18.1 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process"
  },
  "ghcr.io/karakeep-app/karakeep|GHSA-pp34-2c9r-mchw": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "ghcr.io/karakeep-app/karakeep 0.33.2 (karakeep)",
   "summary": "karakeep-chrome ships Chromium 151.0.7922.47, which is affected by two CVEs in CISA KEV"
  },
  "ghcr.io/karakeep-app/karakeep|release:karakeep-app/karakeep@v0.34.0": {
   "first": "2026-10-26",
   "last_mailed": "2026-10-26",
   "program": "ghcr.io/karakeep-app/karakeep 0.33.2 (karakeep)",
   "summary": "1 for its October security release ( #3196 )"
  },
  "ghcr.io/karakeep-app/karakeep|release:karakeep-app/karakeep@v0.34.1": {
   "first": "2026-10-26",
   "last_mailed": "2026-10-26",
   "program": "ghcr.io/karakeep-app/karakeep 0.33.2 (karakeep)",
   "summary": "This is a security release on top of 0"
  },
  "ghcr.io/lukegus/termix|CVE-2026-111497": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "ghcr.io/lukegus/termix release-2.9.2 (termix-system/termix.yaml)",
   "summary": "Node.js 26.10.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process"
  },
  "ghcr.io/lukegus/termix|GHSA-3q2m-5r5p-w45r": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "ghcr.io/lukegus/termix 2.8.0 (termix)",
   "silent": "first read after the seed",
   "summary": "Cross-user nested automation execution bypasses ownership checks and runs actions with victim privileges"
  },
  "ghcr.io/lukegus/termix|GHSA-6gr3-r7jx-wfmh": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "ghcr.io/lukegus/termix 2.8.0 (termix)",
   "silent": "first read after the seed",
   "summary": "Two-factor authentication can be bypassed via a forged client-supplied device identifier"
  },
  "ghcr.io/lukegus/termix|GHSA-7j7m-85p4-2cpm": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "ghcr.io/lukegus/termix 2.8.0 (termix)",
   "silent": "first read after the seed",
   "summary": "Authentication Bypass by Spoofing and Improper Restriction of Excessive Authentication Attempts in Termix"
  },
  "ghcr.io/lukegus/termix|GHSA-fj9w-vcj9-66qh": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "ghcr.io/lukegus/termix 2.8.0 (termix)",
   "silent": "first read after the seed",
   "summary": "Termix: the automation `run_command` step substitutes untrusted template values straight into a shell command, ignoring the quoting contract its own template mo"
  },
  "ghcr.io/lukegus/termix|GHSA-frx8-qqgg-7j7g": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "ghcr.io/lukegus/termix 2.8.0 (termix)",
   "silent": "first read after the seed",
   "summary": "Termix Desktop: any website can obtain a session on the embedded backend (CORS allows all origins + passwordless loopback auto-session)"
  },
  "ghcr.io/lukegus/termix|GHSA-hmv7-25x4-vp6w": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "ghcr.io/lukegus/termix 2.8.0 (termix)",
   "silent": "first read after the seed",
   "summary": "Termix: a read-only session-share guest can delete its own participant record and then type into the owner's live SSH session, turning a \"watch only\" link into "
  },
  "ghcr.io/lukegus/termix|GHSA-j7j4-82wh-3vj5": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "ghcr.io/lukegus/termix 2.8.0 (termix)",
   "silent": "first read after the seed",
   "summary": "LDAPS certificate validation is disabled, allowing MITM capture of LDAP and user credentials"
  },
  "ghcr.io/lukegus/termix|GHSA-r7x4-j6x8-jxrx": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "ghcr.io/lukegus/termix 2.8.0 (termix)",
   "silent": "first read after the seed",
   "summary": "Authenticated users can mint Guacamole tokens for arbitrary RDP/VNC/Telnet targets"
  },
  "ghcr.io/lukegus/termix|GHSA-r9gw-3w87-mhh7": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "ghcr.io/lukegus/termix 2.8.0 (termix)",
   "silent": "first read after the seed",
   "summary": "Improper certificate validation in Electron desktop client enables MITM credential/token theft"
  },
  "ghcr.io/lukegus/termix|GHSA-rgf3-2q88-q4wp": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "ghcr.io/lukegus/termix 2.8.0 (termix)",
   "silent": "first read after the seed",
   "summary": "Cross-User File Manager SSH Session Termination and State Replacement"
  },
  "ghcr.io/lukegus/termix|GHSA-v3vp-ffww-q7pw": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "ghcr.io/lukegus/termix 2.8.0 (termix)",
   "silent": "first read after the seed",
   "summary": "Credential disclosure vulnerability in Termix"
  },
  "ghcr.io/lukegus/termix|GHSA-wv2p-5jqw-9qf3": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "ghcr.io/lukegus/termix 2.8.0 (termix)",
   "silent": "first read after the seed",
   "summary": "User-controlled Vault address is fetched without SSRF controls"
  },
  "ghcr.io/paperless-ngx/paperless-ngx|CVE-2026-111497": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "ghcr.io/paperless-ngx/paperless-ngx 3.3.4 (paperless-system/paperless.yaml)",
   "summary": "Python Brotli 1.2.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell), PYSEC-2026-4322"
  },
  "ghcr.io/paperless-ngx/paperless-ngx|GHSA-2jhj-xqrq-rmrq": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "ghcr.io/paperless-ngx/paperless-ngx 2.20.15 (paperless-ngx)",
   "silent": "first read after the seed",
   "summary": "Path traversal in filename generation when `FILENAME_FORMAT_REMOVE_NONE` enabled"
  },
  "ghcr.io/paperless-ngx/paperless-ngx|GHSA-c8f3-pqr2-rr24": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "ghcr.io/paperless-ngx/paperless-ngx 2.20.15 (paperless-ngx)",
   "silent": "first read after the seed",
   "summary": "Cross-user information disclosure in AI classification workflows on ownerless documents"
  },
  "ghcr.io/papra-hq/papra|CVE-2026-111497": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "ghcr.io/papra-hq/papra 26.6.2-rootless (papra)",
   "summary": "Node.js 26.4.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process"
  },
  "ghcr.io/seanmorley15/adventurelog-backend|release:seanmorley15/AdventureLog@v0.13.1": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "ghcr.io/seanmorley15/adventurelog-backend v0.13.0 (adventurelog)",
   "summary": "This release includes security updates for the backend, frontend, and container images"
  },
  "ghcr.io/seanmorley15/adventurelog-frontend|CVE-2026-111497": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "ghcr.io/seanmorley15/adventurelog-frontend v0.13.0 (adventurelog)",
   "summary": "Node.js 26.3.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process"
  },
  "ghcr.io/seanmorley15/adventurelog-frontend|release:seanmorley15/AdventureLog@v0.13.1": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "ghcr.io/seanmorley15/adventurelog-frontend v0.13.0 (adventurelog)",
   "summary": "This release includes security updates for the backend, frontend, and container images"
  },
  "ghcr.io/tandoorrecipes/recipes|CVE-2026-111497": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "ghcr.io/tandoorrecipes/recipes 2.6.15 (tandoor)",
   "summary": "Node.js 24.18.1 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process"
  },
  "ghcr.io/tandoorrecipes/recipes|GHSA-5f74-7rgh-pc97": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "ghcr.io/tandoorrecipes/recipes 2.6.15 (tandoor)",
   "silent": "first read after the seed",
   "summary": "Recipe import subsystem: XXE local file read via lxml default parser (rezeptsuitede/Cookmate XML importers) and SSRF in the pestle importer left out of the GHSA"
  },
  "ghcr.io/tandoorrecipes/recipes|GHSA-5p9v-743w-79h3": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "ghcr.io/tandoorrecipes/recipes 2.6.15 (tandoor)",
   "silent": "first read after the seed",
   "summary": "Shopping-list bulk create accepts foreign-Space Food/Unit/Ingredient IDs and returns their names"
  },
  "ghcr.io/tandoorrecipes/recipes|GHSA-69q3-5q6x-7hmx": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "ghcr.io/tandoorrecipes/recipes 2.6.15 (tandoor)",
   "silent": "first read after the seed",
   "summary": "Group-Permission Cache Key Omits Active Space"
  },
  "ghcr.io/tandoorrecipes/recipes|GHSA-748x-xc8h-95hj": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "ghcr.io/tandoorrecipes/recipes 2.6.15 (tandoor)",
   "silent": "first read after the seed",
   "summary": "User can move an owned entry into another user’s unshared recipe book"
  },
  "ghcr.io/tandoorrecipes/recipes|GHSA-c7mc-c9jr-38hf": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "ghcr.io/tandoorrecipes/recipes 2.6.15 (tandoor)",
   "silent": "first read after the seed",
   "summary": "Any user can read other spaces' meal plans via mealplan_id on shopping list entries"
  },
  "ghcr.io/tandoorrecipes/recipes|GHSA-cqj3-64qw-4w52": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "ghcr.io/tandoorrecipes/recipes 2.6.15 (tandoor)",
   "silent": "first read after the seed",
   "summary": "Private recipe file and share-link authorization bypass in recipe utility API endpoints"
  },
  "ghcr.io/tandoorrecipes/recipes|GHSA-pcq2-64qw-jm4x": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "ghcr.io/tandoorrecipes/recipes 2.6.15 (tandoor)",
   "silent": "first read after the seed",
   "summary": "Private recipe overview disclosed through ShoppingListRecipe API in 2.6.15"
  },
  "ghcr.io/tandoorrecipes/recipes|GHSA-vc5c-xh64-79vp": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "ghcr.io/tandoorrecipes/recipes 2.6.15 (tandoor)",
   "silent": "first read after the seed",
   "summary": "Fix for GHSA-5mw3-c978-gc6w checks UserSpace ids against User ids"
  },
  "ghcr.io/tandoorrecipes/recipes|GHSA-xq7g-9q95-vjc6": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "ghcr.io/tandoorrecipes/recipes 2.6.15 (tandoor)",
   "silent": "first read after the seed",
   "summary": "Server-Side Request Forgery (SSRF) in Pestle Recipe Import"
  },
  "ghcr.io/tandoorrecipes/recipes|release:TandoorRecipes/recipes@2.7.0": {
   "first": "2026-10-26",
   "last_mailed": "2026-10-26",
   "program": "ghcr.io/tandoorrecipes/recipes 2.6.15 (tandoor)",
   "summary": "fixed  shopping list bulk API endpoint accepted IDs from foreign spaces  GHSA-5p9v-743w-79h3"
  },
  "ghost|CVE-2026-111497": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "ghost 6.67.0-alpine (ghost)",
   "summary": "Node.js 22.23.3 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process"
  },
  "gitea/gitea|GHSA-25gq-j9jx-43pg": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)"
  },
  "gitea/gitea|GHSA-2fcr-jfvc-vgg2": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Two SSRF findings in Gitea 1.26.2"
  },
  "gitea/gitea|GHSA-2m9v-5q2g-58vq": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Git LFS object reuse allows non-Code access to authorize private source objects"
  },
  "gitea/gitea|GHSA-2r5c-gw76-rh3w": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter"
  },
  "gitea/gitea|GHSA-2wm4-vwp6-v7xc": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata"
  },
  "gitea/gitea|GHSA-2xph-7j4g-43rg": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Fork pull requests can read reusable workflow files from another private repository (missed sibling of GHSA-fj8v-hjwv-qm88)"
  },
  "gitea/gitea|GHSA-36q5-5423-vgx2": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Unbounded Alpine .PKGINFO parse amplifies a small .apk upload into process memory"
  },
  "gitea/gitea|GHSA-3pww-vcvm-3gmj": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "API access token scope enforcement bypass on repository RSS/Atom feed endpoints leaks private repository commit data"
  },
  "gitea/gitea|GHSA-3r5c-2xxx-h872": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Webhook Authorization Header Returned in Plaintext via API"
  },
  "gitea/gitea|GHSA-44qc-pgvp-wx7v": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Notification API leaks private issue metadata after access revocation"
  },
  "gitea/gitea|GHSA-467c-4w7p-8427": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "gitea/gitea 1.27.3 (gitea)",
   "silent": "first read after the seed",
   "summary": "Algorithmic Complexity DoS in Issue Reference Parsing"
  },
  "gitea/gitea|GHSA-469m-x4mw-38r3": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "gitea/gitea 1.27.3 (gitea)",
   "silent": "first read after the seed",
   "summary": "OAuth access tokens can be exchanged as refresh tokens"
  },
  "gitea/gitea|GHSA-46c7-w5w4-h644": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Email Management API Bypasses ManageCredentials Feature Restrictions"
  },
  "gitea/gitea|GHSA-46px-6cqx-c5fv": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Authenticated DoS in OneDev migration via unbounded version response body"
  },
  "gitea/gitea|GHSA-4j4g-m7mr-hp5j": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "gitea/gitea 1.27.3 (gitea)",
   "silent": "first read after the seed",
   "summary": "Unapproved fork PR cancels trusted in-progress runs via run-level concurrency"
  },
  "gitea/gitea|GHSA-4jmf-h2cm-hg7w": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "gitea/gitea 1.27.3 (gitea)",
   "silent": "first read after the seed",
   "summary": "Cross-Site Request Forgery on `POST /{owner}/{repo}/topics`"
  },
  "gitea/gitea|GHSA-4xjf-493q-98p3": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Gitea SSH Key Parser Denial of Service"
  },
  "gitea/gitea|GHSA-54w9-6cc5-9wj9": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "gitea/gitea 1.27.3 (gitea)",
   "silent": "first read after the seed",
   "summary": "Migration SSRF policy regression: ALLOWED_DOMAINS permits reserved addresses despite ALLOW_LOCALNETWORKS=false"
  },
  "gitea/gitea|GHSA-579w-82gf-89m2": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Remote Code Execution via unescaped markup `Context` into external renderer argv"
  },
  "gitea/gitea|GHSA-5952-x23q-p23f": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Authenticated DoS in GitLab migration via uncancelable version probe"
  },
  "gitea/gitea|GHSA-5ggr-2f2h-jmvm": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Local File Inclusion via file:// URI in Migration Restore"
  },
  "gitea/gitea|GHSA-5w72-2mqm-qh46": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Wiki-only members can read private pull request titles through markup preview"
  },
  "gitea/gitea|GHSA-5xcq-p92v-43rf": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Package size quota bypass and unbounded memory read in the Maven checksum upload path"
  },
  "gitea/gitea|GHSA-5xp7-r6cr-39ff": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "A fork pull request author can satisfy a required Actions status check without any workflow running, because a filtered out workflow taken from the pull request"
  },
  "gitea/gitea|GHSA-66m4-5jjr-2rg5": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocatio"
  },
  "gitea/gitea|GHSA-683j-3ff6-hh2x": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Privilege Escalation via Access Token Scope Escalation in API"
  },
  "gitea/gitea|GHSA-6c6r-5xr4-cr5m": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Cross-repository issue/comment attachment re-linking can expose private attachment content"
  },
  "gitea/gitea|GHSA-6cqf-375w-639g": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)"
  },
  "gitea/gitea|GHSA-6f9g-7jgm-m5ph": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "gitea/gitea 1.27.3 (gitea)",
   "silent": "first read after the seed",
   "summary": "Gitea Actions Artifact V4 API: unbounded request body read in parseProtobufBody enables memory-exhaustion DoS"
  },
  "gitea/gitea|GHSA-6g2h-xpg3-rm48": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "gitea/gitea 1.27.3 (gitea)",
   "silent": "first read after the seed",
   "summary": "Migration / pull-mirror SSRF, egress allow-list bypass via multi-answer DNS - 3 findings"
  },
  "gitea/gitea|GHSA-6hm7-3pwj-22rm": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload"
  },
  "gitea/gitea|GHSA-6pv5-8rp7-8c75": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "gitea/gitea 1.27.3 (gitea)",
   "silent": "first read after the seed",
   "summary": "Duplicate tree-entry name: Gitea renders the benign blob while checkout and CI run the malicious one"
  },
  "gitea/gitea|GHSA-7769-9pr9-m24h": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "gitea/gitea 1.27.3 (gitea)",
   "silent": "first read after the seed",
   "summary": "Deploy keys impersonate the repository owner in the hook pipeline"
  },
  "gitea/gitea|GHSA-777r-4v59-6486": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Permanent Fork PR Workflow Approval Gate Bypass"
  },
  "gitea/gitea|GHSA-7cq7-4v93-8wjm": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "gitea/gitea 1.27.3 (gitea)",
   "silent": "first read after the seed",
   "summary": "Stored XSS in Gitea container registry via unvalidated blob Content-Type (mediaType injection)"
  },
  "gitea/gitea|GHSA-7p4h-3gxq-x3h3": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118"
  },
  "gitea/gitea|GHSA-7v5j-mph8-9w6g": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "gitea/gitea 1.27.3 (gitea)",
   "silent": "first read after the seed",
   "summary": "Push-mirror API checks local-path permission on the repository owner instead of the caller"
  },
  "gitea/gitea|GHSA-7w2r-xwp6-mh6c": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Gitea Actions: fork pull request approval bypass via `pull_request_review_comment` (missing `WithPullRequest`)"
  },
  "gitea/gitea|GHSA-7wvc-rvp7-w99x": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories"
  },
  "gitea/gitea|GHSA-8hhh-mqpg-jpxc": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "gitea/gitea 1.27.3 (gitea)",
   "silent": "first read after the seed",
   "summary": "Gitea push-mirror creation API does not enforce the site-wide DISABLE_NEW_PUSH policy"
  },
  "gitea/gitea|GHSA-8j56-f865-gqq2": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "gitea/gitea 1.27.3 (gitea)",
   "silent": "first read after the seed",
   "summary": "Draft releases include attachment metadata from other repositories"
  },
  "gitea/gitea|GHSA-8p9h-49rc-qgxj": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Repository Visibility Manipulation via Git Push Options"
  },
  "gitea/gitea|GHSA-8pwg-hcgm-54cp": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "gitea/gitea 1.27.3 (gitea)",
   "silent": "first read after the seed",
   "summary": "Built-in SSH server auth bypass via case-insensitive LIKE key lookup"
  },
  "gitea/gitea|GHSA-8r3w-5682-jrqf": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Unbounded gitignores repository-creation field enables linear template-read amplification"
  },
  "gitea/gitea|GHSA-8vmh-w35x-73qr": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Unauthenticated Blind SSRF via OpenID Sign-In Verification"
  },
  "gitea/gitea|GHSA-8xjr-x7rg-hp5h": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "2FA bypass and persistent account takeover via OpenID identity linking"
  },
  "gitea/gitea|GHSA-92j2-6qcg-c28c": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "WebAuthn second factor is bypassed on OAuth2/OpenID sign-in (WebAuthn-only users)"
  },
  "gitea/gitea|GHSA-93pj-3x56-5gc2": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "gitea/gitea 1.27.3 (gitea)",
   "silent": "first read after the seed",
   "summary": "Cancelled fork-PR Actions jobs are revived by later approval"
  },
  "gitea/gitea|GHSA-94rx-fqm6-q23v": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "gitea/gitea 1.27.3 (gitea)",
   "silent": "first read after the seed",
   "summary": "Stored XSS via Repository Media API"
  },
  "gitea/gitea|GHSA-94v3-77j7-vm48": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)"
  },
  "gitea/gitea|GHSA-96gv-2xc4-4hxj": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Gitea watched-repos API (GET /api/v1/user/subscriptions) leaks private repository metadata after team permission downgrade"
  },
  "gitea/gitea|GHSA-96qg-qxxj-r8xq": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "gitea/gitea 1.27.3 (gitea)",
   "silent": "first read after the seed",
   "summary": "Issue-scoped attachment routes accept comment-scoped attachment ids, letting an issue opener delete or rename other users' comment attachments"
  },
  "gitea/gitea|GHSA-9h7g-h754-c8x2": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "gitea/gitea 1.27.3 (gitea)",
   "silent": "first read after the seed",
   "summary": "Installer Re-run Against an Already-Populated Database Grants an Authenticated Session for an Existing Admin Account Without Password Verification"
  },
  "gitea/gitea|GHSA-9mq6-mqjj-c2c5": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads"
  },
  "gitea/gitea|GHSA-c3cr-qq9g-666c": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "gitea/gitea 1.27.3 (gitea)",
   "silent": "first read after the seed",
   "summary": "Unauthenticated nil-pointer panic on /{username}/-/repositories for individual users"
  },
  "gitea/gitea|GHSA-cp3q-vrj2-ghhh": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents"
  },
  "gitea/gitea|GHSA-cwq7-782w-pxcc": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "gitea/gitea 1.27.3 (gitea)",
   "silent": "first read after the seed",
   "summary": "Gitea AddReleaseAttachments missing IssueID check allows issue attachment metadata exposure and deletion via releases"
  },
  "gitea/gitea|GHSA-f75j-4cw6-rmx4": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Gitea Docker image: `REVERSE_PROXY_TRUSTED_PROXIES = *` default lets any source IP impersonate any user via `X-WEBAUTH-USER`"
  },
  "gitea/gitea|GHSA-f8ph-p9p5-vg2p": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Unauthenticated artifact-to-repository oracle in raw Actions downloads"
  },
  "gitea/gitea|GHSA-fj8v-hjwv-qm88": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)"
  },
  "gitea/gitea|GHSA-fq2p-5p22-8g6j": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints"
  },
  "gitea/gitea|GHSA-fqjr-23c8-gg9m": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "gitea/gitea 1.27.3 (gitea)",
   "silent": "first read after the seed",
   "summary": "SSRF via DNS rebinding: MatchHostOrIP short-circuits IP check when hostname matches ALLOWED_DOMAINS"
  },
  "gitea/gitea|GHSA-fqxf-w92m-prvq": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Swift registry per-file 128KiB manifest guard bypassed by aggregation"
  },
  "gitea/gitea|GHSA-frpv-2xgv-wxpq": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Attachments created before the January 2026 cutoff skip the cross repository check entirely, and permission is then evaluated against the repository named in th"
  },
  "gitea/gitea|GHSA-frpw-3h2q-4jj6": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs"
  },
  "gitea/gitea|GHSA-fw57-jgch-pgf3": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests"
  },
  "gitea/gitea|GHSA-fx95-gwfc-grgc": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "gitea/gitea 1.27.3 (gitea)",
   "silent": "first read after the seed",
   "summary": "Gitea push-to-create ignores ForcePrivate server policy, allowing non-admin users to publish repositories as public"
  },
  "gitea/gitea|GHSA-fxq4-gr55-7x5g": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "gitea/gitea 1.27.3 (gitea)",
   "silent": "first read after the seed",
   "summary": "DeleteLabel compares one untyped id against whichever namespace the label uses, letting a repo collaborator delete an ID-colliding organisation's labels"
  },
  "gitea/gitea|GHSA-g4hw-fg4c-89mq": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "gitea/gitea 1.27.3 (gitea)",
   "silent": "first read after the seed",
   "summary": "Raw Git redirect SSRF bypass in push mirrors, WikiRemoteURL, and PR-head fetches"
  },
  "gitea/gitea|GHSA-g5jj-gp8w-73h7": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Repo-side team-link endpoint still bypasses RepoAdminChangeTeamAccess"
  },
  "gitea/gitea|GHSA-gx3v-q759-g323": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surface"
  },
  "gitea/gitea|GHSA-h2x6-g7q6-344v": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Repository migration SSRF via multi-answer DNS allow-list bypass"
  },
  "gitea/gitea|GHSA-h56g-4qw7-2mxg": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Public-only API token restriction is not enforced on team API routes"
  },
  "gitea/gitea|GHSA-h62v-wmrr-5qjq": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Admin repository collaborator can self-escalate to Owner and transfer the repository"
  },
  "gitea/gitea|GHSA-hcgw-r9gf-8mph": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "gitea/gitea 1.27.3 (gitea)",
   "silent": "first read after the seed",
   "summary": "Gitea Push Mirror Host Policy Bypass Enables SSRF and Forced Writes to Internal Git Repositories"
  },
  "gitea/gitea|GHSA-hch4-r2j8-xm72": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Repository listing exposes repositories owned by hidden users due to inconsistent visibility predicate"
  },
  "gitea/gitea|GHSA-hf55-9cwq-2x64": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "gitea/gitea 1.27.3 (gitea)",
   "silent": "first read after the seed",
   "summary": "Web RSS/Atom Accept-header bypass leaks activity feeds of limited/private users and orgs"
  },
  "gitea/gitea|GHSA-hxhc-246f-rvqc": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Organization repository creation endpoint skips repository token scope"
  },
  "gitea/gitea|GHSA-j2w3-9c3r-g83q": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Private Repository Metadata Remains Accessible After Access Revocation"
  },
  "gitea/gitea|GHSA-j72v-mjr6-3424": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation)"
  },
  "gitea/gitea|GHSA-jj5r-9rpc-8h6h": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "gitea/gitea 1.27.3 (gitea)",
   "silent": "first read after the seed",
   "summary": "A migration source reporting max_response_items: 0 makes six paginated loops in the Gitea downloader never terminate, exhausting server memory from one authenti"
  },
  "gitea/gitea|GHSA-jr5x-6h83-wrxf": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "REST API exposes organization membership of private organizations to public"
  },
  "gitea/gitea|GHSA-m6qc-j894-7h9r": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting"
  },
  "gitea/gitea|GHSA-m78w-jjjx-gp8r": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Public-only tokens can read private head repositories via compare and pull request creation (incomplete fix of CVE-2026-58443)"
  },
  "gitea/gitea|GHSA-m932-crvm-gcp5": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service"
  },
  "gitea/gitea|GHSA-m984-2424-x6vw": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Generic attachment downloads bypass draft-release visibility checks"
  },
  "gitea/gitea|GHSA-mf69-7pqq-86vx": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "gitea/gitea 1.27.3 (gitea)",
   "silent": "first read after the seed",
   "summary": "Cross-Session OpenID Credential Linking Enables Account Takeover"
  },
  "gitea/gitea|GHSA-mg4f-x9v4-6h2p": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes"
  },
  "gitea/gitea|GHSA-mw6q-qj47-9g5q": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "gitea/gitea 1.27.3 (gitea)",
   "silent": "first read after the seed",
   "summary": "Uncaught Exception and Out-of-bounds Read results in Gitea crash"
  },
  "gitea/gitea|GHSA-p3pc-g8m5-hrrr": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "gitea/gitea 1.27.3 (gitea)",
   "silent": "first read after the seed",
   "summary": "Migration SSRF via DNS Rebinding — TOCTOU Between DNS Validation and Git Connection"
  },
  "gitea/gitea|GHSA-p3rv-cr5f-9gjh": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "gitea/gitea 1.27.3 (gitea)",
   "silent": "first read after the seed",
   "summary": "Uncontrolled resource consumption — unapproved fork-PR workflow with a large static strategy.matrix exhausts server memory at run-creation"
  },
  "gitea/gitea|GHSA-p4mj-98mv-xq26": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Private Repository Existence Disclosure via go-get Meta Endpoint"
  },
  "gitea/gitea|GHSA-pgqf-926r-548m": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API"
  },
  "gitea/gitea|GHSA-pq8x-xpgp-rvmh": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Permissive Git hook directory and script modes may allow local code execution as the Gitea service account"
  },
  "gitea/gitea|GHSA-prr9-9mp4-5gp2": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Private org member list leaked via /members API endpoint — incomplete fix for PR #38145"
  },
  "gitea/gitea|GHSA-pvjf-7jrm-6w9g": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "gitea/gitea 1.27.3 (gitea)",
   "silent": "first read after the seed",
   "summary": "Untrusted first-time fork PR achieves self-hosted Actions runner RCE without approval via cancel-then-rerun"
  },
  "gitea/gitea|GHSA-px3q-x2mm-55wg": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Package registry: restricted users can read packages of limited-visibility users (authorization bypass)"
  },
  "gitea/gitea|GHSA-q423-49rw-g9mh": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private"
  },
  "gitea/gitea|GHSA-q55v-4cmj-xh65": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "User-scoped tokens can mint unscoped HTTP signature API credentials"
  },
  "gitea/gitea|GHSA-q9pg-jj6x-j9p6": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive I"
  },
  "gitea/gitea|GHSA-r96c-jc75-rxv6": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Gitea workflow badge bypasses API token scopes"
  },
  "gitea/gitea|GHSA-r9ch-mqjm-g67v": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Secret Exfiltration via Reusable Workflow Resolution in pull_request_target Events"
  },
  "gitea/gitea|GHSA-rcr6-4jqh-j84m": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Remote Code Execution via diffpatch Git Hook Installation"
  },
  "gitea/gitea|GHSA-rfm6-r2x5-cg56": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Restricted users can access limited-visibility users' activity feeds and contribution heatmaps through the API"
  },
  "gitea/gitea|GHSA-rgv6-xp99-6mgj": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Gitea Remember-Me Token Theft Not Invalidating Attacker Session"
  },
  "gitea/gitea|GHSA-rh79-75qm-gwjr": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Gitea LFS Deploy-Key Privilege Escalation"
  },
  "gitea/gitea|GHSA-rqhx-647v-wx32": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "gitea/gitea 1.27.3 (gitea)",
   "silent": "first read after the seed",
   "summary": "SSRF via HTTP Redirect in Repository Migration"
  },
  "gitea/gitea|GHSA-v2w8-m4gr-qj65": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "RCE on self-hosted runners | fork-PR approval gate (`NeedApproval`) bypass via job-level concurrency cancellation"
  },
  "gitea/gitea|GHSA-v73x-hx65-6pf4": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Unauthorized Access to Labels of Private Organizations"
  },
  "gitea/gitea|GHSA-vcp6-2qc6-gvq3": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "gitea/gitea 1.27.3 (gitea)",
   "silent": "first read after the seed",
   "summary": "VerifyCert maps SSH certificate principals onto other users' SSH public keys"
  },
  "gitea/gitea|GHSA-vrhc-jjfc-m3m3": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)"
  },
  "gitea/gitea|GHSA-vvqw-mjq8-x248": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "gitea/gitea 1.27.3 (gitea)",
   "silent": "first read after the seed",
   "summary": "POST /{owner}/{repo}/tags/delete requires only Code:Write but destroys Releases and their attachment blobs"
  },
  "gitea/gitea|GHSA-vxv2-8j6r-pcpg": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)"
  },
  "gitea/gitea|GHSA-w4wc-g858-3672": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Restricted users can enumerate limited-visibility organizations via the user org-list API (authorization bypass)"
  },
  "gitea/gitea|GHSA-w5pg-649r-p6gg": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag"
  },
  "gitea/gitea|GHSA-wg93-gp4m-c6vr": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Restricted users can read limited-visibility users' issue titles and bodies through issue search"
  },
  "gitea/gitea|GHSA-wrf9-r3h7-7x5v": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Fork Synchronization Continues After Parent Repository Changes from Public to Private"
  },
  "gitea/gitea|GHSA-ww9q-7j5q-hrv5": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Token Scope Bypass on `GET /api/v1/orgs`"
  },
  "gitea/gitea|GHSA-wwmh-7r9x-fg49": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Restricted users can read limited-visibility users’ SSH and GPG keys through the API"
  },
  "gitea/gitea|GHSA-wx44-9m3m-rjqx": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "gitea/gitea 1.27.3 (gitea)",
   "silent": "first read after the seed",
   "summary": "Locked issues and comments still accept reactions through the web UI"
  },
  "gitea/gitea|GHSA-x4q3-gcj3-m6cf": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "gitea/gitea 1.27.3 (gitea)",
   "silent": "first read after the seed",
   "summary": "gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled"
  },
  "gitea/gitea|GHSA-x58h-3mx5-q44r": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Repository migration skips public-only token guard for private repository creation"
  },
  "gitea/gitea|GHSA-x77v-q46j-393g": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim"
  },
  "gitea/gitea|GHSA-x8c3-3rp8-2j46": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "gitea/gitea 1.27.3 (gitea)",
   "silent": "first read after the seed",
   "summary": "API team demotion does not reset unit permissions"
  },
  "gitea/gitea|GHSA-xfqq-h54g-92f8": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "gitea/gitea 1.27.3 (gitea)",
   "silent": "first read after the seed",
   "summary": " Incorrect Authorization in Repository Transfer Allows Persistent Unauthorized Read Access"
  },
  "gitea/gitea|GHSA-xh39-mxw9-34pp": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "gitea/gitea 1.27.3 (gitea)",
   "silent": "first read after the seed",
   "summary": "Gitea Actions: fork pull request approval bypass via maintainer-triggered pull_request sub-events (ifNeedApprovalWith keys on the event actor, not the pull requ"
  },
  "gitea/gitea|GHSA-xmfc-hqq8-33wh": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "gitea/gitea 1.27.3 (gitea)",
   "silent": "first read after the seed",
   "summary": "Private profile information leaks on POST request"
  },
  "gitea/gitea|GHSA-xmj7-xj85-hfc3": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL"
  },
  "gitea/gitea|GHSA-xv9x-fj9g-vj6h": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access"
  },
  "gitea/gitea|GHSA-xvfh-qwmh-f92w": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "API routes for user social graph, keys, and starred repos bypass private visibility check"
  },
  "gitea/gitea|GHSA-xxjv-752h-3vp2": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Public-only repository tokens can update private PR head branches"
  },
  "gitea/gitea|release:go-gitea/gitea@v1.27.0": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
   "summary": "Fix: various security fixes ( #38406 ) ( #38426 )"
  },
  "glanceapp/glance|GHSA-r225-jhr6-68cc": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "glanceapp/glance v0.8.5 (glance)",
   "silent": "first read after the seed",
   "summary": "Unauthenticated login requests can cause unbounded memory consumption"
  },
  "grafana/grafana|GHSA-2x6g-h2hg-rq84": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "grafana/grafana 13.2.3 (grafana)",
   "silent": "first read after the seed",
   "summary": "Email addresses and usernames can not be trusted"
  },
  "grafana/grafana|GHSA-4724-7jwc-3fpw": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "grafana/grafana 13.2.3 (grafana)",
   "silent": "first read after the seed",
   "summary": "Spoofing originalUrl of snapshots"
  },
  "grafana/grafana|GHSA-8wjh-59cw-9xh4": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "grafana/grafana 13.2.3 (grafana)",
   "silent": "first read after the seed",
   "summary": "Forward OAuth Identity Token can allow users to access some data sources"
  },
  "grafana/grafana|GHSA-8xmm-x63g-f6xv": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "grafana/grafana 13.2.3 (grafana)",
   "silent": "first read after the seed",
   "summary": "Stored XSS in ResourcePicker component "
  },
  "grafana/grafana|release:grafana/grafana@v13.2.5": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "grafana/grafana 13.2.4 (mon-system/monitoring.yaml)",
   "summary": "Security: Fix CVE-2026-100105"
  },
  "grafana/grafana|release:grafana/grafana@v13.3.0": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "grafana/grafana 13.2.4 (mon-system/monitoring.yaml)",
   "summary": "Security: Fix CVE-2026-100105"
  },
  "gtstef/filebrowser|CVE-2026-111497": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "gtstef/filebrowser 1.5.8-stable (controller infra)",
   "summary": "Alpine brotli-libs 1.2.0-r1 inside the image: the Brotli library of the image's Alpine base (HTTP2Shell)"
  },
  "gtstef/filebrowser|GHSA-26fh-r34c-qxh6": {
   "first": "2026-10-26",
   "last_mailed": "2026-10-26",
   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
   "summary": "Moving or renaming a folder retargets public shares to the whole folder"
  },
  "gtstef/filebrowser|GHSA-3846-gh75-gp3m": {
   "first": "2026-10-26",
   "last_mailed": "2026-10-26",
   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
   "summary": "Public upload share AllowReplacements=false is bypassed by override=true (deny only checks unused action=override)"
  },
  "gtstef/filebrowser|GHSA-3j46-5w28-f8p2": {
   "first": "2026-10-26",
   "last_mailed": "2026-10-26",
   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
   "summary": "Incomplete symlink-containment remediation: relocated archive symlink allows arbitrary host file write"
  },
  "gtstef/filebrowser|GHSA-4fhx-8pf6-5gmr": {
   "first": "2026-10-26",
   "last_mailed": "2026-10-26",
   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
   "summary": "Duplicate finder can show another user’s restricted file names from a shared cache"
  },
  "gtstef/filebrowser|GHSA-4v62-884x-2466": {
   "first": "2026-10-26",
   "last_mailed": "2026-10-26",
   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
   "summary": "Read-only sources (`readOnly: true`) can be written and deleted through WebDAV, archive/unarchive and the OnlyOffice save callback"
  },
  "gtstef/filebrowser|GHSA-4vrc-935w-xxq2": {
   "first": "2026-10-26",
   "last_mailed": "2026-10-26",
   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
   "summary": "Per-path access DENY rule bypass via filesystem name aliases (case variant, Windows 8.3 short name, trailing-dot) — access rules evaluated before path canonical"
  },
  "gtstef/filebrowser|GHSA-4wmj-rq3c-m65v": {
   "first": "2026-10-26",
   "last_mailed": "2026-10-26",
   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
   "summary": "Improper session revocation allows authentication bypass via revoked-JWT resurrection in `extractUserFromExpiredToken`"
  },
  "gtstef/filebrowser|GHSA-55mw-cwg7-m8f5": {
   "first": "2026-10-26",
   "last_mailed": "2026-10-26",
   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
   "summary": "`GET /public/api/media/metadata` returns file content to anonymous share visitors, ignoring the share's download limit and file-viewer setting"
  },
  "gtstef/filebrowser|GHSA-6gr6-5qpq-888p": {
   "first": "2026-10-26",
   "last_mailed": "2026-10-26",
   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
   "summary": "Privilege Escalation: Restricted Custom API Token Can Be Upgraded to a Full-Permission Session Token via /api/auth/renew in FileBrowser Quantum"
  },
  "gtstef/filebrowser|GHSA-8655-2ph3-q7q7": {
   "first": "2026-10-26",
   "last_mailed": "2026-10-26",
   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
   "summary": "Authenticated Modify-only user can create new files through WebDAV PUT despite Create permission being disabled"
  },
  "gtstef/filebrowser|GHSA-8m35-wcjh-95q7": {
   "first": "2026-10-26",
   "last_mailed": "2026-10-26",
   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
   "summary": "Logout Bypass via Alternate JWT Spelling"
  },
  "gtstef/filebrowser|GHSA-9fcr-gm58-p839": {
   "first": "2026-10-26",
   "last_mailed": "2026-10-26",
   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
   "summary": "Share directory-archive download skips per-user access rules, exposing admin-denied content to anonymous share visitors"
  },
  "gtstef/filebrowser|GHSA-9wm6-jcjh-3m8c": {
   "first": "2026-10-26",
   "last_mailed": "2026-10-26",
   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
   "summary": "Stored XSS via Unsanitized DOCX Hyperlink in DocViewer"
  },
  "gtstef/filebrowser|GHSA-c7pj-xjp9-x4xp": {
   "first": "2026-10-26",
   "last_mailed": "2026-10-26",
   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
   "summary": "Read-only users can overwrite files through PUT /api/resources"
  },
  "gtstef/filebrowser|GHSA-c84q-q5g6-r47f": {
   "first": "2026-10-26",
   "last_mailed": "2026-10-26",
   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
   "summary": "createUserDir: new accounts named `..` or `b..ob` are given the folder that holds every user's home, or another user's home (cross-user read and write)"
  },
  "gtstef/filebrowser|GHSA-c9cr-w724-gqj3": {
   "first": "2026-10-26",
   "last_mailed": "2026-10-26",
   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
   "summary": "Session tokens issued in the same second are identical, so a low-privilege user's session can resolve to another user, including an admin"
  },
  "gtstef/filebrowser|GHSA-cw65-p35p-633w": {
   "first": "2026-10-26",
   "last_mailed": "2026-10-26",
   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
   "summary": "FileBrowser Quantum: file-upload / mkdir authorization uses the scope-relative path, bypassing per-user access-rule denials (write into a restricted directory)"
  },
  "gtstef/filebrowser|GHSA-g2q5-r6ch-v25f": {
   "first": "2026-10-26",
   "last_mailed": "2026-10-26",
   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
   "summary": "FileBrowser Quantum authenticated arbitrary file read via symlink following on the preview read path (incomplete fix of GHSA-mgqf-5mf5-prfj)"
  },
  "gtstef/filebrowser|GHSA-gfgm-886h-6r47": {
   "first": "2026-10-26",
   "last_mailed": "2026-10-26",
   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
   "summary": "Custom API token with no global caps inherits owner admin access"
  },
  "gtstef/filebrowser|GHSA-mgqf-5mf5-prfj": {
   "first": "2026-10-26",
   "last_mailed": "2026-10-26",
   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
   "summary": "Symlink following escapes user scope allowing arbitrary file read outside the served directory"
  },
  "gtstef/filebrowser|GHSA-p7x3-p5jj-9xfh": {
   "first": "2026-10-26",
   "last_mailed": "2026-10-26",
   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
   "summary": "Incomplete remediation of GHSA-55mw-cwg7-m8f5: public media routes bypass share restrictions"
  },
  "gtstef/filebrowser|GHSA-p93p-v944-4p44": {
   "first": "2026-10-26",
   "last_mailed": "2026-10-26",
   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
   "summary": "Unarchive writes into folders denied by access rules and overwrites files without modify permission"
  },
  "gtstef/filebrowser|GHSA-p9wm-f5jj-75pj": {
   "first": "2026-10-26",
   "last_mailed": "2026-10-26",
   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
   "summary": "FileBrowser Quantum SSE EventRouter Concurrent Map Iteration/Write DoS"
  },
  "gtstef/filebrowser|GHSA-qqf3-2wvq-q4w9": {
   "first": "2026-10-26",
   "last_mailed": "2026-10-26",
   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
   "summary": "Archive download follows symlinks out of source scope (arbitrary file read)"
  },
  "gtstef/filebrowser|GHSA-qv53-4557-m65h": {
   "first": "2026-10-26",
   "last_mailed": "2026-10-26",
   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
   "summary": "Improper authorization in public upload endpoint allows anonymous bypass of er-folder DENY ACLs via Scope-Stripped path key"
  },
  "gtstef/filebrowser|GHSA-qx86-4v5r-26g5": {
   "first": "2026-10-26",
   "last_mailed": "2026-10-26",
   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
   "summary": "MFA bypass and account takeover via unauthenticated TOTP re-enrollment in FileBrowser Quantum (`/api/auth/otp/generate` + `/api/auth/otp/verify`)"
  },
  "gtstef/filebrowser|GHSA-r744-4vm3-2px3": {
   "first": "2026-10-26",
   "last_mailed": "2026-10-26",
   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
   "summary": "Passkey MFA factor can be wiped, overwritten or attacker-enrolled with only a session cookie, bypassing the password re-authentication enforced for TOTP and pas"
  },
  "gtstef/filebrowser|GHSA-rmjp-pfrq-cc3v": {
   "first": "2026-10-26",
   "last_mailed": "2026-10-26",
   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
   "summary": "Stored XSS in the File Size Analyzer tooltip (unescaped v-html) with a nonce-CSP bypass via an allowlisted CDN"
  },
  "gtstef/filebrowser|GHSA-rqqq-wv83-rp74": {
   "first": "2026-10-26",
   "last_mailed": "2026-10-26",
   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
   "summary": "Absolute Path Traversal Bypass in SanitizeUserPath allows authenticated arbitrary file read outside user scope"
  },
  "gtstef/filebrowser|GHSA-vvm6-jwrf-hgmg": {
   "first": "2026-10-26",
   "last_mailed": "2026-10-26",
   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
   "summary": " Stored XSS via HTML Preview — `<script>` Whitelist + `allow-same-origin` Sandbox Escape"
  },
  "gtstef/filebrowser|GHSA-wfjp-qhvc-69wp": {
   "first": "2026-10-26",
   "last_mailed": "2026-10-26",
   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
   "summary": "Share path re-point allows scope escape (arbitrary read/write across the source root)"
  },
  "gtstef/filebrowser|GHSA-wjp8-g49g-xrhx": {
   "first": "2026-10-26",
   "last_mailed": "2026-10-26",
   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
   "summary": "Failed-login lockout bypass: client-controlled leftmost X-Forwarded-For is trusted, and the documented nginx config forwards it"
  },
  "gtstef/filebrowser|GHSA-wxj5-g3qp-g732": {
   "first": "2026-10-26",
   "last_mailed": "2026-10-26",
   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
   "summary": "Cross-source view-grant confusion: a public share's view token lets an authenticated user with view=false/download=false read files in their own source scope (/"
  },
  "gtstef/filebrowser|GHSA-x79q-5hqm-x839": {
   "first": "2026-10-26",
   "last_mailed": "2026-10-26",
   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
   "summary": "Share authorization gaps let read-only users delete files"
  },
  "louislam/uptime-kuma|CVE-2026-111497": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "louislam/uptime-kuma 2.5.6 (uptimekuma-system/uptimekuma.yaml)",
   "summary": "Node.js 22.22.3 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process"
  },
  "louislam/uptime-kuma|GHSA-qjxc-h5jf-c7rj": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "louislam/uptime-kuma 2.5.6 (uptimekuma-system/uptimekuma.yaml)",
   "summary": "GCP and selected cloud providers provide metadata endpoints to the local network which can be queried to extract sensitive information via authentificated accou"
  },
  "louislam/uptime-kuma|release:louislam/uptime-kuma@2.5.7": {
   "first": "2026-10-26",
   "last_mailed": "2026-10-26",
   "program": "louislam/uptime-kuma 2.5.5 (uptime-kuma)",
   "summary": "⬆️ Security Fixes"
  },
  "louislam/uptime-kuma|release:louislam/uptime-kuma@2.5.8": {
   "first": "2026-10-26",
   "last_mailed": "2026-10-26",
   "program": "louislam/uptime-kuma 2.5.5 (uptime-kuma)",
   "summary": "⬆️ Security Fixes"
  },
  "n8nio/n8n|GHSA-365g-vjw2-grx8": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "n8nio/n8n 2.42.1 (n8n)",
   "silent": "first read after the seed",
   "summary": "Execute Command Node in n8n Allows Authenticated Users to Run Arbitrary Commands on Host"
  },
  "outlinewiki/outline|CVE-2026-111497": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "outlinewiki/outline 1.11.0 (outline-system/outline.yaml)",
   "summary": "Node.js 26.3.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process"
  },
  "outlinewiki/outline|GHSA-cprf-crfh-w3p4": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "outlinewiki/outline 1.10.1 (outline)",
   "silent": "first read after the seed",
   "summary": "Email sign-in token has no server-side redemption check (confirmed in code; asymmetric with the sibling code+email flow; live replay not executed)"
  },
  "outlinewiki/outline|GHSA-h6ff-rw9x-5mq2": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "outlinewiki/outline 1.10.1 (outline)",
   "silent": "first read after the seed",
   "summary": "Authenticated members can publish documents into private collections through a retained parent link"
  },
  "outlinewiki/outline|GHSA-rq53-m97j-f2pg": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "outlinewiki/outline 1.10.1 (outline)",
   "silent": "first read after the seed",
   "summary": "Unpublished documents remain publicly accessible and their shares cannot be revoked"
  },
  "outlinewiki/outline|GHSA-rvj7-2gww-6xfq": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "outlinewiki/outline 1.10.1 (outline)",
   "silent": "first read after the seed",
   "summary": "Outline: shares.info parent-share discovery leaks private-collection name/path (and ancestor document titles/URLs + sharer identity) to a non-member"
  },
  "outlinewiki/outline|GHSA-x4w3-9p9j-cprh": {
   "first": "2026-10-27",
   "last_mailed": "2026-10-27",
   "program": "outlinewiki/outline 1.10.1 (outline)",
   "silent": "first read after the seed",
   "summary": "users.update_role reveals whether a user id from another team exists and which role it has"
  },
  "outlinewiki/outline|release:outline/outline@v1.12.0": {
   "first": "2026-10-26",
   "last_mailed": "2026-10-26",
   "program": "outlinewiki/outline 1.10.1 (outline)",
   "summary": "1 which fixes multiple recently disclosed  vulnerabilities"
  },
  "redis|GHSA-4c68-q8q8-3g4f": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "redis 8.10.2 (plantit-system/plantit.yaml)",
   "summary": "Out of bound read due to a bug in LUA"
  },
  "redis|GHSA-4q32-c38c-pwgq": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "redis 8.10.2 (plantit-system/plantit.yaml)",
   "summary": "Redis DoS Vulnerability due to bad connection error handling"
  },
  "redis|GHSA-5453-q98w-cmvm": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "redis 8.10.2 (plantit-system/plantit.yaml)",
   "summary": "redis-check-aof may lead to stack overflow and potential RCE"
  },
  "redis|GHSA-8ghh-qpmp-7826": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "redis 8.10.2 (plantit-system/plantit.yaml)",
   "summary": "Lua Use-After-Free may lead to remote code execution"
  },
  "redis|GHSA-93m2-935m-8rj3": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "redis 8.10.2 (plantit-system/plantit.yaml)",
   "summary": "Use-After-Free in unblock client flow may lead to remote code execution"
  },
  "redis|GHSA-c8h9-259x-jff4": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "redis 8.10.2 (plantit-system/plantit.yaml)",
   "summary": "Invalid Memory Access in Redis RESTORE Command May Lead to Remote Code Execution"
  },
  "redis|GHSA-m8fj-85cg-7vhp": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "redis 8.10.2 (plantit-system/plantit.yaml)",
   "summary": "Lua library commands may lead to integer overflow and potential RCE"
  },
  "redis|GHSA-prpq-rh5h-46g9": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "redis 8.10.2 (plantit-system/plantit.yaml)",
   "summary": "Denial-of-service due to malformed ACL selectors"
  },
  "redis|GHSA-qrv7-wcrx-q5jp": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "redis 8.10.2 (plantit-system/plantit.yaml)",
   "summary": "Running Lua function as a different user"
  },
  "redis|GHSA-r67f-p999-2gff": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "redis 8.10.2 (plantit-system/plantit.yaml)",
   "summary": "Redis DoS Vulnerability due to unlimited growth of output buffers abused by unauthenticated client"
  },
  "redis|GHSA-rp2m-q4j6-gr43": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "redis 8.10.2 (plantit-system/plantit.yaml)",
   "summary": "Out of bounds write in hyperloglog commands leads to RCE"
  },
  "redis|release:redis/redis@8.10.3": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "redis 8.10.2 (plantit-system/plantit.yaml)",
   "summary": "Update urgency: SECURITY: There is a security fix in the release"
  },
  "rommapp/romm|CVE-2026-111497": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "rommapp/romm 5.4.0 (arcade-system/romm.yaml)",
   "summary": "Node.js 24.18.1 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process"
  },
  "rommapp/romm|release:rommapp/romm@5.4.1": {
   "first": "2026-10-26",
   "last_mailed": "2026-10-26",
   "program": "rommapp/romm 5.3.1 (romm)",
   "summary": "While we don't believe RomM instances are vulnerable, we recommend upgrading as soon as possible"
  },
  "vabene1111/recipes|CVE-2026-111497": {
   "first": "2026-10-28",
   "last_mailed": "2026-10-28",
   "program": "vabene1111/recipes 2.6.15 (tandoor-system/tandoor.yaml)",
   "summary": "Node.js 24.18.1 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process"
  }
 },
 "failures": {
  "registry:docker.io": {
   "mailed": true,
   "streak": 2
  },
  "runtime": {
   "mailed": false,
   "streak": 1
  }
 },
 "runtime_cache": {
  "sha256:01bdf0ad6d53198da4331540c1e73ab65db7a72e961fff97ecb0847d46055c5f": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:066877418cd11b59edbf56ee31848ee96381b9860eccea94d6233ebf7ece15cf",
   "dpkg": {
    "libbrotli1": "1.1.0-2build2"
   },
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:0250d9cb0d745a8d768f31d3cdc68ac14bfa8b43dedfe0f550158e3861c12db7": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:00724fc1f511635e3675538a326915474d486fcc9409a8b0f574da543e5980a1",
   "dpkg": {
    "libbrotli1": "1.1.0-2+b7",
    "python3": "3.13.5-1",
    "python3.13": "3.13.5-2+deb13u4"
   },
   "env": {
    "PYTHON_VERSION": "3.13.15"
   },
   "node": null,
   "python": "3.13.15",
   "unchecked": []
  },
  "sha256:03295f95a6290e752641f9553ac4198b0e5b71b879d57f7b2371b98f608feb54": {
   "apk": {
    "brotli-libs": "1.2.0-r1",
    "nodejs": "24.18.1-r0"
   },
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:d5cd2424802f2649dbd6526c07a8de335b9687a4c032b46256c96c82217067f6",
   "dpkg": {},
   "env": {},
   "node": "24.18.1",
   "python": null,
   "unchecked": []
  },
  "sha256:039239902a01e58a5a0f52e29039fafa18ffc2a481bb8acd807599f1c6dde7ef": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:07a683755cc5eef919d807e53d9e0eaf136607e3f7ed47333e1f629d37834b84",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:084b3b2ab1d0ef930660727259546a241f2bdf67c9ed085d54bf1486a6887c9b": {
   "apk": {
    "brotli-libs": "1.2.1-r0"
   },
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:41fdc1672209c2ef31c5260015ec8b96e3c75513e60a667eb052e1ff54b4cfa9",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:08ee9ffdb847e1bd35ded30ee832090dd06a7f93f67422687db59e70bc7f5393": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:898e4e94aeeb1e95a5d2a637dbcb51393cfd1e041d65381ab182cf2aade585fe",
   "dpkg": {},
   "env": {
    "NODE_VERSION": "26.3.0"
   },
   "node": "26.3.0",
   "python": null,
   "unchecked": []
  },
  "sha256:0985e772fb9f729e6fa0980da05fca5d9c468e870eed43071545afa9d2e27d94": {
   "apk": {
    "brotli-libs": "1.2.0-r1"
   },
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:8f84ed99befc3891b8f329c5c202785278a2cfb7c25107d57fb2a134a3117433",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:09b5aacb0b23e5bff5e09dc87211f64b5beb82010107a1f63f121e343f4c6bf3": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:9855801a896b636f697a49c86f14192ac9fd4fe883a0da90d3f8f86761aab756",
   "dpkg": {
    "libbrotli1": "1.0.9-2+b6",
    "python3": "3.11.2-1+b1",
    "python3.11": "3.11.2-6+deb12u9"
   },
   "env": {
    "PYTHON_VERSION": "3.15.2"
   },
   "node": null,
   "python": "3.15.2",
   "unchecked": []
  },
  "sha256:0cefaabd882e42bcb2a2f3dc56d3ce4770560ba62fd7f197f1a2e008fd5731ab": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:cbf42f0edc946c0bc1b8eeed62403734e1f25dc67a3491455d07a92fdb558b28",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:0e5688ba0988b9112cf03f9c6bab53eccb466d278435f6596f16c1f25acacf74": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:1d154af14e2e590de1b3df3459e4e883e3fda7882ec49ad0e98978da868ddf9a",
   "dpkg": {
    "libbrotli1": "1.1.0-2+b7",
    "python3": "3.13.5-1",
    "python3.13": "3.13.5-2+deb13u5"
   },
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:10a5c69a83035ab5239f5620d708520e8b28f5aa1f2b20143e6024532edadfb5": {
   "apk": {
    "brotli-libs": "1.2.0-r1"
   },
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:3b0ef735388b2cb097fc29b8bb421d86d57d0ddbe7aa1fbd6493e06d65028503",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:13290e2f04bfd98cf8fc7e8d216fb76b2b2d12373d4923b859cd41c2d984fde8": {
   "apk": {
    "brotli-libs": "1.2.0-r1"
   },
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:40e9b3aa6bc2fb28cfdeeeefe4f1b838d42fd78d750d3c90d1715f3461fd0faf",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:1336e85aaed293bd63d005086e0dd013b04078b26aaeb1c18b26a2f928af7e65": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:abb2b9c1b132b5b0be40d09c85bf8d3dab2a59fa0eb3aa955ab8be5efbb73de6",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:186694f07bb1d6449efbebbd3efb1ec09b476732e77eb80618afb96fa35c5da4": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:39289781f568f61a710f9ebbf734750d3f7eab7635d7cc962d893fb983d39cdb",
   "dpkg": {
    "libbrotli1": "1.1.0-2+b7",
    "python3": "3.13.5-1",
    "python3.13": "3.13.5-2+deb13u5"
   },
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:19764751d501495b021530c9426f25d8f9f8748dc38ab3ba48eb62d7df2cd92e": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:abdbd75d465f3bf9d55063c8b3caa43b75e4f4c141f7afc03c4be9e23ab2fe4a",
   "dpkg": {
    "libbrotli1": "1.2.0-3build1"
   },
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:19ea2b669945d842dadc3d500f2d6a795866a003330f59a47b9634658bae98bb": {
   "apk": {
    "brotli-libs": "1.2.0-r1"
   },
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:7d90670a4e2531e752f014e58f7283b9d197847b6f073bf84e99598f49d80ffd",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:1a078b237c1d9b420b0ee59147386b4aa60d3a07a8e6a402fc84a57e41b043a4": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:886090efddca88b0498f775acea8a11b9d4cbb4a101626759c7ce53768e06d10",
   "dpkg": {
    "python3": "3.11.2-1+b1"
   },
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:1b4e4438faca4dd7e001dd445d161a4a2091b0fededa84093b3a8dfeae1f1be0": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:da83fae85603c4e47e6c68369a7d746e2dda683dc35ea2e234b4f171e0d92798",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:1b5875fe3193d450a62e7b438eb6701195c841f14f3dcb962e545eda42d3696f": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:6681d91b75ecfedfb9df4b2e251345a89f79a511aa14dade1193320e38c892e1",
   "dpkg": {
    "libbrotli1": "1.1.0-2+b7"
   },
   "env": {
    "PYTHON_VERSION": "3.13.15"
   },
   "node": null,
   "python": "3.13.15",
   "unchecked": []
  },
  "sha256:1c5789b93bfe5eed0b7287255782d9177027b255de2b22b59f511a693a48db04": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:112a5a87010d39124c8c31499745184c283f0e5bc56b672d2eda84c7131e8300",
   "dpkg": {
    "python3": "3.12.3-0ubuntu2.1",
    "python3.12": "3.12.3-1ubuntu0.16"
   },
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:1e7c2345c493f9228a5dc2102be06b5a33331100f303fe0078502f4ef1068724": {
   "apk": {
    "brotli-libs": "1.2.0-r1"
   },
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:20a187e25a0872c2b7147c729e949c1611bdd32273109e92bb14ad08211d1b36",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:1f7ecf094d54363014636c3540dbe9c368394504abaa283914e4fcf8d699f331": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:7cdfce0cbaec91b166bf61f7fafa1199f7b71c8e2c42a3ac1a44279c56ad0d10",
   "dpkg": {},
   "env": {
    "NODE_VERSION": "22.23.3"
   },
   "node": "22.23.3",
   "python": null,
   "unchecked": []
  },
  "sha256:1feaaf724694d08a1fb19370b6ff37e6669edb16cae69e02660177253f903dc1": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:6a2db9c82657be91326fd8eec3ac5d8ca9a7758ee778b5034520ec8e13df393e",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:203a0854738be101bfdada825ac3cbf95e5681bc849757b6bc199e4cfae98faa": {
   "apk": {
    "brotli-libs": "1.1.0-r2"
   },
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:e0ffa3534f2a8e1691c687f3c087f2801b5e14b9ca57f0884280d4836bcdb0df",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:23ddf8660087d6b9f5dbdca2ca09817b84db45cb2d9d6e2e0176e70f514629e7": {
   "apk": {
    "brotli-libs": "1.1.0-r2"
   },
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:8828499b52c4bebfc266c287f5c1be5cdefe907dc035ac1d01c530e972020814",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:24645e971da6bb1a1f953d6859e307a0b29be1e8b4130a35b3220c209b5b860c": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:bdfbb624d5fe9df05481d8eb6791a00a4a78ab8152bce31e79c6f18917e6933e",
   "dpkg": {},
   "env": {
    "NODE_VERSION": "24.21.0"
   },
   "node": "24.21.0",
   "python": null,
   "unchecked": []
  },
  "sha256:25d6a2ced2f1f0cf03c09abd776d87ba31941ed96d3a99992aa84b3bd0afc074": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:5d506854fed4940177e37cec1a28e9189dd26f404faafaa978a746038b6c2dfb",
   "dpkg": {},
   "env": {
    "NODE_VERSION": "26.12.1"
   },
   "node": "26.12.1",
   "python": null,
   "unchecked": []
  },
  "sha256:25e8a0eb39f45c9ac5e8e7615fd84a0380018ea012317bc665b86458d900b4b9": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:eed3001be168d4c20e6a4b0087cca33bae98c5107b93a641d94980de09b6f8ee",
   "dpkg": {
    "python3": "3.13.5-1",
    "python3.13": "3.13.5-2+deb13u5"
   },
   "env": {
    "NODE_VERSION": "26.9.0"
   },
   "node": "26.9.0",
   "python": null,
   "unchecked": []
  },
  "sha256:266d3c257594e195b309ae9d1805e54c788f1d7b375f56bf6c367aac6c917e7b": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:e4cb93687b062cd25a0e8f672d85a7708235009d70d31f8a7698d9370092a9c4",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:d56c381f961d307a21b3ca004cf1e3910f106644aefb1f43e654c8a56c4fd395",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:2e759dd1478a2ed119ee474e28522079fb1cfa50b3fd25cba89f6b9a67abad72": {
   "apk": {
    "brotli-libs": "1.2.0-r0",
    "nodejs": "24.18.1-r0"
   },
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:187871639d9ca05cfb17c248d432518cd51d1bc57afbdada744f7e2857c3127c",
   "dpkg": {},
   "env": {
    "PYTHON_VERSION": "3.13.15"
   },
   "node": "24.18.1",
   "python": "3.13.15",
   "unchecked": []
  },
  "sha256:2fdeeb1a2028ce7cb1274696237e32b9f849e16b6d77314d08c78356a6016fca": {
   "apk": {
    "brotli-libs": "1.2.0-r1"
   },
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:9ecfcc16092957520389b4955d6eb5a2ef2b59bc054e5ef39e4d5de3cc731956",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:3084f1e5ecdc10afafc193911039a06cdabda4473f3a48d62edbe460e3c154ee": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:ece46f9548c8b7ba80aa135d36f0636d1fbe26fe83d55583684c0967e64a1695",
   "dpkg": {
    "libbrotli1": "1.0.9-2+b6"
   },
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:32ab73d80f2b8b5fb0735b0431deb36b93fbb6b2fb43592449b0178c8b83e350": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:abd3a252d538f24afa0759d677d531dedccd4e4239c524202255cf72de80a2be",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:3400b0a4714d62161727a710c82a3e319cfea364ac6e591aed653f5bb6bb8055": {
   "apk": {
    "brotli-libs": "1.2.0-r1"
   },
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:997a7318c8affaaf7013f82716b36b17c17af69deea1452d4c9d3b8cc068ce44",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:35d599d80e8a06c0a4b218d6fa7c23d6d3e5818ee7db17edb6820c6deb9611b2": {
   "apk": {
    "brotli-libs": "1.1.0-r2"
   },
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:c58aa3d711a2f2537962a1edb0a4ad46f8212490e2b20de7307b7314f49bb840",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:36a92e9344ef965e9318c8d2f70dd35cad654a4615b889c6a4dd483ca1ddec7c": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:36a92e9344ef965e9318c8d2f70dd35cad654a4615b889c6a4dd483ca1ddec7c",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:377b66bec5645510ed52549bb00e648c273edc604d230a3f90fd2b2433afcb97": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:bc1a44f83c207dd9607cad8f5a13843918131361e899b4ebae9b786f5adbb76f",
   "dpkg": {
    "libbrotli1": "1.1.0-2+deb13u1"
   },
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:38dc2727bfcfd5ede290f8ada114fc90368146f265ae4701ddddbcbe2a44ee52": {
   "apk": {
    "brotli-libs": "1.1.0-r2"
   },
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:59ce76e6e06193fbfbb1736a93b8468227e1ea663fc7b25b1da13fbb97f5197b",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:3ac1c9ea03bafa2588dd8acdcb809857bae305e71d2d90e11d689c78076a9c01": {
   "apk": {
    "brotli-libs": "1.2.0-r1",
    "python3": "3.14.8-r0"
   },
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:93e23ba7dd20c4a00da1bdeb9adf9d622890a11caed4f5468892f48eef7b0c0c",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:40c454d74ffdd9ecb15833e4d96f3a630d59aad862a1869381ae6ee086454419": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:a54abf44e6927355f58e4995461d7daf97250d4d390acff48dea16bb04579d56",
   "dpkg": {
    "libbrotli1": "1.1.0-2+deb13u1"
   },
   "env": {
    "NODE_VERSION": "26.12.1"
   },
   "node": "26.12.1",
   "python": null,
   "unchecked": []
  },
  "sha256:43cd93b9e1f02d760923f67f6e74e1c4d4a9cccb9b08fa42ad60770333f231eb": {
   "apk": {
    "brotli-libs": "1.1.0-r1"
   },
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:065e1a518711d716619e0b15a5e1895457f62e055548d463e05ccc711fe643fe",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:4524d0b00478e41264f42e0e660c1819e3b7d0c460f78ce73e44fa39b2b55134": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:45c2e5c840248cc431260bac20219ad5b3b6124fcd8dab346cf85e3cb6b8963c",
   "dpkg": {
    "libbrotli1": "1.1.0-2build2"
   },
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:4538137bc5af902dece165f2bf73776d9cf4eafb6dd714670724af8f3eb77764": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:499fbe958fa4a0c93172a231c14898986556bb28bd5cd569a0f41dbf887b04d7",
   "dpkg": {},
   "env": {
    "NODE_VERSION": "22.18.0"
   },
   "node": "22.18.0",
   "python": null,
   "unchecked": []
  },
  "sha256:46d90e46bd87312fcbbbb05036d99e4cb1c821e928b0516ee727de4c3c90752b": {
   "apk": {
    "brotli-libs": "1.1.0-r2"
   },
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:93e2efccb4d0111c045d9f46c27343df0114faa050e210d2f95b50671eb98529",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:47b08295737773de3b711fb86f13ae802f5074e96a9a2d29f5f80164ac08c046": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:be7c1cada5a6eb1656adfa2635b99296af725881301b21f84f35a71fac072c7f",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:47e961a569fd52ff31f0fe205ed91eeab17d9f5fff6722e6d7ea6b588748b293": {
   "apk": {
    "brotli-libs": "1.2.0-r1"
   },
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:682bb307fed2165594aa60883dc142c757fa70894b1802c0ef0814e02a8c1844",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:48e36b608b461273b9dae857725cd0561a127f2c694b687318f6d0c5ce63e5c9": {
   "apk": {
    "brotli-libs": "1.2.0-r1"
   },
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:a674ae620ca7ce1246b377bcac13a7500567196cf2207059e68146fa4dc169f7",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:4b3d9475d65571d28cbb19544d3820ec2945e4c8b2f18279394282b8dc3a592e": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:2d6a23c682c574ae49320fdf2419441b6f10658588d44b6d8739d673b96903e5",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:4b95dbe7ac5343b768f8e04e3035ccd59997872b1a35ab9b0f082d2cc279070e": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:2e1a606449aab9b7577620ec87554c71e924d8f3dedd50e69b938c63c8d5d1b9",
   "dpkg": {
    "libbrotli1": "1.0.9-2+b6",
    "python3": "3.11.2-1+b1",
    "python3.11": "3.11.2-6+deb12u9"
   },
   "env": {
    "NODE_VERSION": "22.23.4"
   },
   "node": "22.23.4",
   "python": null,
   "unchecked": []
  },
  "sha256:4d7cd163d60c81c257badef488707601fa02c56368894bde4af69839fc761d69": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:5c1a104885622f3566161a6262b6909f00d39783d22499daf8cc1c727c019b51",
   "dpkg": {
    "libbrotli1": "1.0.9-2build6",
    "python3": "3.10.6-1~22.04.1",
    "python3.10": "3.10.12-1~22.04.10"
   },
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:4f733dc50b0c77517db402541f88c5489d4c9eedb32ac6c5eef7cadd8a594196": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:a39e5d7f885dac95005e39345e629d5047696ca0f1320cb332cf6f403d6fb795",
   "dpkg": {
    "libbrotli1": "1.1.0-2build2",
    "python3": "3.12.3-0ubuntu2.1",
    "python3.12": "3.12.3-1ubuntu0.13"
   },
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:51ee22428b4192f4372b54f84c8b90cd710311ad99993c5045f53b51717dd3f7": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:db459d08b5f3b900e9a646920e58c1087497a9f070f9142ed8f0fca8e81b1350",
   "dpkg": {},
   "env": {},
   "node": "26.3.0",
   "python": null,
   "unchecked": []
  },
  "sha256:54d9406cd30f9e206a9dd6d61dfac48da26b9afc37200e14f23beb8fafa7d11c": {
   "apk": {
    "brotli-libs": "1.2.0-r1"
   },
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:f5b936519c0041c17ea79eb85444e86d7fc55bdcc271b74d722f62537323eb84",
   "dpkg": {},
   "env": {
    "PYTHON_VERSION": "3.14.7"
   },
   "node": null,
   "python": "3.14.7",
   "unchecked": []
  },
  "sha256:54e0dd8e8cddcdbb9156c2486eed5a43eccb7214d7c6828097d41ce049fb3984": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:1d4031d6ed0a9b774b365f99a3c16127217eb19f699d8d43fc43b732748601ef",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:552beab3dec8c93d46b8b9245612d63c3f123b8a45063a474f53e229b17621d3": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:59cab86c77e764855119e2d5ddd96b9c9cefd90913f4feed7f4ee1433a6482c5",
   "dpkg": {},
   "env": {
    "NODE_VERSION": "24.20.0"
   },
   "node": "24.20.0",
   "python": null,
   "unchecked": []
  },
  "sha256:568b1be1c42f456df066a8bb55be8ce0046b2c6fc96b1650db5d2162eb4f1ce9": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:cff6177bc30fcc2e96deb2c5dd4e626720e9bd20dea9d8d5f79e521c8ce1709c",
   "dpkg": {},
   "env": {},
   "node": "26.12.1",
   "python": null,
   "unchecked": []
  },
  "sha256:581d68b2a6fc7ebf58d81c878a9f387cbbc0d88ac9d37b298b9cee10168af85b": {
   "apk": {
    "brotli-libs": "1.2.0-r1"
   },
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:10f3490855630aa024ba618b90ba6f58f3d9d7063dd77e1d1e958fdc4ede7c70",
   "dpkg": {},
   "env": {
    "NODE_VERSION": "24.21.0"
   },
   "node": "24.21.0",
   "python": null,
   "unchecked": []
  },
  "sha256:589e3606b11b61c3fa2d9661832cb73645a9b93a9cc7d807a071e2bc6c584498": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:b29c63de16524ac92971b465a0487cd396bd7c7498d1a2c01440ac42aac818e6",
   "dpkg": {
    "libbrotli1": "1.1.0-2+b7",
    "nodejs": "20.19.2+dfsg-1+deb13u3",
    "python3": "3.13.5-1",
    "python3.13": "3.13.5-2+deb13u5"
   },
   "env": {},
   "node": "20.19.2",
   "python": null,
   "unchecked": []
  },
  "sha256:591974a7cb92be1d30a9033da0b97ef628d0ee1328e3ec29683b0075619805ba": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:27e97da27f1581e8e134009230d6bc2ec62757fda13d23095ebcb349f935a702",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:599b99bbae1a297fa8169734cf9267dc97c330f5c9abd21ebdaab32869c9a42c": {
   "apk": {},
   "brotli": "1.2.0",
   "brotlicffi": null,
   "digest": "sha256:d9927bdad52483f16eb172ad7809425898cb8a0970a42e4f996127012d4ef68b",
   "dpkg": {
    "libbrotli1": "1.1.0-2build2",
    "python3": "3.12.3-0ubuntu2.1",
    "python3.13": "3.13.15-1+noble1"
   },
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:5b19bbb160e9ff60681a3abd97e1c4ec9f64212301410de658c3900ab7ef31e7": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:7dd0edb7a82dd71a574a968e0361bf6e0ae850c4b291e14539e0f0000d810e36",
   "dpkg": {
    "libbrotli1": "1.1.0-2+b7"
   },
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:5e00373854247750cc3e4479b492ae09293ff5e06ed10177f226634d97888679": {
   "apk": {},
   "brotli": "1.2.0",
   "brotlicffi": null,
   "digest": "sha256:1297be5207318acea7030884a2d283ef3e805c745eaeaa4c5602bc3dc9b7f47a",
   "dpkg": {
    "libbrotli1": "1.1.0-2build2",
    "python3": "3.12.3-0ubuntu2.1",
    "python3.13": "3.13.15-1+noble1"
   },
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:61d2b391e3e324d05edc6c65c555989a7c544ddb72ef271b3abd4a35b57942b1": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:c266a6e065eb1aed529058245446139e6a13cedd12b892f7867cd402b0760ecc",
   "dpkg": {
    "python3": "3.9.2-3",
    "python3.9": "3.9.2-1+deb11u2"
   },
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:6282144f9a14d4a4dca2bc96801a2e43a2ff51116f001b13e5488eacad7b80e2": {
   "apk": {
    "brotli-libs": "1.2.0-r1"
   },
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:cb02c63fdc2dd9536ca9614d74f0a130b318c5813f76963570db1f782968c574",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:68455d4953bad8e984e1bc5d112ed1e9c918a0a04f104c13c9ece50790308894": {
   "apk": {
    "brotli-libs": "1.2.0-r1"
   },
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:41a515f2282aca486e1d41941362d4f3c49fb3460a51ec77e145410af9893de5",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:6aa7d9832324ea403be144a26398a82afbf04abbb4da89f9d04ba61838516b3f": {
   "apk": {
    "brotli-libs": "1.2.0-r1"
   },
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:d16c593650c975b9c6c044363fd7bfe95b6cee311fb8af2bc49079a42072e333",
   "dpkg": {},
   "env": {
    "NODE_VERSION": "24.18.0"
   },
   "node": "24.18.0",
   "python": null,
   "unchecked": []
  },
  "sha256:6ba19c50b56777f5c11c58eff8ddb69d0d5f27ba131cffb63f180ccfd43c66af": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:1cf73a2f04808e55a8bd2f5706c2aa0ebb0f71938f93deb7af79f48311cd5cb9",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:6c86cad803970ea782683a8e80e7403444c5bf3cf70de63b4d3c8e87500db92f": {
   "apk": {},
   "brotli": "1.1.0",
   "brotlicffi": null,
   "digest": "sha256:835974fc3368fc6714aa38542db7a1f0f542d03244e39b981e519aefc100f355",
   "dpkg": {
    "libbrotli1": "1.1.0-2+b7"
   },
   "env": {
    "PYTHON_VERSION": "3.12.12"
   },
   "node": null,
   "python": "3.12.12",
   "unchecked": []
  },
  "sha256:6f8f1fc29d1ff67b4d8d503bb4e0a69b55c8d42600decafde951344218193a27": {
   "apk": {
    "brotli-libs": "1.1.0-r2"
   },
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:df2df6d13efea6d86c86091a549d8adcf6301a7fb9558d2870f69d3a485d479d",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:712dc5385d1c1a3f83b747fa9e40f64d433a97f72ff42f9755ff7dd1f62846e4": {
   "apk": {
    "brotli-libs": "1.2.0-r1",
    "python3": "3.14.7-r0"
   },
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:a466f1230db238e7e534c633619b4c4c2fa5fded43c74bd7600e17545929ae98",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:75ecbb1c89ab7b0a21c4bde40b4820e4f1649d2d56d83b91913422155e8d2a5f": {
   "apk": {
    "brotli-libs": "1.2.1-r0",
    "python3": "3.14.8-r0"
   },
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:236a7a3a81a3706182ae1f12ee55aa3781c753963e680b2d9c8e55541686d0ce",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:7837f8148cc6db5e3e9a8df199912950adaee66898ebad4949d9dbb2f30aa02b": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:bdc2aaeee2f5d2ad478bae33fdfd2e6881b55bdabcbb3f6b4f7dc297c1013d6c",
   "dpkg": {
    "libbrotli1": "1.0.9-2+deb12u1"
   },
   "env": {
    "NODE_VERSION": "24.22.1"
   },
   "node": "24.22.1",
   "python": null,
   "unchecked": []
  },
  "sha256:78eb28b8776d0bad40c5e605c72b3f4f5976793e491558c7dcbdfc04c835d4bc": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:243e33ea66e71b2094cb1f9c9167af24452405a33fc899a1dc7359dc210506f8",
   "dpkg": {
    "libbrotli1": "1.1.0-2+b7"
   },
   "env": {
    "PYTHON_VERSION": "3.14.8"
   },
   "node": null,
   "python": "3.14.8",
   "unchecked": []
  },
  "sha256:7a6779d345d4d678614aa1a0a8a4d8456aeb98de10dfae700b839c3140c89f39": {
   "apk": {
    "brotli-libs": "1.2.0-r1"
   },
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:b0808c771d92d24980188352acdbd9215edcbbf522b947bbd8b2763ae63c7ae7",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:7b6e87514259549647e15ceeaf73d238792e6d77e2c79fc744d5badc8d6e997c": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:224de96048a5bb7319aff1068f509a904849edb3fe8caabe24a90da65e52d366",
   "dpkg": {
    "libbrotli1": "1.1.0-2build2",
    "python3": "3.12.3-0ubuntu2.1",
    "python3.12": "3.12.3-1ubuntu0.17"
   },
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:7d13848af12645600a5f9d93ee2560daa9c6fa6b5b859b7bff3a5e1c0b661031": {
   "apk": {
    "brotli-libs": "1.2.0-r0"
   },
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:0b35a8706dd0171866ca4b787b53b272a519fff5ba7520ef4bddbe58121411f9",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:823dc5036b911696c27faacf7664219b28e6e15826405720df29aad208d19f25": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:1af003c7f40d6c692a4ee5bd5e02f01e42b7f6ea07924f3c9d7505898e6a5c9b",
   "dpkg": {
    "libbrotli1": "1.1.0-2build2",
    "python3": "3.12.3-0ubuntu2.1",
    "python3.12": "3.12.3-1ubuntu0.17"
   },
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:860fa4baed04ae1c235de870edab0c8006227546dea1bbb6411fbfc5e27cf1db": {
   "apk": {
    "brotli-libs": "1.1.0-r2"
   },
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:d84b081420b2e5899f5acc3745e1d6510950430fef3ee6b9df5e53b0bf3e19c9",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:87a67ee09d3ae0d1df5fda5dcda3e2a1f9236a45b0a59025d6e00e46adc43bef": {
   "apk": {
    "brotli-libs": "1.2.0-r1"
   },
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:d584940b7143982682ac4541509dd628506c2b568221e6af41e5a2ead1de4fe7",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:894f570c0cf0664ed5576a8fd5d5bfb8fb1b19d592885b686c3a88c8bd90c41f": {
   "apk": {
    "brotli-libs": "1.2.0-r1"
   },
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:1e85984a7261b01b38a8e7d4166abcdb35370e6b7667a6d6fd9caa057f64eab6",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:8974eaa9ba32f713daf311e7cc8cd7e4cdfba1edea39eed75524e78ef4b08f4f": {
   "apk": {
    "brotli-libs": "1.0.9-r14"
   },
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:f39258e35244b6bf79bc6ac4e60eee176aea6f6a5adb13e8c3090e48df8ae515",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:89c1ea91e897f0fe0a3731595330bc45b8bdef4047464a07116f891a94054b31": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:1e1a22175fbf1b32157ddaf0219e1db4e5401fab2b94ed285add64d18587cd2d",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:8a0ef97527544baa2b35825940ddf4db6e2d09c30cd5aa31fd269ff604cc8b75": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:fcc6a6b011a8c0adbf4489384588442224c01f74b6f63739e50b089d54b98371",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:8ae3cdf8cdbba2ac98754e9fc4ccec67bbaa86b6e6ab1ccf9683ddcff85eee72": {
   "apk": {
    "brotli-libs": "1.2.0-r0"
   },
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:280421e740e660db04c5c907810a01cb1a53becbefbf8dda2f0e0bb7edeceaca",
   "dpkg": {},
   "env": {
    "NODE_VERSION": "24.21.0"
   },
   "node": "24.21.0",
   "python": null,
   "unchecked": []
  },
  "sha256:8c45e21f95875ccd35a6e68f7da72504df9e837d6ee703379512cb8de6a67082": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:01324c091da066333a2efb0f124a80dc2f0afcc87ffd79f948bf2436f9d0b1aa",
   "dpkg": {
    "libbrotli1": "1.1.0-2+deb13u1",
    "python3": "3.13.5-1",
    "python3.13": "3.13.5-2+deb13u5"
   },
   "env": {
    "PYTHON_VERSION": "3.13.18"
   },
   "node": null,
   "python": "3.13.18",
   "unchecked": []
  },
  "sha256:8e2fe9beeefc55a02f6e1d04cad0fc3c22e8f067d309188f016551dc99ec27b3": {
   "apk": {},
   "brotli": "1.2.0",
   "brotlicffi": null,
   "digest": "sha256:8f7c95941bcc560ea4ddd9ac27142698000e1abf08ac43d709828e712f71a4ea",
   "dpkg": {
    "libbrotli1": "1.1.0-2+b7"
   },
   "env": {
    "PYTHON_VERSION": "3.14.7"
   },
   "node": null,
   "python": "3.14.7",
   "unchecked": []
  },
  "sha256:92bfd78d731e254ba64f62b77b0696add6447a33642ee5feda106a26b285aa7f": {
   "apk": {
    "brotli-libs": "1.2.0-r1",
    "python3": "3.14.7-r1"
   },
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:f5d34c27db7853bef7262666561d1b6e84fbffde0ffa7e9e24ed21337f006ef1",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:94146ac37bc61e2322f88016056c5920729cb8c64c8542ed590af8fc2abdac07": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:7ef699637304feff96028edbc7a653e135f2db2236d322b5cb2bfca11fd920bc",
   "dpkg": {
    "libbrotli1": "1.0.9-2+b2"
   },
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:942bc274709f27f99f7c6024a785d8e8f75ac06838cabcba448abb8d9127ec7b": {
   "apk": {
    "brotli-libs": "1.2.0-r1"
   },
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:7a7708314f9b1d0656e2e7f697abb64fae5f76e1895f0a9ccb9036c3933a0394",
   "dpkg": {},
   "env": {
    "NODE_VERSION": "26.12.1-r0"
   },
   "node": "26.12.1-r0",
   "python": null,
   "unchecked": []
  },
  "sha256:97ec88159e6d7cfb5ddef9015386087d58a912de80112f06ebdfa78fa5989901": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:13ad9044b4b2fd2abe4c5aad8c384b0504a71006fa33f023fc68998453a2eeca",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:9912da7d7d9b6ddc0c2d904beb84d24689c1ed9c33b81419eb9008663a92a329": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:99286a05eb86191f3f1aab9b537950aa55b958e77d9f7a2385bc9332674e6e00",
   "dpkg": {
    "libbrotli1": "1.0.9-2+b6",
    "python3": "3.11.2-1+b1",
    "python3.11": "3.11.2-6+deb12u7"
   },
   "env": {
    "NODE_VERSION": "22.22.3"
   },
   "node": "22.22.3",
   "python": null,
   "unchecked": []
  },
  "sha256:9bc6e8248891bcfa6f52fffe8b81e4ea8cae75790c3ec1b9906961a7ba55c969": {
   "apk": {},
   "brotli": "1.2.0",
   "brotlicffi": null,
   "digest": "sha256:b3f480cc5a8beb3ad45cb484b7c606f93240ae58fbfaf4f609be1cfa248267e8",
   "dpkg": {
    "libbrotli1": "1.1.0-2+b7"
   },
   "env": {
    "PYTHON_VERSION": "3.14.9"
   },
   "node": null,
   "python": "3.14.9",
   "unchecked": []
  },
  "sha256:9c8137a169ccb1f4946137736fbfffd091f6ce9c95c1f504bd7c996e9938a4be": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:baea1fb7cfd458687ded4aeb7187f0c4074107e55765ace026d1e2764d65c37c",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:9d0b64776c694f018c0ca06faf52105a33ca376024f46bb58e6ab0e2b728bb61": {
   "apk": {
    "brotli-libs": "1.2.1-r0"
   },
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:1cd73f053e07828478922e9bca4b38ed819da8beac067459bd7da085a1296469",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:9ebc7c4c2f0f9376c981f2b172f8e01c103a09b6464097432b08bee8e698d681": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:59fe90b30e8560352a9c41547ee16426aa471cba61c0cebaeae90b6f88966ae0",
   "dpkg": {
    "libbrotli1": "1.0.9-2+b6",
    "python3": "3.11.2-1+b1",
    "python3.11": "3.11.2-6+deb12u6"
   },
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:a0225d1ea6631c8bc2385dc4c2faba17bbf1834ecf369e1659a9a382bd8d5dd7": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:5cf1e1293ea42e077e6a22114e6773b9aae3bb8f9933a2acd5a9721518ff8f5b",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:a0b71c8e757298d02560186bab9fbe3fc2d375c523a62cc1019177b37e48aa28": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:c881120b024d6a8e2f3c9664efc568984e4352e47df459d6b32e225374c71955",
   "dpkg": {},
   "env": {
    "NODE_VERSION": "22.22.3"
   },
   "node": "22.22.3",
   "python": null,
   "unchecked": []
  },
  "sha256:a2501141440f10516d329fdfba2c68082e19eb9ba6016c061ac80d23beadf7f3": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:c7a8bd9cc982024a55da94c235122449ff8fa91347b6e99f902f31e0349fc623",
   "dpkg": {},
   "env": {
    "PYTHON_VERSION": "3.11.14"
   },
   "node": null,
   "python": "3.11.14",
   "unchecked": []
  },
  "sha256:a281cb44176dbe5323e0f7ea2d6fd34d58914a3a8525c36437a086d1d7c4fef8": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:7512ade4f436688782c85e07da559fc3af73e80ed568f674fda11c960a2e9d02",
   "dpkg": {},
   "env": {
    "NODE_VERSION": "26.4.0"
   },
   "node": "26.4.0",
   "python": null,
   "unchecked": []
  },
  "sha256:a3554c0d0b48177b1413c26e01f695334428020d9df01243fbae3e11cfd17417": {
   "apk": {
    "brotli-libs": "1.2.0-r1"
   },
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:2db7d28517d1fba17c2da3210395f7be11a11b419246ad0da2edf782af72f367",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:a3c0482c5d55155a3aa96c4cbb63d2aa379f02ae3bbeb76909ffed2b15980f36": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:b15ec813f2d8f0ad1e51f4964eca02e1e76fa3b4c2fb6cf21f988227a6155e21",
   "dpkg": {},
   "env": {
    "NODE_VERSION": "24.22.1"
   },
   "node": "24.22.1",
   "python": null,
   "unchecked": []
  },
  "sha256:a469ea076d4a1b4b1d86a41d130f2f536cd9da996a2b1fb39c0d7635f9d89b9a": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:1bc61f3b452ae458c0f5be7867fcc0c78476bbd48c5546b41d7d66a6df04db71",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:a76e08dbf5db4781fefd1ed81c65ad46ae8d2849dae6b6d3acebcde2fc4e59d6": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:4b2b5c9912c95899ad4720b3ada368e7b0d46f4c2fd6dc7d174922c325ef9855",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:ace3bb1219fb7306585ab9f4d94d41af7ee064c343db0498173436bbe857bd49": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:9d962292d21244382560a129fc0a5519b83fff9fd2ad77baa72947db2b3c5001",
   "dpkg": {
    "libbrotli1": "1.0.9-2+b6",
    "python3": "3.11.2-1+b1",
    "python3.11": "3.11.2-6+deb12u6"
   },
   "env": {
    "NODE_VERSION": "20.20.0"
   },
   "node": "20.20.0",
   "python": null,
   "unchecked": []
  },
  "sha256:ae9094a0ead891eef80499a072e680734bcb34892242f0e232223c65eb4c3af8": {
   "apk": {
    "brotli-libs": "1.1.0-r1"
   },
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:8491074e73af38d8ddfc227d0a8cbbf1a38c51475ff450ed9034613e6dd5a50e",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:af535d94061cf97a52e1661945ffba78c03f9443eae7c0da1a80a5a4be56b520": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:89c48c73e5285bfd707afcf02d5d8d6dcfc1d955aa7160d08145654b4bc8dfbc",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:af721ffac56fd33243043211fc49e4d5c5651f784551ae7b5b05d845c7c41147": {
   "apk": {
    "brotli-libs": "1.2.0-r1"
   },
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:f516dabf6dcac490826d826b58b80598afc054862e5ad040256f282afdb8098c",
   "dpkg": {},
   "env": {
    "NODE_VERSION": "22.23.3"
   },
   "node": "22.23.3",
   "python": null,
   "unchecked": []
  },
  "sha256:b069e4307dec06ea06d16989c6861c30a1ff208568be44ed5fb5d422cd3e950c": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:3d57623bf031f32a0597a3ebe0cd869bff6ba181c02ebc90fac492458bcfd4a4",
   "dpkg": {
    "libbrotli1": "1.0.9-2+b6"
   },
   "env": {
    "NODE_VERSION": "24.18.1"
   },
   "node": "24.18.1",
   "python": null,
   "unchecked": []
  },
  "sha256:b09d9b21381f47a79b3cbcb30da25266dc17186ea00ae65e99fdc51396f48e70": {
   "apk": {
    "brotli-libs": "1.2.0-r1",
    "python3": "3.14.5-r2"
   },
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:147f2c4cb0aa7a741151bce2bfef71d9e1a04631636e24665ee2a5ed799feb47",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:b11583ad2e93e4671128538c88cf11f460444a5d7e449311dd1933a400ab849d": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:5244f014aa3ad6b80db621ce161989d3cfc2a03c16024525e72d1b40a7a5dd2e",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:b3b00047ed20f6ce2b16780145cb6a0acb51c9e28ea6aa6f5dcd33c7034f1797": {
   "apk": {
    "brotli-libs": "1.2.0-r1"
   },
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:9ad6d7c7f1334a879b1d8aa488539c8cad5d19e7a876bb2ca2f6fd47b23fbc81",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:b578b7599d65c0279f6e1aad201bba737b9b15e6a4f308281d9e26f765e6657f": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:f23e297aff60046ab53d327d7705ec92228bf9e61f0f720d6038c651f664066c",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:b897c33f05972fb1bf484f7487bc878fa91ec8691335c1db6e2929c3a7658efa": {
   "apk": {
    "brotli-libs": "1.2.1-r0"
   },
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:37c2057e150694970442579815c646fe6bdc01c95b9d1547c4c9068be8844ef3",
   "dpkg": {},
   "env": {
    "NODE_VERSION": "24.22.1"
   },
   "node": "24.22.1",
   "python": null,
   "unchecked": []
  },
  "sha256:ba7bd45b8177fec7a31d297ecaf3c98e94aabb4fc043f167df35aeba8b93468c": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:25e49d3730a077afafcb37ee6c7cbf63d6a4d21eadfb64174a68bdacf521d1da",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:bc5a392672c1ec8823c50b61f3bd4b7e5acc34fcbb8477862577b3af1c633875": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:e976c3f0d43fe4ac2020bd7b496712108bba6ada27fb6784defe0cd187024d9f",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:bf6fe21c6e247597f7869664a440b5a34242e2d2940575cae39c17bfaa66dc0b": {
   "apk": {
    "brotli-libs": "1.2.0-r1"
   },
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:83597bf02da48a8ec4042fd4d4f58b9631f5b131d6dee7d2fcc5cf3f2eec2526",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:c124b9ad3452f46061b5054607d26ea51730dae5372c5e469920063ba2bc6dcc": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:8aa2821993207ae840ce09e4223217efcd14e01f71525db734faf4232bd59999",
   "dpkg": {
    "libbrotli1": "1.1.0-2+b7",
    "python3": "3.13.5-1",
    "python3.13": "3.13.5-2+deb13u5"
   },
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:c15bff75068effb03f4355997d03dc7e0fc58720c2b54ad6f7f10d1bc57efaa5": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:cd4aaf5d917fe19b942bba0df4e50eed8e6766190b381e85687cc7880255674e",
   "dpkg": {
    "libbrotli1": "1.1.0-2+b7"
   },
   "env": {
    "NODE_VERSION": "24.14.1"
   },
   "node": "24.14.1",
   "python": null,
   "unchecked": []
  },
  "sha256:c4124d1afa875e47f2892edf26b482fa54f796e2f342d3717a04ca091a22a9bd": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:8a4a99eff981d95c3ab12d019b82fe59725fb7761f1f9a5f155bc3f025528f4f",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:c5f2c369bbe47d0b712601bf44af5927e67a18cb5816dc378efb45eb993dab0a": {
   "apk": {
    "brotli-libs": "1.2.0-r1"
   },
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:813c41c0f5d2023c987e90ecf47e162dfc7afe62f93a8ad0f8392b5046f39961",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:c6c7ae1d5dfdcb094ad344ed68ccffc26635c9c6be80965664c33baf064b0515": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:4c72c1af2984a66a255efd20fc4ec73fe0f7267384b55315ad953b354b3361b4",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:c6ec6d72ff3d2d96cafaf673d64b17e709d0abdae20db218bd13a29348fb212f": {
   "apk": {
    "brotli-libs": "1.2.1-r0"
   },
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:5e17dc583ad1bc49a137691d660b6aa6b8a46a4da0a4b9bebf6ad5074a1edb25",
   "dpkg": {},
   "env": {
    "NODE_VERSION": "24.22.1"
   },
   "node": "24.22.1",
   "python": null,
   "unchecked": []
  },
  "sha256:c9d2bbb48c7f84d90e54496e2cd60422e56a5f2345c8a539ebe09f77e629d321": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:192fdcf5a91c193a0a7d3a854c1213f8be767854cb8e07204c9789ec2cba8422",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:cdcb7b1c7b6f1c9cb9442c71ac6275e78184657448407b2c1fdde7ee8024f4fb": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:48dc9d22ed984d9599e0d5823726053b0b426a86cff534f6bf1bd3dfb951f33e",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:d1891ede5a559f1086f55053bb8cc1569b0298338c4d72d71725a7f74f6ba620": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:d9fc02976678d4236145299c40dc267051681b33489c994f0ec4a097ce4a9521",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:d200d2dd76b03a99b52651fd1325aff7dcd35422c35c01bac56571b0507f3deb": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:bff16a94c0b4b6d9642581e2a3aa81beb3edb940b2f5a3aac1d22c6a68cb7747",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:d317916b28090c33eb36b308464ea391f8b7df1d850fcfea227a39ec879718c2": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:04225d8995a221de3b73a6131fe25eed14448830e54998f30877a70f48c6ac13",
   "dpkg": {
    "libbrotli1": "1.1.0-2+b7"
   },
   "env": {
    "NODE_VERSION": "24.21.0"
   },
   "node": "24.21.0",
   "python": null,
   "unchecked": []
  },
  "sha256:d4057e7019e9b19f25e039d4a204cc502e1a112d1a2305966a534f3d7079e644": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:15aef503f27e9919847595a81ab4e0fcbf2889effffd7995a09fe5a95c3add8f",
   "dpkg": {
    "libbrotli1": "1.2.0-3build1",
    "python3": "3.14.3-0ubuntu2",
    "python3.14": "3.14.4-1ubuntu0.2"
   },
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:d46e102fa8b9b72bfcdeb56f9dd538742092119dc8b11f31fe662605cd234cd9": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:71541e69e0a1fbec2fa57d6b3b30d751c7847ca77ce66f5af4ffff48060c37c8",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:d64c841a560c54aa7c27b0e6bbd2fbf8b51073565040d2a6bfbc127f0a72cf1e": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:b3322549752cd0b5b3c72adee7ac727130365089de66743875d10225c17e0549",
   "dpkg": {},
   "env": {
    "NODE_VERSION": "26.10.0"
   },
   "node": "26.10.0",
   "python": null,
   "unchecked": []
  },
  "sha256:d76177573caab135e8167179c9954168b5c582a48cbef0fcb7e1571af0c84d98": {
   "apk": {
    "brotli-libs": "1.2.0-r1"
   },
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:aa7226cab445342c5271844424663c59cdd635af5ccde63e4e3a362662fa86bf",
   "dpkg": {},
   "env": {
    "NODE_VERSION": "22.23.1"
   },
   "node": "22.23.1",
   "python": null,
   "unchecked": []
  },
  "sha256:d8fab675b55ad293ded98fd71efcfd46054cbad9746534ae1cc4794a88c0b3be": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:2636191726a315dbd75228537f7be74b2fa7498998bb22e37b5b5c8756018fba",
   "dpkg": {},
   "env": {
    "NODE_VERSION": "22.23.4"
   },
   "node": "22.23.4",
   "python": null,
   "unchecked": []
  },
  "sha256:dbbc38ea21103cefb50396340cd88afec779c7e070b0a7bf5a75b4ce46651d3f": {
   "apk": {
    "brotli-libs": "1.2.0-r1"
   },
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:7b22f3edf947329d75eba7a62d9f6ea1ac1e786736813ef7a98cfb275a52e49b",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:def2480040adc164b3a57340e77674eadfd88fb7f0593df25e93297f29c7fd7c": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:965ca448f19e0d2f1afb2b36e951cc6fdd371f3d928616229de88819108a947b",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:e16c2f166a8174901959fdf85e2e4c7bd1ebc4b37e0b6655de97c41408a260c4": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:7909f11a1ce217ed660afb02545f26e4adf72a5282633db436972abdfa026d20",
   "dpkg": {},
   "env": {
    "PYTHON_VERSION": "3.11.15"
   },
   "node": null,
   "python": "3.11.15",
   "unchecked": []
  },
  "sha256:e3da62a847b9a5d51a11f73cfea1d9c13c3be3809614490d4edddcf01dcf919b": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:8c114db7648a1654828d33e1f9f3b18e97c4caae6707d34bf04d793d260f7e67",
   "dpkg": {
    "libbrotli1": "1.1.0-2build2",
    "python3": "3.12.3-0ubuntu2.1",
    "python3.12": "3.12.3-1ubuntu0.13"
   },
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:e9733bafb1bdef9b00e25a21f8f99dc26a22224bf16641ad754d1649f4c3357a": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:84967b9b7ba45e38a9278d3e594305f43d4993c310df3905b51138b816c365f3",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:ea1c7aa3ef3f307cd03e85f34abb604478ccb90b567fc690da0cd9776da76b13": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:66eae352a79e6f677aeddd8c25a9bdb017586dc5fbd230f22329213d891f94bd",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:eae9a374d22f8bf73311ac7d1f37fc4e78822d196117a0a42d5e9ba6cd749d01": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:9066789006d76cd8214f5fff86e6c092ed79f6e3502d51d0aff0517da9e406e6",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:ebefa8cb3e36a8ce667b7739f51b86c24e9fd07f367e9fee9f21df48ea4e6542": {
   "apk": {
    "brotli-libs": "1.2.1-r0",
    "python3": "3.14.10-r1"
   },
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:5483bf13c33be98fe1df144e6281f13cd48ee77aa68b4ef46e7cf02c02998f54",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:efb3cde962015fcc036b2ea625242248611943b27212ebf4392841fb30fad055": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:2bb2e0344616c62a6d76ea10558497499f8ed3f731400e143dc7bf17b757b5b9",
   "dpkg": {
    "libbrotli1": "1.1.0-2+b7"
   },
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:efd719c99d83b060d9daefdcf00360461adf279f45ef5391f8d111892118753e": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:86b17a25c2db1d16a61b16b3c8f336679eb19e26333d03e808da387206e40faa",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:f344085e618bb05e22b964b0208dbd06d3468275bac70206f93805245e067b40": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:50484043eadd8d9562053940c0ed523dbddaf9086c370127b2f4acabb8bddddc",
   "dpkg": {
    "libbrotli1": "1.1.0-2build2"
   },
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:f451d98066cbc0c108146420a61a60f7638de50e067738951461e0105eeaa56d": {
   "apk": {
    "python3": "3.12.14-r0"
   },
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:0902d473d575082781b3fd4f56a6eb5550a5e121838156e0a26f2fdd104288fc",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:f5dd39cc9409b4006f8b090e5f9ed042cdb736d28a06b4f985c674dacafc94d5": {
   "apk": {
    "brotli-libs": "1.2.0-r1"
   },
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:3752fb2a467b4fc5e19a6ba4985f5a84e005b62c3fbb63536aea1f8f2d3a6222",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:f7dc8428d10aef17f3075886d3c1c022f566ec456f88985f02c137f4fc534576": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:3a848c83404d59ba9df4d91b92af4c400c8876ccdbbf3b563d41019cee29df39",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:f8be8d6963d17e4e5e406a4a8462c0ca4ce5c7e54fd9cb52890f5bfb7012b365": {
   "apk": {
    "brotli-libs": "1.2.0-r1"
   },
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:8e652a04a2b631f5ac5f7dd04c5c156dc9377a4dbe7f8bf55bd52da05184ca3e",
   "dpkg": {},
   "env": {
    "NODE_VERSION": "24.22.0"
   },
   "node": "24.22.0",
   "python": null,
   "unchecked": []
  },
  "sha256:fbfbb6903bb98087454861f73335a193c8a76fd54e58616b7be8e0b2f70ba7a2": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:ee15d7e813f27ea4cdbfd683715360c1e8edb4b5decd30ecaecd775d969b0087",
   "dpkg": {
    "python3": "3.11.2-1+b1"
   },
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:fd7dc98638c8e305f4dc34e979f1c0fdfdcaeb0fbf8fcff77ae834b6da3d7e6e": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:f97baa533a26513c453a362be331a43eb60214302f449c16571b23cea141dce4",
   "dpkg": {},
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:fea863d0cd9ec445985d9c75fc6ed64e38a1d2766cf0c250a33d553f4fc1b771": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:7da5184caa38c553f219f6772476540081f392a68049e2b68c923f6daf877f8e",
   "dpkg": {
    "libbrotli1": "1.1.0-2+deb13u1"
   },
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  },
  "sha256:ffbb7ba5c4f017e4b2a5bd4013b5c90f86f38123b21d9fbda69af6ec6c112b2b": {
   "apk": {},
   "brotli": null,
   "brotlicffi": null,
   "digest": "sha256:1663512e484c86f784e986f55cfe5c5bc3da77dd9a217ab327b2f84b53d8bf03",
   "dpkg": {
    "libbrotli1": "1.1.0-2build2"
   },
   "env": {},
   "node": null,
   "python": null,
   "unchecked": []
  }
 },
 "seed_pending": [],
 "seeded_at": "2026-10-26",
 "version": 1,
 "weekly_last": "2026-10-26"
}