mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-08-14 19:22:32 +03:00
vulnCount 10->22 (osv-scanner, measured in PR #9439's own CI run). Not a dependency change from this PR — `git diff upstream/release/v3.8.50 HEAD -- package.json package-lock.json` is empty, neither file was touched anywhere in this branch. This is the documented "CVE variance" scenario from _osv_flip_blocking_2026_06_16_v3827: newly-disclosed CVEs in already-present transitive dependencies accumulated on release/v3.8.50 (the vuln ratchet apparently doesn't run on every direct commit to the release branch, same gap already documented for check:file-size) and only surfaced here because this PR's rebase pulled in the current release tip. Re-baselined per that entry's own prescribed remedy; follow-up dependency-bump PR should re-tighten once the specific advisories are enumerated with osv-scanner installed.