# Node.js Dependency Security Report **Generated**: 2026-01-09T15:40:11Z **Package Manager**: yarn ## Security Vulnerabilities ### form-data (CRITICAL) **Package**: form-data **Severity**: CRITICAL **Current Version**: 2.3.3 **Fixed In**: 2.5.4 **Recommendation**: Update to 2.5.4 **Details**: https://github.com/advisories/GHSA-fjxv-7rqg-78g4 **Dependency Paths**: ``` cypress>@cypress/request>form-data ``` **Direct Dependencies**: - cypress (prod); spec ^12.17.2; resolved 12.17.4 ### braces (HIGH) **Package**: braces **Severity**: HIGH **Current Version**: 2.3.2 **Fixed In**: 3.0.3 **Recommendation**: Update to 3.0.3 **Details**: https://github.com/advisories/GHSA-grv7-fg5c-xmjg **Dependency Paths**: ``` gulp>glob-watcher>anymatch>micromatch>braces gulp>glob-watcher>chokidar>anymatch>micromatch>braces gulp>glob-watcher>chokidar>braces gulp>gulp-cli>liftoff>findup-sync>micromatch>braces gulp>gulp-cli>matchdep>findup-sync>micromatch>braces gulp>gulp-cli>matchdep>micromatch>braces ``` **Direct Dependencies**: - gulp (prod); spec ^4.0.2; resolved 4.0.2 ### lodash.template (HIGH) **Package**: lodash.template **Severity**: HIGH **Current Version**: 4.5.0 **Fixed In**: 0.0.0 **Recommendation**: Update to 0.0.0 **Details**: https://github.com/advisories/GHSA-35jh-r3h4-6jhm **Dependency Paths**: ``` gulp-exec>lodash.template ``` **Direct Dependencies**: - gulp-exec (prod); spec ^4.0.0; resolved 4.0.0 ### qs (HIGH) **Package**: qs **Severity**: HIGH **Current Version**: 6.13.0 **Fixed In**: 6.14.1 **Recommendation**: Update to 6.14.1 **Details**: https://github.com/advisories/GHSA-6rw7-vpxm-498p **Dependency Paths**: ``` @rspack/cli>@rspack/dev-server>webpack-dev-server>express>body-parser>qs @rspack/cli>@rspack/dev-server>webpack-dev-server>express>qs browserify>url>qs cypress-rspack-dev-server>@rspack/cli>@rspack/dev-server>webpack-dev-server>express>body-parser>qs cypress>@cypress/request>qs watchify>browserify>url>qs webpack-dev-server>express>body-parser>qs webpack-dev-server>express>qs ``` **Direct Dependencies**: - @rspack/cli (dev); spec ^1.0.1; resolved 1.6.5 - browserify (dev); spec ^17.0.0; resolved 17.0.1 - cypress (prod); spec ^12.17.2; resolved 12.17.4 - cypress-rspack-dev-server (dev); spec ^1.1.0; resolved 1.1.1 - watchify (dev); spec ^4.0.0; resolved 4.0.0 - webpack-dev-server (dev); spec ^4.7.4; resolved 4.15.2 ### @cypress/request (MODERATE) **Package**: @cypress/request **Severity**: MODERATE **Current Version**: 2.88.12 **Fixed In**: 3.0.0 **Recommendation**: Update to 3.0.0 **Details**: https://github.com/advisories/GHSA-p8p7-x288-28g6 **Dependency Paths**: ``` cypress>@cypress/request ``` **Direct Dependencies**: - cypress (prod); spec ^12.17.2; resolved 12.17.4 ### js-yaml (MODERATE) **Package**: js-yaml **Severity**: MODERATE **Current Version**: 4.1.0 **Fixed In**: 4.1.1 **Recommendation**: Update to 4.1.1 **Details**: https://github.com/advisories/GHSA-mh29-5h37-fv8m **Dependency Paths**: ``` @redocly/cli>@redocly/respect-core>js-yaml ``` **Direct Dependencies**: - @redocly/cli (prod); spec ^1.25.11; resolved 1.34.5 - js-yaml (prod); spec ^3.13.1; resolved 3.14.2 ### micromatch (MODERATE) **Package**: micromatch **Severity**: MODERATE **Current Version**: 3.1.10 **Fixed In**: 4.0.8 **Recommendation**: Update to 4.0.8 **Details**: https://github.com/advisories/GHSA-952p-6rrq-rcjv **Dependency Paths**: ``` gulp>glob-watcher>anymatch>micromatch gulp>glob-watcher>chokidar>anymatch>micromatch gulp>gulp-cli>liftoff>findup-sync>micromatch gulp>gulp-cli>matchdep>findup-sync>micromatch gulp>gulp-cli>matchdep>micromatch ``` **Direct Dependencies**: - gulp (prod); spec ^4.0.2; resolved 4.0.2 ### postcss (MODERATE) **Package**: postcss **Severity**: MODERATE **Current Version**: 6.0.23 **Fixed In**: 7.0.36 **Recommendation**: Update to 7.0.36 **Details**: https://github.com/advisories/GHSA-566m-qj78-rww5 **Dependency Paths**: ``` gulp-autoprefixer>autoprefixer>postcss gulp-autoprefixer>postcss gulp-rtlcss>rtlcss>postcss ``` **Direct Dependencies**: - gulp-autoprefixer (prod); spec ^4.0.0; resolved 4.1.0 - gulp-rtlcss (prod); spec ^1.4.1; resolved 1.4.2 - postcss (dev); spec ^8.4.14; resolved 6.0.23 ### webpack-dev-server (MODERATE) **Package**: webpack-dev-server **Severity**: MODERATE **Current Version**: 4.15.2 **Fixed In**: 5.2.1 **Recommendation**: Update to 5.2.1 **Details**: https://github.com/advisories/GHSA-9jgg-88mc-972h **Dependency Paths**: ``` webpack-dev-server ``` **Direct Dependencies**: - webpack-dev-server (dev); spec ^4.7.4; resolved 4.15.2 ## Outdated Packages ### @cypress/vue **Current**: 3.1.2 **Wanted**: 3.1.2 **Latest**: 6.0.2 **Update Type**: major ### @cypress/webpack-dev-server **Current**: 1.8.4 **Wanted**: 1.8.4 **Latest**: 5.4.1 **Update Type**: major ### @cypress/webpack-preprocessor **Current**: 6.0.4 **Wanted**: 6.0.4 **Latest**: 7.0.2 **Update Type**: major ### @faker-js/faker **Current**: 9.9.0 **Wanted**: 9.9.0 **Latest**: 10.2.0 **Update Type**: major ### @fortawesome/fontawesome-svg-core **Current**: 6.7.2 **Wanted**: 6.7.2 **Latest**: 7.1.0 **Update Type**: major ### @fortawesome/free-solid-svg-icons **Current**: 6.7.2 **Wanted**: 6.7.2 **Latest**: 7.1.0 **Update Type**: major ### @fortawesome/vue-fontawesome **Current**: 3.1.2 **Wanted**: 3.1.3 **Latest**: 3.1.3 **Update Type**: patch ### @redocly/cli **Current**: 1.34.5 **Wanted**: 1.34.6 **Latest**: 2.14.4 **Update Type**: major ### @rspack/cli **Current**: 1.6.5 **Wanted**: 1.7.1 **Latest**: 1.7.1 **Update Type**: minor ### @rspack/core **Current**: 1.6.5 **Wanted**: 1.7.1 **Latest**: 1.7.1 **Update Type**: minor ### @vue/compiler-sfc **Current**: 3.5.25 **Wanted**: 3.5.26 **Latest**: 3.5.26 **Update Type**: patch ### css-loader **Current**: 6.11.0 **Wanted**: 6.11.0 **Latest**: 7.1.2 **Update Type**: major ### cypress **Current**: 12.17.4 **Wanted**: 12.17.4 **Latest**: 15.8.2 **Update Type**: major ### datatables.net **Current**: 1.13.11 **Wanted**: 1.13.11 **Latest**: 2.3.6 **Update Type**: major ### datatables.net-buttons **Current**: 2.4.3 **Wanted**: 2.4.3 **Latest**: 3.2.6 **Update Type**: major ### datatables.net-vue3 **Current**: 2.1.3 **Wanted**: 2.1.3 **Latest**: 3.0.4 **Update Type**: major ### eslint **Current**: 9.39.1 **Wanted**: 9.39.2 **Latest**: 9.39.2 **Update Type**: patch ### eslint-config-prettier **Current**: 9.1.2 **Wanted**: 9.1.2 **Latest**: 10.1.8 **Update Type**: major ### eslint-plugin-vue **Current**: 9.33.0 **Wanted**: 9.33.0 **Latest**: 10.6.2 **Update Type**: major ### globals **Current**: 16.5.0 **Wanted**: 16.5.0 **Latest**: 17.0.0 **Update Type**: major ### gulp **Current**: 4.0.2 **Wanted**: 4.0.2 **Latest**: 5.0.1 **Update Type**: major ### gulp-autoprefixer **Current**: 4.1.0 **Wanted**: 4.1.0 **Latest**: 10.0.0 **Update Type**: major ### gulp-exec **Current**: 4.0.0 **Wanted**: 4.0.0 **Latest**: 5.0.0 **Update Type**: major ### gulp-rtlcss **Current**: 1.4.2 **Wanted**: 1.4.2 **Latest**: 2.0.0 **Update Type**: major ### gulp-sass **Current**: 5.1.0 **Wanted**: 5.1.0 **Latest**: 6.0.1 **Update Type**: major ### gulp-sourcemaps **Current**: 2.6.5 **Wanted**: 2.6.5 **Latest**: 3.0.0 **Update Type**: major ### gulp-tap **Current**: 1.0.1 **Wanted**: 1.0.1 **Latest**: 2.0.0 **Update Type**: major ### js-yaml **Current**: 3.14.2 **Wanted**: 3.14.2 **Latest**: 4.1.1 **Update Type**: major ### minimatch **Current**: 3.1.2 **Wanted**: 3.1.2 **Latest**: 10.1.1 **Update Type**: major ### mysql2 **Current**: 3.15.3 **Wanted**: 3.16.0 **Latest**: 3.16.0 **Update Type**: minor ### postcss-selector-parser **Current**: 6.1.2 **Wanted**: 6.1.2 **Latest**: 7.1.1 **Update Type**: major ### prettier **Current**: 3.7.1 **Wanted**: 3.7.4 **Latest**: 3.7.4 **Update Type**: patch ### sass **Current**: 1.94.2 **Wanted**: 1.97.2 **Latest**: 1.97.2 **Update Type**: minor ### style-loader **Current**: 3.3.4 **Wanted**: 3.3.4 **Latest**: 4.0.0 **Update Type**: major ### stylelint **Current**: 14.16.1 **Wanted**: 14.16.1 **Latest**: 16.26.1 **Update Type**: major ### stylelint-config-standard-scss **Current**: 5.0.0 **Wanted**: 5.0.0 **Latest**: 16.0.0 **Update Type**: major ### stylelint-order **Current**: 5.0.0 **Wanted**: 5.0.0 **Latest**: 7.0.1 **Update Type**: major ### typescript **Current**: 4.9.5 **Wanted**: 4.9.5 **Latest**: 5.9.3 **Update Type**: major ### typescript-eslint **Current**: 8.48.0 **Wanted**: 8.52.0 **Latest**: 8.52.0 **Update Type**: minor ### vue **Current**: 3.5.25 **Wanted**: 3.5.26 **Latest**: 3.5.26 **Update Type**: patch ### vue-flatpickr-component **Current**: 9.0.8 **Wanted**: 9.0.8 **Latest**: 12.0.0 **Update Type**: major ### vue-router **Current**: 4.6.3 **Wanted**: 4.6.4 **Latest**: 4.6.4 **Update Type**: patch ### webpack **Current**: 5.103.0 **Wanted**: 5.104.1 **Latest**: 5.104.1 **Update Type**: minor ### webpack-cli **Current**: 4.10.0 **Wanted**: 4.10.0 **Latest**: 6.0.1 **Update Type**: major ### webpack-dev-server **Current**: 4.15.2 **Wanted**: 4.15.2 **Latest**: 5.2.2 **Update Type**: major ### yaml **Current**: 2.8.1 **Wanted**: 2.8.2 **Latest**: 2.8.2 **Update Type**: patch ## Next Steps 1. Review vulnerabilities and schedule fixes in Bugzilla. 2. Plan updates for major-version or security related packages. 3. Validate dependency changes in a controlled environment.