{
  "auditReportVersion": 2,
  "vulnerabilities": {
    "@11ty/eleventy": {
      "name": "@11ty/eleventy",
      "severity": "high",
      "isDirect": true,
      "via": [
        "@11ty/eleventy-dev-server",
        "chokidar",
        "nunjucks"
      ],
      "effects": [],
      "range": "0.4.0 - 4.0.0-alpha.5",
      "nodes": [
        "node_modules/@11ty/eleventy"
      ],
      "fixAvailable": {
        "name": "@11ty/eleventy",
        "version": "0.6.0",
        "isSemVerMajor": true
      }
    },
    "@11ty/eleventy-dev-server": {
      "name": "@11ty/eleventy-dev-server",
      "severity": "high",
      "isDirect": false,
      "via": [
        "chokidar"
      ],
      "effects": [
        "@11ty/eleventy"
      ],
      "range": "<=2.0.8",
      "nodes": [
        "node_modules/@11ty/eleventy-dev-server"
      ],
      "fixAvailable": {
        "name": "@11ty/eleventy",
        "version": "0.6.0",
        "isSemVerMajor": true
      }
    },
    "argparse": {
      "name": "argparse",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "sprintf-js"
      ],
      "effects": [
        "js-yaml"
      ],
      "range": "1.0.0 - 1.0.10",
      "nodes": [
        "node_modules/gray-matter/node_modules/argparse"
      ],
      "fixAvailable": true
    },
    "brace-expansion": {
      "name": "brace-expansion",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1123897,
          "name": "brace-expansion",
          "dependency": "brace-expansion",
          "title": "brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups",
          "url": "https://github.com/advisories/GHSA-3jxr-9vmj-r5cp",
          "severity": "high",
          "cwe": [
            "CWE-400",
            "CWE-407"
          ],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
          },
          "range": "<1.1.16"
        },
        {
          "source": 1130588,
          "name": "brace-expansion",
          "dependency": "brace-expansion",
          "title": "brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash",
          "url": "https://github.com/advisories/GHSA-mh99-v99m-4gvg",
          "severity": "high",
          "cwe": [
            "CWE-400",
            "CWE-770"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<1.1.17"
        },
        {
          "source": 1130737,
          "name": "brace-expansion",
          "dependency": "brace-expansion",
          "title": "brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation",
          "url": "https://github.com/advisories/GHSA-rgw5-rvv9-x895",
          "severity": "high",
          "cwe": [
            "CWE-400",
            "CWE-770"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<1.1.18"
        },
        {
          "source": 1240100,
          "name": "brace-expansion",
          "dependency": "brace-expansion",
          "title": "brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service",
          "url": "https://github.com/advisories/GHSA-q2hr-2g5m-vwhr",
          "severity": "moderate",
          "cwe": [
            "CWE-400",
            "CWE-407"
          ],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
          },
          "range": "<1.1.21"
        },
        {
          "source": 1240104,
          "name": "brace-expansion",
          "dependency": "brace-expansion",
          "title": "brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion",
          "url": "https://github.com/advisories/GHSA-qhr7-859c-m2p7",
          "severity": "high",
          "cwe": [
            "CWE-400",
            "CWE-674"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<1.1.20"
        },
        {
          "source": 1240108,
          "name": "brace-expansion",
          "dependency": "brace-expansion",
          "title": "brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion",
          "url": "https://github.com/advisories/GHSA-6j4f-fj2g-mc7p",
          "severity": "high",
          "cwe": [
            "CWE-400",
            "CWE-674"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<1.1.19"
        }
      ],
      "effects": [],
      "range": "<=1.1.20",
      "nodes": [
        "node_modules/brace-expansion"
      ],
      "fixAvailable": true
    },
    "braces": {
      "name": "braces",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1240992,
          "name": "braces",
          "dependency": "braces",
          "title": "braces vulnerable to stack-exhaustion denial of service through deeply nested patterns",
          "url": "https://github.com/advisories/GHSA-vfj7-8cjw-p6xm",
          "severity": "high",
          "cwe": [
            "CWE-674"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<=3.0.3"
        }
      ],
      "effects": [
        "chokidar"
      ],
      "range": "*",
      "nodes": [
        "node_modules/braces"
      ],
      "fixAvailable": {
        "name": "@11ty/eleventy",
        "version": "0.6.0",
        "isSemVerMajor": true
      }
    },
    "chokidar": {
      "name": "chokidar",
      "severity": "high",
      "isDirect": false,
      "via": [
        "braces"
      ],
      "effects": [
        "@11ty/eleventy",
        "@11ty/eleventy-dev-server",
        "nunjucks"
      ],
      "range": "2.0.0 - 3.6.0",
      "nodes": [
        "node_modules/chokidar"
      ],
      "fixAvailable": {
        "name": "@11ty/eleventy",
        "version": "0.6.0",
        "isSemVerMajor": true
      }
    },
    "form-data": {
      "name": "form-data",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1120743,
          "name": "form-data",
          "dependency": "form-data",
          "title": "form-data: CRLF injection in form-data via unescaped multipart field names and filenames",
          "url": "https://github.com/advisories/GHSA-hmw2-7cc7-3qxx",
          "severity": "high",
          "cwe": [
            "CWE-93"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
          },
          "range": ">=4.0.0 <4.0.6"
        }
      ],
      "effects": [],
      "range": "4.0.0 - 4.0.5",
      "nodes": [
        "node_modules/form-data"
      ],
      "fixAvailable": true
    },
    "js-yaml": {
      "name": "js-yaml",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1121859,
          "name": "js-yaml",
          "dependency": "js-yaml",
          "title": "JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases",
          "url": "https://github.com/advisories/GHSA-h67p-54hq-rp68",
          "severity": "moderate",
          "cwe": [
            "CWE-407"
          ],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
          },
          "range": "<3.15.0"
        },
        {
          "source": 1121860,
          "name": "js-yaml",
          "dependency": "js-yaml",
          "title": "JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases",
          "url": "https://github.com/advisories/GHSA-h67p-54hq-rp68",
          "severity": "moderate",
          "cwe": [
            "CWE-407"
          ],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
          },
          "range": ">=4.0.0 <=4.1.1"
        },
        {
          "source": 1123911,
          "name": "js-yaml",
          "dependency": "js-yaml",
          "title": "js-yaml: YAML merge-key chains can force quadratic CPU consumption",
          "url": "https://github.com/advisories/GHSA-52cp-r559-cp3m",
          "severity": "high",
          "cwe": [
            "CWE-400",
            "CWE-407"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=4.0.0 <4.3.0"
        },
        {
          "source": 1123912,
          "name": "js-yaml",
          "dependency": "js-yaml",
          "title": "js-yaml: YAML merge-key chains can force quadratic CPU consumption",
          "url": "https://github.com/advisories/GHSA-52cp-r559-cp3m",
          "severity": "high",
          "cwe": [
            "CWE-400",
            "CWE-407"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=3.0.0 <3.15.0"
        },
        {
          "source": 1138114,
          "name": "js-yaml",
          "dependency": "js-yaml",
          "title": "JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported",
          "url": "https://github.com/advisories/GHSA-5p4m-2wfm-xmqj",
          "severity": "high",
          "cwe": [
            "CWE-407"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=3.0.0 <3.15.1"
        },
        {
          "source": 1138115,
          "name": "js-yaml",
          "dependency": "js-yaml",
          "title": "JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported",
          "url": "https://github.com/advisories/GHSA-5p4m-2wfm-xmqj",
          "severity": "high",
          "cwe": [
            "CWE-407"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=4.0.0 <4.3.1"
        },
        {
          "source": 1193726,
          "name": "js-yaml",
          "dependency": "js-yaml",
          "title": "js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources",
          "url": "https://github.com/advisories/GHSA-2883-xcg3-v3hh",
          "severity": "high",
          "cwe": [
            "CWE-400",
            "CWE-407"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=3.0.0 <3.15.2"
        },
        {
          "source": 1193727,
          "name": "js-yaml",
          "dependency": "js-yaml",
          "title": "js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources",
          "url": "https://github.com/advisories/GHSA-2883-xcg3-v3hh",
          "severity": "high",
          "cwe": [
            "CWE-400",
            "CWE-407"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=4.0.0 <4.3.2"
        },
        "argparse"
      ],
      "effects": [],
      "range": "<=4.3.1",
      "nodes": [
        "node_modules/gray-matter/node_modules/js-yaml",
        "node_modules/js-yaml"
      ],
      "fixAvailable": true
    },
    "linkify-it": {
      "name": "linkify-it",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1121797,
          "name": "linkify-it",
          "dependency": "linkify-it",
          "title": "LinkifyIt#match scan loop has quadratic algorithmic complexity",
          "url": "https://github.com/advisories/GHSA-22p9-wv53-3rq4",
          "severity": "high",
          "cwe": [
            "CWE-1333"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<=5.0.0"
        },
        {
          "source": 1124012,
          "name": "linkify-it",
          "dependency": "linkify-it",
          "title": "linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text",
          "url": "https://github.com/advisories/GHSA-v245-v573-v5vm",
          "severity": "high",
          "cwe": [
            "CWE-407"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<=5.0.1"
        }
      ],
      "effects": [],
      "range": "<=5.0.1",
      "nodes": [
        "node_modules/linkify-it"
      ],
      "fixAvailable": true
    },
    "liquidjs": {
      "name": "liquidjs",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1124277,
          "name": "liquidjs",
          "dependency": "liquidjs",
          "title": "LiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforce",
          "url": "https://github.com/advisories/GHSA-g357-x5c3-c72p",
          "severity": "high",
          "cwe": [
            "CWE-770"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<=10.27.0"
        },
        {
          "source": 1164797,
          "name": "liquidjs",
          "dependency": "liquidjs",
          "title": "LiquidJS has an infinite loop vulnerability in its `strip_html` filter",
          "url": "https://github.com/advisories/GHSA-m7fp-h3p4-hr49",
          "severity": "high",
          "cwe": [
            "CWE-835"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=10.26.0 <10.27.1"
        },
        {
          "source": 1193669,
          "name": "liquidjs",
          "dependency": "liquidjs",
          "title": "LiquidJS: Uncontrolled Resource Consumption in `join` filter allows template authors to bypass `memoryLimit` and crash the process",
          "url": "https://github.com/advisories/GHSA-4r6h-5v86-94p3",
          "severity": "high",
          "cwe": [
            "CWE-400"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<=10.27.1"
        },
        {
          "source": 1241408,
          "name": "liquidjs",
          "dependency": "liquidjs",
          "title": "LiquidJS: ownPropertyOnly bypass for inherited array indices in first/last/join/reverse/slice/compact, `.first`/`.last`, negative index, and for-loop iteration",
          "url": "https://github.com/advisories/GHSA-fwxr-j5w2-587m",
          "severity": "moderate",
          "cwe": [
            "CWE-200"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<=10.27.1"
        }
      ],
      "effects": [],
      "range": "<=10.27.1",
      "nodes": [
        "node_modules/liquidjs"
      ],
      "fixAvailable": true
    },
    "markdown-it": {
      "name": "markdown-it",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1120820,
          "name": "markdown-it",
          "dependency": "markdown-it",
          "title": "markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations",
          "url": "https://github.com/advisories/GHSA-6v5v-wf23-fmfq",
          "severity": "moderate",
          "cwe": [
            "CWE-400",
            "CWE-407"
          ],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
          },
          "range": "<=14.1.1"
        },
        {
          "source": 1239989,
          "name": "markdown-it",
          "dependency": "markdown-it",
          "title": "markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds",
          "url": "https://github.com/advisories/GHSA-253c-mchw-3w2r",
          "severity": "moderate",
          "cwe": [
            "CWE-400",
            "CWE-407"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<14.3.1"
        }
      ],
      "effects": [],
      "range": "<=14.3.0",
      "nodes": [
        "node_modules/markdown-it"
      ],
      "fixAvailable": true
    },
    "nunjucks": {
      "name": "nunjucks",
      "severity": "high",
      "isDirect": false,
      "via": [
        "chokidar"
      ],
      "effects": [
        "@11ty/eleventy"
      ],
      "range": "1.0.2 - 1.0.3 || >=3.1.3",
      "nodes": [
        "node_modules/nunjucks"
      ],
      "fixAvailable": {
        "name": "@11ty/eleventy",
        "version": "0.6.0",
        "isSemVerMajor": true
      }
    },
    "sprintf-js": {
      "name": "sprintf-js",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1241202,
          "name": "sprintf-js",
          "dependency": "sprintf-js",
          "title": "sprintf-js vulnerable to denial of service through unbounded precision specifiers",
          "url": "https://github.com/advisories/GHSA-hp3w-g68c-fv3c",
          "severity": "moderate",
          "cwe": [
            "CWE-1284"
          ],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
          },
          "range": "<=1.1.3"
        }
      ],
      "effects": [
        "argparse"
      ],
      "range": "*",
      "nodes": [
        "node_modules/sprintf-js"
      ],
      "fixAvailable": true
    },
    "ws": {
      "name": "ws",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1123259,
          "name": "ws",
          "dependency": "ws",
          "title": "ws: Memory exhaustion DoS from tiny fragments and data chunks",
          "url": "https://github.com/advisories/GHSA-96hv-2xvq-fx4p",
          "severity": "high",
          "cwe": [
            "CWE-400",
            "CWE-770",
            "CWE-1050"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=8.0.0 <8.21.0"
        }
      ],
      "effects": [],
      "range": "8.0.0 - 8.20.1",
      "nodes": [
        "node_modules/ws"
      ],
      "fixAvailable": true
    }
  },
  "metadata": {
    "vulnerabilities": {
      "info": 0,
      "low": 0,
      "moderate": 3,
      "high": 11,
      "critical": 0,
      "total": 14
    },
    "dependencies": {
      "prod": 1,
      "dev": 171,
      "optional": 1,
      "peer": 0,
      "peerOptional": 0,
      "total": 171
    }
  }
}