{"events":[{"event":"package_manager_selected","client":"npm","version":"11","source":"matrix_default","argv":["/usr/local/bin/corepack","npm@11"],"honors_pin":true,"detail":"no packageManager field; using the validated matrix default; corepack serves npm@11 (matrix_default)"},{"event":"tool_version_support","client":"npm","version":"11","state":"supported","evidence":"spec-02 matrix suite: resolve-through-view, capped-edge error, overrides"},{"event":"major_line_floor_applied","package_name":"@babel/core","major":"6","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable @babel/core 6.x version carries an identical vulnerability set; staying on the best available version 6.0.0-bridge.1 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-4x5r-pxfx-6jf8"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"@babel/core","major":"7","tier":"cve_free","reason":"floored","floor_version":"7.29.6","rationale":"@babel/core 7.x has a CVE-free floor at 7.29.6 clearing GHSA-4x5r-pxfx-6jf8.","clearing_vulnerability_ids":["GHSA-4x5r-pxfx-6jf8"],"residual_vulnerability_ids":[],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"@babel/core","major":"8","tier":"cve_free","reason":"floored","floor_version":"8.0.0","rationale":"@babel/core 8.x has a CVE-free floor at 8.0.0 clearing GHSA-4x5r-pxfx-6jf8.","clearing_vulnerability_ids":["GHSA-4x5r-pxfx-6jf8"],"residual_vulnerability_ids":[],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"@babel/plugin-transform-modules-systemjs","major":"7","tier":"cve_free","reason":"floored","floor_version":"7.29.4","rationale":"@babel/plugin-transform-modules-systemjs 7.x has a CVE-free floor at 7.29.4 clearing GHSA-fv7c-fp4j-7gwp.","clearing_vulnerability_ids":["GHSA-fv7c-fp4j-7gwp"],"residual_vulnerability_ids":[],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"@babel/plugin-transform-modules-systemjs","major":"8","tier":"cve_free","reason":"floored","floor_version":"8.0.0","rationale":"@babel/plugin-transform-modules-systemjs 8.x has a CVE-free floor at 8.0.0 clearing GHSA-fv7c-fp4j-7gwp.","clearing_vulnerability_ids":["GHSA-fv7c-fp4j-7gwp"],"residual_vulnerability_ids":[],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"ajv","major":"0","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable ajv 0.x version carries an identical vulnerability set; staying on the best available version 0.7.2 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-2g4f-4pwh-qvx6"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"ajv","major":"1","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable ajv 1.x version carries an identical vulnerability set; staying on the best available version 1.4.10 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-2g4f-4pwh-qvx6"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"ajv","major":"2","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable ajv 2.x version carries an identical vulnerability set; staying on the best available version 2.5.0 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-2g4f-4pwh-qvx6"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"ajv","major":"3","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable ajv 3.x version carries an identical vulnerability set; staying on the best available version 3.8.10 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-2g4f-4pwh-qvx6"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"ajv","major":"4","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable ajv 4.x version carries an identical vulnerability set; staying on the best available version 4.11.8 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-2g4f-4pwh-qvx6"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"ajv","major":"5","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable ajv 5.x version carries an identical vulnerability set; staying on the best available version 5.5.2 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-2g4f-4pwh-qvx6"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"ajv","major":"6","tier":"cve_free","reason":"floored","floor_version":"6.14.0","rationale":"ajv 6.x has a CVE-free floor at 6.14.0 clearing GHSA-2g4f-4pwh-qvx6.","clearing_vulnerability_ids":["GHSA-2g4f-4pwh-qvx6"],"residual_vulnerability_ids":[],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"ajv","major":"7","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable ajv 7.x version carries an identical vulnerability set; staying on the best available version 7.2.4 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-2g4f-4pwh-qvx6"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"ajv","major":"8","tier":"cve_free","reason":"floored","floor_version":"8.18.0","rationale":"ajv 8.x has a CVE-free floor at 8.18.0 clearing GHSA-2g4f-4pwh-qvx6.","clearing_vulnerability_ids":["GHSA-2g4f-4pwh-qvx6"],"residual_vulnerability_ids":[],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"axios","major":"0","tier":"least_bad","reason":"no_fixed_version_line","floor_version":null,"rationale":"no CVE-free axios version exists; ranked by KEV, then max severity, then EPSS sum (M7). Residual exposure: GHSA-35jp-ww65-95wh, GHSA-3g43-6gmg-66jw, GHSA-3p68-rc4w-qgx5, GHSA-3w6x-2g7m-8v23, GHSA-42h9-826w-cgv3, GHSA-43fc-jf86-j433, GHSA-445q-vr5w-6q77, GHSA-4hqw-qxg8-jxx2, GHSA-5c9x-8gcm-mpgx, GHSA-62hf-57xw-28j9, GHSA-6chq-wfr3-2hj9, GHSA-777c-7fjr-54vf, GHSA-7q8q-rj6j-mhjq, GHSA-898c-q2cr-xwhg, GHSA-9fr6-4gfg-395g, GHSA-fvcv-3m26-pcqx, GHSA-hfxv-24rg-xrqf, GHSA-j5f8-grm9-p9fc, GHSA-j8rh-479h-cp32, GHSA-jqh4-m9w3-8hp9, GHSA-m7pr-hjqh-92cm, GHSA-mmx7-hfxf-jppx, GHSA-p92q-9vqr-4j8v, GHSA-pf86-5x62-jrwf, GHSA-pmv8-rq9r-6j72, GHSA-pmwg-cvhr-8vh7, GHSA-q8qp-cvcw-x6jj, GHSA-vf2m-468p-8v99, GHSA-vh66-26gq-q6x8, GHSA-w9j2-pvgh-6h63, GHSA-xhjh-pmcv-23jw, GHSA-xx6v-rp6x-q39c. The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-35jp-ww65-95wh","GHSA-3g43-6gmg-66jw","GHSA-3p68-rc4w-qgx5","GHSA-3w6x-2g7m-8v23","GHSA-42h9-826w-cgv3","GHSA-43fc-jf86-j433","GHSA-445q-vr5w-6q77","GHSA-4hqw-qxg8-jxx2","GHSA-5c9x-8gcm-mpgx","GHSA-62hf-57xw-28j9","GHSA-6chq-wfr3-2hj9","GHSA-777c-7fjr-54vf","GHSA-7q8q-rj6j-mhjq","GHSA-898c-q2cr-xwhg","GHSA-9fr6-4gfg-395g","GHSA-fvcv-3m26-pcqx","GHSA-hfxv-24rg-xrqf","GHSA-j5f8-grm9-p9fc","GHSA-j8rh-479h-cp32","GHSA-jqh4-m9w3-8hp9","GHSA-m7pr-hjqh-92cm","GHSA-mmx7-hfxf-jppx","GHSA-p92q-9vqr-4j8v","GHSA-pf86-5x62-jrwf","GHSA-pmv8-rq9r-6j72","GHSA-pmwg-cvhr-8vh7","GHSA-q8qp-cvcw-x6jj","GHSA-vf2m-468p-8v99","GHSA-vh66-26gq-q6x8","GHSA-w9j2-pvgh-6h63","GHSA-xhjh-pmcv-23jw","GHSA-xx6v-rp6x-q39c"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"axios","major":"1","tier":"cve_free","reason":"floored","floor_version":"1.20.0","rationale":"axios 1.x has a CVE-free floor at 1.20.0 clearing GHSA-35jp-ww65-95wh, GHSA-3g43-6gmg-66jw, GHSA-3p68-rc4w-qgx5, GHSA-3w6x-2g7m-8v23, GHSA-42h9-826w-cgv3, GHSA-43fc-jf86-j433, GHSA-445q-vr5w-6q77, GHSA-4hqw-qxg8-jxx2, GHSA-5c9x-8gcm-mpgx, GHSA-62hf-57xw-28j9, GHSA-6chq-wfr3-2hj9, GHSA-777c-7fjr-54vf, GHSA-7q8q-rj6j-mhjq, GHSA-898c-q2cr-xwhg, GHSA-9fr6-4gfg-395g, GHSA-fvcv-3m26-pcqx, GHSA-hfxv-24rg-xrqf, GHSA-j5f8-grm9-p9fc, GHSA-j8rh-479h-cp32, GHSA-jqh4-m9w3-8hp9, GHSA-m7pr-hjqh-92cm, GHSA-mmx7-hfxf-jppx, GHSA-p92q-9vqr-4j8v, GHSA-pf86-5x62-jrwf, GHSA-pmv8-rq9r-6j72, GHSA-pmwg-cvhr-8vh7, GHSA-q8qp-cvcw-x6jj, GHSA-vf2m-468p-8v99, GHSA-vh66-26gq-q6x8, GHSA-w9j2-pvgh-6h63, GHSA-xhjh-pmcv-23jw, GHSA-xx6v-rp6x-q39c.","clearing_vulnerability_ids":["GHSA-35jp-ww65-95wh","GHSA-3g43-6gmg-66jw","GHSA-3p68-rc4w-qgx5","GHSA-3w6x-2g7m-8v23","GHSA-42h9-826w-cgv3","GHSA-43fc-jf86-j433","GHSA-445q-vr5w-6q77","GHSA-4hqw-qxg8-jxx2","GHSA-5c9x-8gcm-mpgx","GHSA-62hf-57xw-28j9","GHSA-6chq-wfr3-2hj9","GHSA-777c-7fjr-54vf","GHSA-7q8q-rj6j-mhjq","GHSA-898c-q2cr-xwhg","GHSA-9fr6-4gfg-395g","GHSA-fvcv-3m26-pcqx","GHSA-hfxv-24rg-xrqf","GHSA-j5f8-grm9-p9fc","GHSA-j8rh-479h-cp32","GHSA-jqh4-m9w3-8hp9","GHSA-m7pr-hjqh-92cm","GHSA-mmx7-hfxf-jppx","GHSA-p92q-9vqr-4j8v","GHSA-pf86-5x62-jrwf","GHSA-pmv8-rq9r-6j72","GHSA-pmwg-cvhr-8vh7","GHSA-q8qp-cvcw-x6jj","GHSA-vf2m-468p-8v99","GHSA-vh66-26gq-q6x8","GHSA-w9j2-pvgh-6h63","GHSA-xhjh-pmcv-23jw","GHSA-xx6v-rp6x-q39c"],"residual_vulnerability_ids":[],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"baseline-browser-mapping","major":"0","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable baseline-browser-mapping 0.x version carries an identical vulnerability set; staying on the best available version 0.3.1 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-w5vr-8v7q-w6rv"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"baseline-browser-mapping","major":"1","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable baseline-browser-mapping 1.x version carries an identical vulnerability set; staying on the best available version 1.0.0 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-w5vr-8v7q-w6rv"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"baseline-browser-mapping","major":"2","tier":"cve_free","reason":"floored","floor_version":"2.11.0","rationale":"baseline-browser-mapping 2.x has a CVE-free floor at 2.11.0 clearing GHSA-w5vr-8v7q-w6rv.","clearing_vulnerability_ids":["GHSA-w5vr-8v7q-w6rv"],"residual_vulnerability_ids":[],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"basic-ftp","major":"1","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable basic-ftp 1.x version carries an identical vulnerability set; staying on the best available version 1.2.0 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-5rq4-664w-9x2c","GHSA-6v7q-wjvx-w8wg","GHSA-c475-qrg2-pj4r","GHSA-rp42-5vxx-qpwr","GHSA-rpmf-866q-6p89"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"basic-ftp","major":"2","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable basic-ftp 2.x version carries an identical vulnerability set; staying on the best available version 2.17.1 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-5rq4-664w-9x2c","GHSA-6v7q-wjvx-w8wg","GHSA-c475-qrg2-pj4r","GHSA-rp42-5vxx-qpwr","GHSA-rpmf-866q-6p89"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"basic-ftp","major":"3","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable basic-ftp 3.x version carries an identical vulnerability set; staying on the best available version 3.8.7 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-5rq4-664w-9x2c","GHSA-6v7q-wjvx-w8wg","GHSA-c475-qrg2-pj4r","GHSA-rp42-5vxx-qpwr","GHSA-rpmf-866q-6p89"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"basic-ftp","major":"4","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable basic-ftp 4.x version carries an identical vulnerability set; staying on the best available version 4.6.6 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-5rq4-664w-9x2c","GHSA-6v7q-wjvx-w8wg","GHSA-c475-qrg2-pj4r","GHSA-rp42-5vxx-qpwr","GHSA-rpmf-866q-6p89"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"basic-ftp","major":"5","tier":"least_bad","reason":"no_fixed_version_line","floor_version":null,"rationale":"no CVE-free basic-ftp version exists; ranked by KEV, then max severity, then EPSS sum (M7). Residual exposure: GHSA-5rq4-664w-9x2c, GHSA-6v7q-wjvx-w8wg, GHSA-c475-qrg2-pj4r, GHSA-rp42-5vxx-qpwr, GHSA-rpmf-866q-6p89. The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-5rq4-664w-9x2c","GHSA-6v7q-wjvx-w8wg","GHSA-c475-qrg2-pj4r","GHSA-rp42-5vxx-qpwr","GHSA-rpmf-866q-6p89"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"basic-ftp","major":"6","tier":"cve_free","reason":"floored","floor_version":"6.2.1","rationale":"basic-ftp 6.x has a CVE-free floor at 6.2.1 clearing GHSA-c475-qrg2-pj4r.","clearing_vulnerability_ids":["GHSA-c475-qrg2-pj4r"],"residual_vulnerability_ids":[],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"body-parser","major":"1","tier":"cve_free","reason":"floored","floor_version":"1.20.6","rationale":"body-parser 1.x has a CVE-free floor at 1.20.6 clearing GHSA-v422-hmwv-36x6.","clearing_vulnerability_ids":["GHSA-v422-hmwv-36x6"],"residual_vulnerability_ids":[],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"body-parser","major":"2","tier":"cve_free","reason":"floored","floor_version":"2.3.0","rationale":"body-parser 2.x has a CVE-free floor at 2.3.0 clearing GHSA-v422-hmwv-36x6.","clearing_vulnerability_ids":["GHSA-v422-hmwv-36x6"],"residual_vulnerability_ids":[],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"brace-expansion","major":"0","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable brace-expansion 0.x version carries an identical vulnerability set; staying on the best available version 0.0.0 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-3jxr-9vmj-r5cp","GHSA-6j4f-fj2g-mc7p","GHSA-f886-m6hf-6m8v","GHSA-mh99-v99m-4gvg","GHSA-q2hr-2g5m-vwhr","GHSA-qhr7-859c-m2p7","GHSA-rgw5-rvv9-x895"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"brace-expansion","major":"1","tier":"cve_free","reason":"floored","floor_version":"1.1.21","rationale":"brace-expansion 1.x has a CVE-free floor at 1.1.21 clearing GHSA-3jxr-9vmj-r5cp, GHSA-6j4f-fj2g-mc7p, GHSA-f886-m6hf-6m8v, GHSA-mh99-v99m-4gvg, GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7, GHSA-rgw5-rvv9-x895.","clearing_vulnerability_ids":["GHSA-3jxr-9vmj-r5cp","GHSA-6j4f-fj2g-mc7p","GHSA-f886-m6hf-6m8v","GHSA-mh99-v99m-4gvg","GHSA-q2hr-2g5m-vwhr","GHSA-qhr7-859c-m2p7","GHSA-rgw5-rvv9-x895"],"residual_vulnerability_ids":[],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"brace-expansion","major":"2","tier":"cve_free","reason":"floored","floor_version":"2.1.7","rationale":"brace-expansion 2.x has a CVE-free floor at 2.1.7 clearing GHSA-3jxr-9vmj-r5cp, GHSA-6j4f-fj2g-mc7p, GHSA-f886-m6hf-6m8v, GHSA-mh99-v99m-4gvg, GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7, GHSA-rgw5-rvv9-x895.","clearing_vulnerability_ids":["GHSA-3jxr-9vmj-r5cp","GHSA-6j4f-fj2g-mc7p","GHSA-f886-m6hf-6m8v","GHSA-mh99-v99m-4gvg","GHSA-q2hr-2g5m-vwhr","GHSA-qhr7-859c-m2p7","GHSA-rgw5-rvv9-x895"],"residual_vulnerability_ids":[],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"brace-expansion","major":"3","tier":"least_bad","reason":"no_fixed_version_line","floor_version":null,"rationale":"no CVE-free brace-expansion version exists; ranked by KEV, then max severity, then EPSS sum (M7). Residual exposure: GHSA-3jxr-9vmj-r5cp, GHSA-6j4f-fj2g-mc7p, GHSA-f886-m6hf-6m8v, GHSA-mh99-v99m-4gvg, GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7, GHSA-rgw5-rvv9-x895. The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-3jxr-9vmj-r5cp","GHSA-6j4f-fj2g-mc7p","GHSA-f886-m6hf-6m8v","GHSA-mh99-v99m-4gvg","GHSA-q2hr-2g5m-vwhr","GHSA-qhr7-859c-m2p7","GHSA-rgw5-rvv9-x895"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"brace-expansion","major":"4","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable brace-expansion 4.x version carries an identical vulnerability set; staying on the best available version 4.0.1 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-3jxr-9vmj-r5cp","GHSA-6j4f-fj2g-mc7p","GHSA-f886-m6hf-6m8v","GHSA-mh99-v99m-4gvg","GHSA-q2hr-2g5m-vwhr","GHSA-qhr7-859c-m2p7","GHSA-rgw5-rvv9-x895"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"brace-expansion","major":"5","tier":"cve_free","reason":"floored","floor_version":"5.0.12","rationale":"brace-expansion 5.x has a CVE-free floor at 5.0.12 clearing GHSA-3jxr-9vmj-r5cp, GHSA-6j4f-fj2g-mc7p, GHSA-f886-m6hf-6m8v, GHSA-mh99-v99m-4gvg, GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7, GHSA-rgw5-rvv9-x895.","clearing_vulnerability_ids":["GHSA-3jxr-9vmj-r5cp","GHSA-6j4f-fj2g-mc7p","GHSA-f886-m6hf-6m8v","GHSA-mh99-v99m-4gvg","GHSA-q2hr-2g5m-vwhr","GHSA-qhr7-859c-m2p7","GHSA-rgw5-rvv9-x895"],"residual_vulnerability_ids":[],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"braces","major":"0","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable braces 0.x version carries an identical vulnerability set; staying on the best available version 0.1.5 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-vfj7-8cjw-p6xm"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"braces","major":"1","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable braces 1.x version carries an identical vulnerability set; staying on the best available version 1.8.5 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-vfj7-8cjw-p6xm"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"braces","major":"2","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable braces 2.x version carries an identical vulnerability set; staying on the best available version 2.3.2 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-vfj7-8cjw-p6xm"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"braces","major":"3","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable braces 3.x version carries an identical vulnerability set; keeping the locked version 3.0.3 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-vfj7-8cjw-p6xm"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"browserslist","major":"0","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable browserslist 0.x version carries an identical vulnerability set; staying on the best available version 0.5.0 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-73wf-gq98-2v4g","GHSA-c83g-rgw3-j3cx"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"browserslist","major":"1","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable browserslist 1.x version carries an identical vulnerability set; staying on the best available version 1.7.7 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-73wf-gq98-2v4g","GHSA-c83g-rgw3-j3cx"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"browserslist","major":"2","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable browserslist 2.x version carries an identical vulnerability set; staying on the best available version 2.11.3 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-73wf-gq98-2v4g","GHSA-c83g-rgw3-j3cx"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"browserslist","major":"3","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable browserslist 3.x version carries an identical vulnerability set; staying on the best available version 3.2.8 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-73wf-gq98-2v4g","GHSA-c83g-rgw3-j3cx"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"browserslist","major":"4","tier":"cve_free","reason":"floored","floor_version":"4.28.7","rationale":"browserslist 4.x has a CVE-free floor at 4.28.7 clearing GHSA-73wf-gq98-2v4g, GHSA-c83g-rgw3-j3cx.","clearing_vulnerability_ids":["GHSA-73wf-gq98-2v4g","GHSA-c83g-rgw3-j3cx"],"residual_vulnerability_ids":[],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"deepmerge-ts","major":"1","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable deepmerge-ts 1.x version carries an identical vulnerability set; staying on the best available version 1.1.7 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-ggr8-5vv4-36mx"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"deepmerge-ts","major":"2","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable deepmerge-ts 2.x version carries an identical vulnerability set; staying on the best available version 2.0.1 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-ggr8-5vv4-36mx"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"deepmerge-ts","major":"3","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable deepmerge-ts 3.x version carries an identical vulnerability set; staying on the best available version 3.0.1 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-ggr8-5vv4-36mx"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"deepmerge-ts","major":"4","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable deepmerge-ts 4.x version carries an identical vulnerability set; staying on the best available version 4.3.0 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-ggr8-5vv4-36mx"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"deepmerge-ts","major":"5","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable deepmerge-ts 5.x version carries an identical vulnerability set; keeping the locked version 5.1.0 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-ggr8-5vv4-36mx"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"deepmerge-ts","major":"6","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable deepmerge-ts 6.x version carries an identical vulnerability set; staying on the best available version 6.0.3 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-ggr8-5vv4-36mx"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"deepmerge-ts","major":"7","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable deepmerge-ts 7.x version carries an identical vulnerability set; staying on the best available version 7.1.6 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-ggr8-5vv4-36mx"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"diff","major":"1","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable diff 1.x version carries an identical vulnerability set; staying on the best available version 1.4.0 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-73rr-hh4g-fpgx"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"diff","major":"2","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable diff 2.x version carries an identical vulnerability set; staying on the best available version 2.2.3 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-73rr-hh4g-fpgx"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"diff","major":"3","tier":"cve_free","reason":"floored","floor_version":"3.5.1","rationale":"diff 3.x has a CVE-free floor at 3.5.1 clearing GHSA-73rr-hh4g-fpgx.","clearing_vulnerability_ids":["GHSA-73rr-hh4g-fpgx"],"residual_vulnerability_ids":[],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"diff","major":"4","tier":"cve_free","reason":"floored","floor_version":"4.0.4","rationale":"diff 4.x has a CVE-free floor at 4.0.4 clearing GHSA-73rr-hh4g-fpgx.","clearing_vulnerability_ids":["GHSA-73rr-hh4g-fpgx"],"residual_vulnerability_ids":[],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"diff","major":"5","tier":"cve_free","reason":"floored","floor_version":"5.2.2","rationale":"diff 5.x has a CVE-free floor at 5.2.2 clearing GHSA-73rr-hh4g-fpgx.","clearing_vulnerability_ids":["GHSA-73rr-hh4g-fpgx"],"residual_vulnerability_ids":[],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"diff","major":"6","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable diff 6.x version carries an identical vulnerability set; staying on the best available version 6.0.0 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-73rr-hh4g-fpgx"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"diff","major":"7","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable diff 7.x version carries an identical vulnerability set; staying on the best available version 7.0.0 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-73rr-hh4g-fpgx"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"diff","major":"8","tier":"cve_free","reason":"floored","floor_version":"8.0.3","rationale":"diff 8.x has a CVE-free floor at 8.0.3 clearing GHSA-73rr-hh4g-fpgx.","clearing_vulnerability_ids":["GHSA-73rr-hh4g-fpgx"],"residual_vulnerability_ids":[],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"extract-zip","major":"1","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable extract-zip 1.x version carries an identical vulnerability set; staying on the best available version 1.7.0 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-7pqw-9j4j-h8q3","GHSA-jmr9-qjv8-65gv"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"extract-zip","major":"2","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable extract-zip 2.x version carries an identical vulnerability set; keeping the locked version 2.0.1 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-7pqw-9j4j-h8q3","GHSA-jmr9-qjv8-65gv"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"follow-redirects","major":"0","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable follow-redirects 0.x version carries an identical vulnerability set; staying on the best available version 0.3.0 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-r4q5-vmmm-2653"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"follow-redirects","major":"1","tier":"cve_free","reason":"floored","floor_version":"1.16.0","rationale":"follow-redirects 1.x has a CVE-free floor at 1.16.0 clearing GHSA-r4q5-vmmm-2653.","clearing_vulnerability_ids":["GHSA-r4q5-vmmm-2653"],"residual_vulnerability_ids":[],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"glob","major":"1","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable glob 1.x version carries an identical vulnerability set; staying on the best available version 1.1.0 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-5j98-mcp5-4vw2"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"glob","major":"2","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable glob 2.x version carries an identical vulnerability set; staying on the best available version 2.1.0 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-5j98-mcp5-4vw2"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"glob","major":"3","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable glob 3.x version carries an identical vulnerability set; staying on the best available version 3.2.11 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-5j98-mcp5-4vw2"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"glob","major":"4","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable glob 4.x version carries an identical vulnerability set; staying on the best available version 4.5.3 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-5j98-mcp5-4vw2"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"glob","major":"5","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable glob 5.x version carries an identical vulnerability set; staying on the best available version 5.0.15 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-5j98-mcp5-4vw2"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"glob","major":"6","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable glob 6.x version carries an identical vulnerability set; staying on the best available version 6.0.4 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-5j98-mcp5-4vw2"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"glob","major":"7","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable glob 7.x version carries an identical vulnerability set; staying on the best available version 7.2.3 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-5j98-mcp5-4vw2"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"glob","major":"8","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable glob 8.x version carries an identical vulnerability set; staying on the best available version 8.1.0 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-5j98-mcp5-4vw2"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"glob","major":"9","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable glob 9.x version carries an identical vulnerability set; staying on the best available version 9.3.5 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-5j98-mcp5-4vw2"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"glob","major":"10","tier":"cve_free","reason":"floored","floor_version":"10.5.0","rationale":"glob 10.x has a CVE-free floor at 10.5.0 clearing GHSA-5j98-mcp5-4vw2.","clearing_vulnerability_ids":["GHSA-5j98-mcp5-4vw2"],"residual_vulnerability_ids":[],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"glob","major":"11","tier":"cve_free","reason":"floored","floor_version":"11.1.0","rationale":"glob 11.x has a CVE-free floor at 11.1.0 clearing GHSA-5j98-mcp5-4vw2.","clearing_vulnerability_ids":["GHSA-5j98-mcp5-4vw2"],"residual_vulnerability_ids":[],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"http-cache-semantics","major":"1","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable http-cache-semantics 1.x version carries an identical vulnerability set; staying on the best available version 1.0.0 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-ch52-4w7c-c8xp"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"http-cache-semantics","major":"2","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable http-cache-semantics 2.x version carries an identical vulnerability set; staying on the best available version 2.0.0 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-ch52-4w7c-c8xp"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"http-cache-semantics","major":"3","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable http-cache-semantics 3.x version carries an identical vulnerability set; staying on the best available version 3.8.1 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-ch52-4w7c-c8xp"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"http-cache-semantics","major":"4","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable http-cache-semantics 4.x version carries an identical vulnerability set; keeping the locked version 4.2.0 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-ch52-4w7c-c8xp"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"ip-address","major":"3","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable ip-address 3.x version carries an identical vulnerability set; staying on the best available version 3.2.1 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-h3mg-xc3c-68pw","GHSA-j6r3-76f7-8jcv","GHSA-mwp4-54f8-5fhr","GHSA-rpw4-54j3-4h4q","GHSA-v2v4-37r5-5v8g"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"ip-address","major":"4","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable ip-address 4.x version carries an identical vulnerability set; staying on the best available version 4.2.0 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-h3mg-xc3c-68pw","GHSA-j6r3-76f7-8jcv","GHSA-mwp4-54f8-5fhr","GHSA-rpw4-54j3-4h4q","GHSA-v2v4-37r5-5v8g"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"ip-address","major":"5","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable ip-address 5.x version carries an identical vulnerability set; staying on the best available version 5.9.4 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-h3mg-xc3c-68pw","GHSA-j6r3-76f7-8jcv","GHSA-mwp4-54f8-5fhr","GHSA-rpw4-54j3-4h4q","GHSA-v2v4-37r5-5v8g"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"ip-address","major":"6","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable ip-address 6.x version carries an identical vulnerability set; staying on the best available version 6.4.0 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-h3mg-xc3c-68pw","GHSA-j6r3-76f7-8jcv","GHSA-mwp4-54f8-5fhr","GHSA-rpw4-54j3-4h4q","GHSA-v2v4-37r5-5v8g"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"ip-address","major":"7","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable ip-address 7.x version carries an identical vulnerability set; staying on the best available version 7.1.0 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-h3mg-xc3c-68pw","GHSA-j6r3-76f7-8jcv","GHSA-mwp4-54f8-5fhr","GHSA-rpw4-54j3-4h4q","GHSA-v2v4-37r5-5v8g"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"ip-address","major":"8","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable ip-address 8.x version carries an identical vulnerability set; staying on the best available version 8.1.0 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-h3mg-xc3c-68pw","GHSA-j6r3-76f7-8jcv","GHSA-mwp4-54f8-5fhr","GHSA-rpw4-54j3-4h4q","GHSA-v2v4-37r5-5v8g"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"ip-address","major":"9","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable ip-address 9.x version carries an identical vulnerability set; keeping the locked version 9.0.5 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-h3mg-xc3c-68pw","GHSA-j6r3-76f7-8jcv","GHSA-mwp4-54f8-5fhr","GHSA-rpw4-54j3-4h4q","GHSA-v2v4-37r5-5v8g"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"ip-address","major":"10","tier":"cve_free","reason":"floored","floor_version":"10.7.1","rationale":"ip-address 10.x has a CVE-free floor at 10.7.1 clearing GHSA-h3mg-xc3c-68pw, GHSA-j6r3-76f7-8jcv, GHSA-mwp4-54f8-5fhr, GHSA-rpw4-54j3-4h4q, GHSA-v2v4-37r5-5v8g.","clearing_vulnerability_ids":["GHSA-h3mg-xc3c-68pw","GHSA-j6r3-76f7-8jcv","GHSA-mwp4-54f8-5fhr","GHSA-rpw4-54j3-4h4q","GHSA-v2v4-37r5-5v8g"],"residual_vulnerability_ids":[],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"js-yaml","major":"0","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable js-yaml 0.x version carries an identical vulnerability set; staying on the best available version 0.3.7 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-2883-xcg3-v3hh","GHSA-52cp-r559-cp3m","GHSA-5p4m-2wfm-xmqj","GHSA-h67p-54hq-rp68","GHSA-mh29-5h37-fv8m"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"js-yaml","major":"1","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable js-yaml 1.x version carries an identical vulnerability set; staying on the best available version 1.0.3 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-2883-xcg3-v3hh","GHSA-52cp-r559-cp3m","GHSA-5p4m-2wfm-xmqj","GHSA-h67p-54hq-rp68","GHSA-mh29-5h37-fv8m"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"js-yaml","major":"2","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable js-yaml 2.x version carries an identical vulnerability set; staying on the best available version 2.1.3 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-2883-xcg3-v3hh","GHSA-52cp-r559-cp3m","GHSA-5p4m-2wfm-xmqj","GHSA-h67p-54hq-rp68","GHSA-mh29-5h37-fv8m"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"js-yaml","major":"3","tier":"cve_free","reason":"floored","floor_version":"3.15.2","rationale":"js-yaml 3.x has a CVE-free floor at 3.15.2 clearing GHSA-2883-xcg3-v3hh, GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj, GHSA-h67p-54hq-rp68, GHSA-mh29-5h37-fv8m.","clearing_vulnerability_ids":["GHSA-2883-xcg3-v3hh","GHSA-52cp-r559-cp3m","GHSA-5p4m-2wfm-xmqj","GHSA-h67p-54hq-rp68","GHSA-mh29-5h37-fv8m"],"residual_vulnerability_ids":[],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"js-yaml","major":"4","tier":"cve_free","reason":"floored","floor_version":"4.3.2","rationale":"js-yaml 4.x has a CVE-free floor at 4.3.2 clearing GHSA-2883-xcg3-v3hh, GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj, GHSA-h67p-54hq-rp68, GHSA-mh29-5h37-fv8m.","clearing_vulnerability_ids":["GHSA-2883-xcg3-v3hh","GHSA-52cp-r559-cp3m","GHSA-5p4m-2wfm-xmqj","GHSA-h67p-54hq-rp68","GHSA-mh29-5h37-fv8m"],"residual_vulnerability_ids":[],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"lodash","major":"0","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable lodash 0.x version carries an identical vulnerability set; staying on the best available version 0.10.0 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-f23m-r3pf-42rh","GHSA-r5fr-rjxr-66jc","GHSA-xxjr-mmjv-4gpg"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"lodash","major":"1","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable lodash 1.x version carries an identical vulnerability set; staying on the best available version 1.3.1 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-f23m-r3pf-42rh","GHSA-r5fr-rjxr-66jc","GHSA-xxjr-mmjv-4gpg"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"lodash","major":"2","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable lodash 2.x version carries an identical vulnerability set; staying on the best available version 2.4.2 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-f23m-r3pf-42rh","GHSA-r5fr-rjxr-66jc","GHSA-xxjr-mmjv-4gpg"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"lodash","major":"3","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable lodash 3.x version carries an identical vulnerability set; staying on the best available version 3.10.1 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-f23m-r3pf-42rh","GHSA-r5fr-rjxr-66jc","GHSA-xxjr-mmjv-4gpg"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"lodash","major":"4","tier":"cve_free","reason":"floored","floor_version":"4.18.0","rationale":"lodash 4.x has a CVE-free floor at 4.18.0 clearing GHSA-f23m-r3pf-42rh, GHSA-r5fr-rjxr-66jc, GHSA-xxjr-mmjv-4gpg.","clearing_vulnerability_ids":["GHSA-f23m-r3pf-42rh","GHSA-r5fr-rjxr-66jc","GHSA-xxjr-mmjv-4gpg"],"residual_vulnerability_ids":[],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"minimatch","major":"0","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable minimatch 0.x version carries an identical vulnerability set; staying on the best available version 0.4.0 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-23c5-xmqv-rm74","GHSA-3ppc-4f35-3m26","GHSA-7r86-cg39-jmmj"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"minimatch","major":"1","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable minimatch 1.x version carries an identical vulnerability set; staying on the best available version 1.0.0 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-23c5-xmqv-rm74","GHSA-3ppc-4f35-3m26","GHSA-7r86-cg39-jmmj"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"minimatch","major":"2","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable minimatch 2.x version carries an identical vulnerability set; staying on the best available version 2.0.10 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-23c5-xmqv-rm74","GHSA-3ppc-4f35-3m26","GHSA-7r86-cg39-jmmj"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"minimatch","major":"3","tier":"cve_free","reason":"floored","floor_version":"3.1.4","rationale":"minimatch 3.x has a CVE-free floor at 3.1.4 clearing GHSA-23c5-xmqv-rm74, GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj.","clearing_vulnerability_ids":["GHSA-23c5-xmqv-rm74","GHSA-3ppc-4f35-3m26","GHSA-7r86-cg39-jmmj"],"residual_vulnerability_ids":[],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"minimatch","major":"4","tier":"cve_free","reason":"floored","floor_version":"4.2.5","rationale":"minimatch 4.x has a CVE-free floor at 4.2.5 clearing GHSA-23c5-xmqv-rm74, GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj.","clearing_vulnerability_ids":["GHSA-23c5-xmqv-rm74","GHSA-3ppc-4f35-3m26","GHSA-7r86-cg39-jmmj"],"residual_vulnerability_ids":[],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"minimatch","major":"5","tier":"cve_free","reason":"floored","floor_version":"5.1.8","rationale":"minimatch 5.x has a CVE-free floor at 5.1.8 clearing GHSA-23c5-xmqv-rm74, GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj.","clearing_vulnerability_ids":["GHSA-23c5-xmqv-rm74","GHSA-3ppc-4f35-3m26","GHSA-7r86-cg39-jmmj"],"residual_vulnerability_ids":[],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"minimatch","major":"6","tier":"cve_free","reason":"floored","floor_version":"6.2.2","rationale":"minimatch 6.x has a CVE-free floor at 6.2.2 clearing GHSA-23c5-xmqv-rm74, GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj.","clearing_vulnerability_ids":["GHSA-23c5-xmqv-rm74","GHSA-3ppc-4f35-3m26","GHSA-7r86-cg39-jmmj"],"residual_vulnerability_ids":[],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"minimatch","major":"7","tier":"cve_free","reason":"floored","floor_version":"7.4.8","rationale":"minimatch 7.x has a CVE-free floor at 7.4.8 clearing GHSA-23c5-xmqv-rm74, GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj.","clearing_vulnerability_ids":["GHSA-23c5-xmqv-rm74","GHSA-3ppc-4f35-3m26","GHSA-7r86-cg39-jmmj"],"residual_vulnerability_ids":[],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"minimatch","major":"8","tier":"cve_free","reason":"floored","floor_version":"8.0.6","rationale":"minimatch 8.x has a CVE-free floor at 8.0.6 clearing GHSA-23c5-xmqv-rm74, GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj.","clearing_vulnerability_ids":["GHSA-23c5-xmqv-rm74","GHSA-3ppc-4f35-3m26","GHSA-7r86-cg39-jmmj"],"residual_vulnerability_ids":[],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"minimatch","major":"9","tier":"cve_free","reason":"floored","floor_version":"9.0.7","rationale":"minimatch 9.x has a CVE-free floor at 9.0.7 clearing GHSA-23c5-xmqv-rm74, GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj.","clearing_vulnerability_ids":["GHSA-23c5-xmqv-rm74","GHSA-3ppc-4f35-3m26","GHSA-7r86-cg39-jmmj"],"residual_vulnerability_ids":[],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"minimatch","major":"10","tier":"cve_free","reason":"floored","floor_version":"10.2.3","rationale":"minimatch 10.x has a CVE-free floor at 10.2.3 clearing GHSA-23c5-xmqv-rm74, GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj.","clearing_vulnerability_ids":["GHSA-23c5-xmqv-rm74","GHSA-3ppc-4f35-3m26","GHSA-7r86-cg39-jmmj"],"residual_vulnerability_ids":[],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"node-forge","major":"0","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable node-forge 0.x version carries an identical vulnerability set; staying on the best available version 0.10.0 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-2328-f5f3-gj25","GHSA-554w-wpv2-vw27","GHSA-5gfm-wpxj-wjgq","GHSA-5m6q-g25r-mvwx","GHSA-65ch-62r8-g69g","GHSA-86w9-cpqp-85rv","GHSA-ppp5-5v6c-4jwp","GHSA-q67f-28xg-22rw"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"node-forge","major":"1","tier":"least_bad","reason":"no_fixed_version_line","floor_version":null,"rationale":"no CVE-free node-forge version exists; ranked by KEV, then max severity, then EPSS sum (M7). Residual exposure: GHSA-2328-f5f3-gj25, GHSA-554w-wpv2-vw27, GHSA-5gfm-wpxj-wjgq, GHSA-5m6q-g25r-mvwx, GHSA-65ch-62r8-g69g, GHSA-86w9-cpqp-85rv, GHSA-ppp5-5v6c-4jwp, GHSA-q67f-28xg-22rw. The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-2328-f5f3-gj25","GHSA-554w-wpv2-vw27","GHSA-5gfm-wpxj-wjgq","GHSA-5m6q-g25r-mvwx","GHSA-65ch-62r8-g69g","GHSA-86w9-cpqp-85rv","GHSA-ppp5-5v6c-4jwp","GHSA-q67f-28xg-22rw"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"parseuri","major":"0","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable parseuri 0.x version carries an identical vulnerability set; keeping the locked version 0.0.6 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-6fx8-h7jm-663j"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"parseuri","major":"3","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable parseuri 3.x version carries an identical vulnerability set; staying on the best available version 3.0.2 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-6fx8-h7jm-663j"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"path-to-regexp","major":"0","tier":"cve_free","reason":"floored","floor_version":"0.1.13","rationale":"path-to-regexp 0.x has a CVE-free floor at 0.1.13 clearing GHSA-37ch-88jc-xwx2.","clearing_vulnerability_ids":["GHSA-37ch-88jc-xwx2"],"residual_vulnerability_ids":[],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"picomatch","major":"1","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable picomatch 1.x version carries an identical vulnerability set; staying on the best available version 1.2.0 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-3v7f-55p6-f55p","GHSA-c2c7-rcm5-vvqj"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"picomatch","major":"2","tier":"cve_free","reason":"floored","floor_version":"2.3.2","rationale":"picomatch 2.x has a CVE-free floor at 2.3.2 clearing GHSA-3v7f-55p6-f55p, GHSA-c2c7-rcm5-vvqj.","clearing_vulnerability_ids":["GHSA-3v7f-55p6-f55p","GHSA-c2c7-rcm5-vvqj"],"residual_vulnerability_ids":[],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"picomatch","major":"3","tier":"cve_free","reason":"floored","floor_version":"3.0.2","rationale":"picomatch 3.x has a CVE-free floor at 3.0.2 clearing GHSA-3v7f-55p6-f55p, GHSA-c2c7-rcm5-vvqj.","clearing_vulnerability_ids":["GHSA-3v7f-55p6-f55p","GHSA-c2c7-rcm5-vvqj"],"residual_vulnerability_ids":[],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"picomatch","major":"4","tier":"cve_free","reason":"floored","floor_version":"4.0.4","rationale":"picomatch 4.x has a CVE-free floor at 4.0.4 clearing GHSA-3v7f-55p6-f55p, GHSA-c2c7-rcm5-vvqj.","clearing_vulnerability_ids":["GHSA-3v7f-55p6-f55p","GHSA-c2c7-rcm5-vvqj"],"residual_vulnerability_ids":[],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"proxy-addr","major":"0","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable proxy-addr 0.x version carries an identical vulnerability set; staying on the best available version 0.0.1 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-jqcg-44mw-7w3h"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"proxy-addr","major":"1","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable proxy-addr 1.x version carries an identical vulnerability set; staying on the best available version 1.1.5 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-jqcg-44mw-7w3h"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"proxy-addr","major":"2","tier":"cve_free","reason":"floored","floor_version":"2.0.8","rationale":"proxy-addr 2.x has a CVE-free floor at 2.0.8 clearing GHSA-jqcg-44mw-7w3h.","clearing_vulnerability_ids":["GHSA-jqcg-44mw-7w3h"],"residual_vulnerability_ids":[],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"qs","major":"0","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable qs 0.x version carries an identical vulnerability set; staying on the best available version 0.6.6 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-4mjr-xmp4-gh2g","GHSA-6rw7-vpxm-498p","GHSA-q8mj-m7cp-5q26","GHSA-w7fw-mjwx-w883"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"qs","major":"1","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable qs 1.x version carries an identical vulnerability set; staying on the best available version 1.2.2 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-4mjr-xmp4-gh2g","GHSA-6rw7-vpxm-498p","GHSA-q8mj-m7cp-5q26","GHSA-w7fw-mjwx-w883"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"qs","major":"2","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable qs 2.x version carries an identical vulnerability set; staying on the best available version 2.4.2 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-4mjr-xmp4-gh2g","GHSA-6rw7-vpxm-498p","GHSA-q8mj-m7cp-5q26","GHSA-w7fw-mjwx-w883"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"qs","major":"3","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable qs 3.x version carries an identical vulnerability set; staying on the best available version 3.1.0 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-4mjr-xmp4-gh2g","GHSA-6rw7-vpxm-498p","GHSA-q8mj-m7cp-5q26","GHSA-w7fw-mjwx-w883"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"qs","major":"4","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable qs 4.x version carries an identical vulnerability set; staying on the best available version 4.0.0 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-4mjr-xmp4-gh2g","GHSA-6rw7-vpxm-498p","GHSA-q8mj-m7cp-5q26","GHSA-w7fw-mjwx-w883"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"qs","major":"5","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable qs 5.x version carries an identical vulnerability set; staying on the best available version 5.2.1 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-4mjr-xmp4-gh2g","GHSA-6rw7-vpxm-498p","GHSA-q8mj-m7cp-5q26","GHSA-w7fw-mjwx-w883"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"qs","major":"6","tier":"cve_free","reason":"floored","floor_version":"6.16.0","rationale":"qs 6.x has a CVE-free floor at 6.16.0 clearing GHSA-4mjr-xmp4-gh2g, GHSA-6rw7-vpxm-498p, GHSA-q8mj-m7cp-5q26, GHSA-w7fw-mjwx-w883.","clearing_vulnerability_ids":["GHSA-4mjr-xmp4-gh2g","GHSA-6rw7-vpxm-498p","GHSA-q8mj-m7cp-5q26","GHSA-w7fw-mjwx-w883"],"residual_vulnerability_ids":[],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"rollup","major":"0","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable rollup 0.x version carries an identical vulnerability set; staying on the best available version 0.68.2 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-mw96-cpmx-2vgc"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"rollup","major":"1","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable rollup 1.x version carries an identical vulnerability set; staying on the best available version 1.32.1 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-mw96-cpmx-2vgc"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"rollup","major":"2","tier":"cve_free","reason":"floored","floor_version":"2.80.0","rationale":"rollup 2.x has a CVE-free floor at 2.80.0 clearing GHSA-mw96-cpmx-2vgc.","clearing_vulnerability_ids":["GHSA-mw96-cpmx-2vgc"],"residual_vulnerability_ids":[],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"rollup","major":"3","tier":"cve_free","reason":"floored","floor_version":"3.30.0","rationale":"rollup 3.x has a CVE-free floor at 3.30.0 clearing GHSA-mw96-cpmx-2vgc.","clearing_vulnerability_ids":["GHSA-mw96-cpmx-2vgc"],"residual_vulnerability_ids":[],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"rollup","major":"4","tier":"cve_free","reason":"floored","floor_version":"4.59.0","rationale":"rollup 4.x has a CVE-free floor at 4.59.0 clearing GHSA-mw96-cpmx-2vgc.","clearing_vulnerability_ids":["GHSA-mw96-cpmx-2vgc"],"residual_vulnerability_ids":[],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"serialize-javascript","major":"1","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable serialize-javascript 1.x version carries an identical vulnerability set; staying on the best available version 1.9.1 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-5c6j-r48x-rmvq","GHSA-qj8w-gfj5-8c6v"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"serialize-javascript","major":"2","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable serialize-javascript 2.x version carries an identical vulnerability set; staying on the best available version 2.1.2 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-5c6j-r48x-rmvq","GHSA-qj8w-gfj5-8c6v"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"serialize-javascript","major":"3","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable serialize-javascript 3.x version carries an identical vulnerability set; staying on the best available version 3.1.0 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-5c6j-r48x-rmvq","GHSA-qj8w-gfj5-8c6v"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"serialize-javascript","major":"4","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable serialize-javascript 4.x version carries an identical vulnerability set; staying on the best available version 4.0.0 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-5c6j-r48x-rmvq","GHSA-qj8w-gfj5-8c6v"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"serialize-javascript","major":"5","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable serialize-javascript 5.x version carries an identical vulnerability set; staying on the best available version 5.0.1 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-5c6j-r48x-rmvq","GHSA-qj8w-gfj5-8c6v"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"serialize-javascript","major":"6","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable serialize-javascript 6.x version carries an identical vulnerability set; keeping the locked version 6.0.2 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-5c6j-r48x-rmvq","GHSA-qj8w-gfj5-8c6v"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"serialize-javascript","major":"7","tier":"cve_free","reason":"floored","floor_version":"7.0.5","rationale":"serialize-javascript 7.x has a CVE-free floor at 7.0.5 clearing GHSA-5c6j-r48x-rmvq, GHSA-qj8w-gfj5-8c6v.","clearing_vulnerability_ids":["GHSA-5c6j-r48x-rmvq","GHSA-qj8w-gfj5-8c6v"],"residual_vulnerability_ids":[],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"socket.io-parser","major":"1","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable socket.io-parser 1.x version carries an identical vulnerability set; staying on the best available version 1.1.2 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-2m8v-j782-fhvr","GHSA-677m-j7p3-52f9"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"socket.io-parser","major":"2","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable socket.io-parser 2.x version carries an identical vulnerability set; staying on the best available version 2.3.2 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-2m8v-j782-fhvr","GHSA-677m-j7p3-52f9"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"socket.io-parser","major":"3","tier":"cve_free","reason":"floored","floor_version":"3.3.6","rationale":"socket.io-parser 3.x has a CVE-free floor at 3.3.6 clearing GHSA-2m8v-j782-fhvr, GHSA-677m-j7p3-52f9.","clearing_vulnerability_ids":["GHSA-2m8v-j782-fhvr","GHSA-677m-j7p3-52f9"],"residual_vulnerability_ids":[],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"socket.io-parser","major":"4","tier":"cve_free","reason":"floored","floor_version":"4.2.7","rationale":"socket.io-parser 4.x has a CVE-free floor at 4.2.7 clearing GHSA-2m8v-j782-fhvr, GHSA-677m-j7p3-52f9.","clearing_vulnerability_ids":["GHSA-2m8v-j782-fhvr","GHSA-677m-j7p3-52f9"],"residual_vulnerability_ids":[],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"sprintf-js","major":"0","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable sprintf-js 0.x version carries an identical vulnerability set; staying on the best available version 0.0.7 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-hp3w-g68c-fv3c"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"sprintf-js","major":"1","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable sprintf-js 1.x version carries an identical vulnerability set; keeping the locked version 1.0.3 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-hp3w-g68c-fv3c"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"tar","major":"0","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable tar 0.x version carries an identical vulnerability set; staying on the best available version 0.1.20 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-23hp-3jrh-7fpw","GHSA-34x7-hfp2-rc4v","GHSA-83g3-92jg-28cx","GHSA-8qq5-rm4j-mr97","GHSA-8x88-c5mf-7j5w","GHSA-9ppj-qmqm-q256","GHSA-gvwx-54wh-qm9j","GHSA-qffp-2rhf-9h96","GHSA-r292-9mhp-454m","GHSA-r6q2-hw4h-h46w","GHSA-vmf3-w455-68vh","GHSA-w8wr-v893-vjvp"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"tar","major":"1","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable tar 1.x version carries an identical vulnerability set; staying on the best available version 1.0.3 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-23hp-3jrh-7fpw","GHSA-34x7-hfp2-rc4v","GHSA-83g3-92jg-28cx","GHSA-8qq5-rm4j-mr97","GHSA-8x88-c5mf-7j5w","GHSA-9ppj-qmqm-q256","GHSA-gvwx-54wh-qm9j","GHSA-qffp-2rhf-9h96","GHSA-r292-9mhp-454m","GHSA-r6q2-hw4h-h46w","GHSA-vmf3-w455-68vh","GHSA-w8wr-v893-vjvp"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"tar","major":"2","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable tar 2.x version carries an identical vulnerability set; staying on the best available version 2.2.2 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-23hp-3jrh-7fpw","GHSA-34x7-hfp2-rc4v","GHSA-83g3-92jg-28cx","GHSA-8qq5-rm4j-mr97","GHSA-8x88-c5mf-7j5w","GHSA-9ppj-qmqm-q256","GHSA-gvwx-54wh-qm9j","GHSA-qffp-2rhf-9h96","GHSA-r292-9mhp-454m","GHSA-r6q2-hw4h-h46w","GHSA-vmf3-w455-68vh","GHSA-w8wr-v893-vjvp"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"tar","major":"3","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable tar 3.x version carries an identical vulnerability set; staying on the best available version 3.2.3 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-23hp-3jrh-7fpw","GHSA-34x7-hfp2-rc4v","GHSA-83g3-92jg-28cx","GHSA-8qq5-rm4j-mr97","GHSA-8x88-c5mf-7j5w","GHSA-9ppj-qmqm-q256","GHSA-gvwx-54wh-qm9j","GHSA-qffp-2rhf-9h96","GHSA-r292-9mhp-454m","GHSA-r6q2-hw4h-h46w","GHSA-vmf3-w455-68vh","GHSA-w8wr-v893-vjvp"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"tar","major":"4","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable tar 4.x version carries an identical vulnerability set; staying on the best available version 4.4.19 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-23hp-3jrh-7fpw","GHSA-34x7-hfp2-rc4v","GHSA-83g3-92jg-28cx","GHSA-8qq5-rm4j-mr97","GHSA-8x88-c5mf-7j5w","GHSA-9ppj-qmqm-q256","GHSA-gvwx-54wh-qm9j","GHSA-qffp-2rhf-9h96","GHSA-r292-9mhp-454m","GHSA-r6q2-hw4h-h46w","GHSA-vmf3-w455-68vh","GHSA-w8wr-v893-vjvp"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"tar","major":"5","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable tar 5.x version carries an identical vulnerability set; staying on the best available version 5.0.11 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-23hp-3jrh-7fpw","GHSA-34x7-hfp2-rc4v","GHSA-83g3-92jg-28cx","GHSA-8qq5-rm4j-mr97","GHSA-8x88-c5mf-7j5w","GHSA-9ppj-qmqm-q256","GHSA-gvwx-54wh-qm9j","GHSA-qffp-2rhf-9h96","GHSA-r292-9mhp-454m","GHSA-r6q2-hw4h-h46w","GHSA-vmf3-w455-68vh","GHSA-w8wr-v893-vjvp"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"tar","major":"6","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable tar 6.x version carries an identical vulnerability set; keeping the locked version 6.2.1 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-23hp-3jrh-7fpw","GHSA-34x7-hfp2-rc4v","GHSA-83g3-92jg-28cx","GHSA-8qq5-rm4j-mr97","GHSA-8x88-c5mf-7j5w","GHSA-9ppj-qmqm-q256","GHSA-gvwx-54wh-qm9j","GHSA-qffp-2rhf-9h96","GHSA-r292-9mhp-454m","GHSA-r6q2-hw4h-h46w","GHSA-vmf3-w455-68vh","GHSA-w8wr-v893-vjvp"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"tar","major":"7","tier":"cve_free","reason":"floored","floor_version":"7.5.21","rationale":"tar 7.x has a CVE-free floor at 7.5.21 clearing GHSA-23hp-3jrh-7fpw, GHSA-34x7-hfp2-rc4v, GHSA-83g3-92jg-28cx, GHSA-8qq5-rm4j-mr97, GHSA-8x88-c5mf-7j5w, GHSA-9ppj-qmqm-q256, GHSA-gvwx-54wh-qm9j, GHSA-qffp-2rhf-9h96, GHSA-r292-9mhp-454m, GHSA-r6q2-hw4h-h46w, GHSA-vmf3-w455-68vh, GHSA-w8wr-v893-vjvp.","clearing_vulnerability_ids":["GHSA-23hp-3jrh-7fpw","GHSA-34x7-hfp2-rc4v","GHSA-83g3-92jg-28cx","GHSA-8qq5-rm4j-mr97","GHSA-8x88-c5mf-7j5w","GHSA-9ppj-qmqm-q256","GHSA-gvwx-54wh-qm9j","GHSA-qffp-2rhf-9h96","GHSA-r292-9mhp-454m","GHSA-r6q2-hw4h-h46w","GHSA-vmf3-w455-68vh","GHSA-w8wr-v893-vjvp"],"residual_vulnerability_ids":[],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"tar-fs","major":"0","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable tar-fs 0.x version carries an identical vulnerability set; staying on the best available version 0.5.2 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-8cj5-5rvv-wf4v","GHSA-pq67-2wwv-3xjx","GHSA-vj76-c3g6-qr5v"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"tar-fs","major":"1","tier":"cve_free","reason":"floored","floor_version":"1.16.6","rationale":"tar-fs 1.x has a CVE-free floor at 1.16.6 clearing GHSA-8cj5-5rvv-wf4v, GHSA-pq67-2wwv-3xjx, GHSA-vj76-c3g6-qr5v.","clearing_vulnerability_ids":["GHSA-8cj5-5rvv-wf4v","GHSA-pq67-2wwv-3xjx","GHSA-vj76-c3g6-qr5v"],"residual_vulnerability_ids":[],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"tar-fs","major":"2","tier":"cve_free","reason":"floored","floor_version":"2.1.4","rationale":"tar-fs 2.x has a CVE-free floor at 2.1.4 clearing GHSA-8cj5-5rvv-wf4v, GHSA-pq67-2wwv-3xjx, GHSA-vj76-c3g6-qr5v.","clearing_vulnerability_ids":["GHSA-8cj5-5rvv-wf4v","GHSA-pq67-2wwv-3xjx","GHSA-vj76-c3g6-qr5v"],"residual_vulnerability_ids":[],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"tar-fs","major":"3","tier":"cve_free","reason":"floored","floor_version":"3.1.1","rationale":"tar-fs 3.x has a CVE-free floor at 3.1.1 clearing GHSA-8cj5-5rvv-wf4v, GHSA-pq67-2wwv-3xjx, GHSA-vj76-c3g6-qr5v.","clearing_vulnerability_ids":["GHSA-8cj5-5rvv-wf4v","GHSA-pq67-2wwv-3xjx","GHSA-vj76-c3g6-qr5v"],"residual_vulnerability_ids":[],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"uuid","major":"0","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable uuid 0.x version carries an identical vulnerability set; staying on the best available version 0.0.2 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-w5hq-g745-h8pq"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"uuid","major":"1","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable uuid 1.x version carries an identical vulnerability set; staying on the best available version 1.4.2 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-w5hq-g745-h8pq"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"uuid","major":"2","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable uuid 2.x version carries an identical vulnerability set; staying on the best available version 2.0.3 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-w5hq-g745-h8pq"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"uuid","major":"3","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable uuid 3.x version carries an identical vulnerability set; staying on the best available version 3.4.0 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-w5hq-g745-h8pq"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"uuid","major":"7","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable uuid 7.x version carries an identical vulnerability set; staying on the best available version 7.0.3 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-w5hq-g745-h8pq"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"uuid","major":"8","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable uuid 8.x version carries an identical vulnerability set; keeping the locked version 8.3.2 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-w5hq-g745-h8pq"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"uuid","major":"9","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable uuid 9.x version carries an identical vulnerability set; staying on the best available version 9.0.1 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-w5hq-g745-h8pq"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"uuid","major":"10","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable uuid 10.x version carries an identical vulnerability set; staying on the best available version 10.0.0 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-w5hq-g745-h8pq"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"uuid","major":"11","tier":"cve_free","reason":"floored","floor_version":"11.1.1","rationale":"uuid 11.x has a CVE-free floor at 11.1.1 clearing GHSA-w5hq-g745-h8pq.","clearing_vulnerability_ids":["GHSA-w5hq-g745-h8pq"],"residual_vulnerability_ids":[],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"uuid","major":"12","tier":"cve_free","reason":"floored","floor_version":"12.0.1","rationale":"uuid 12.x has a CVE-free floor at 12.0.1 clearing GHSA-w5hq-g745-h8pq.","clearing_vulnerability_ids":["GHSA-w5hq-g745-h8pq"],"residual_vulnerability_ids":[],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"uuid","major":"13","tier":"cve_free","reason":"floored","floor_version":"13.0.1","rationale":"uuid 13.x has a CVE-free floor at 13.0.1 clearing GHSA-w5hq-g745-h8pq.","clearing_vulnerability_ids":["GHSA-w5hq-g745-h8pq"],"residual_vulnerability_ids":[],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"webpack","major":"0","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable webpack 0.x version carries an identical vulnerability set; staying on the best available version 0.11.18 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-38r7-794h-5758","GHSA-8fgc-7cc6-rx7x"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"webpack","major":"1","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable webpack 1.x version carries an identical vulnerability set; staying on the best available version 1.15.0 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-38r7-794h-5758","GHSA-8fgc-7cc6-rx7x"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"webpack","major":"2","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable webpack 2.x version carries an identical vulnerability set; staying on the best available version 2.7.0 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-38r7-794h-5758","GHSA-8fgc-7cc6-rx7x"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"webpack","major":"3","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable webpack 3.x version carries an identical vulnerability set; staying on the best available version 3.12.0 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-38r7-794h-5758","GHSA-8fgc-7cc6-rx7x"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"webpack","major":"4","tier":"no_discrimination","reason":"no_fixed_version_line","floor_version":null,"rationale":"every viable webpack 4.x version carries an identical vulnerability set; staying on the best available version 4.47.0 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","clearing_vulnerability_ids":[],"residual_vulnerability_ids":["GHSA-38r7-794h-5758","GHSA-8fgc-7cc6-rx7x"],"cooldown_withheld":null},{"event":"major_line_floor_applied","package_name":"webpack","major":"5","tier":"cve_free","reason":"floored","floor_version":"5.104.1","rationale":"webpack 5.x has a CVE-free floor at 5.104.1 clearing GHSA-38r7-794h-5758, GHSA-8fgc-7cc6-rx7x.","clearing_vulnerability_ids":["GHSA-38r7-794h-5758","GHSA-8fgc-7cc6-rx7x"],"residual_vulnerability_ids":[],"cooldown_withheld":null},{"event":"view_readmission","package_name":"braces","version":"3.0.3","rationale":"the strict view serves no version of braces without a known vulnerability, so the version already locked (3.0.3) stays available and the exposure is reported rather than the package removed; the view this run resolves against has to keep serving that version for the unit to re-lock at all"},{"event":"view_readmission","package_name":"deepmerge-ts","version":"5.1.0","rationale":"the strict view serves no version of deepmerge-ts without a known vulnerability, so the version already locked (5.1.0, 8.0.2) stays available and the exposure is reported rather than the package removed; the view this run resolves against has to keep serving that version for the unit to re-lock at all"},{"event":"view_readmission","package_name":"deepmerge-ts","version":"8.0.2","rationale":"the strict view serves no version of deepmerge-ts without a known vulnerability, so the version already locked (5.1.0, 8.0.2) stays available and the exposure is reported rather than the package removed; the view this run resolves against has to keep serving that version for the unit to re-lock at all"},{"event":"view_readmission","package_name":"extract-zip","version":"2.0.1","rationale":"the strict view serves no version of extract-zip without a known vulnerability, so the version already locked (2.0.1) stays available and the exposure is reported rather than the package removed; the view this run resolves against has to keep serving that version for the unit to re-lock at all"},{"event":"view_readmission","package_name":"http-cache-semantics","version":"4.2.0","rationale":"the strict view serves no version of http-cache-semantics without a known vulnerability, so the version already locked (4.2.0) stays available and the exposure is reported rather than the package removed; the view this run resolves against has to keep serving that version for the unit to re-lock at all"},{"event":"view_readmission","package_name":"node-forge","version":"1.3.1","rationale":"the strict view serves no version of node-forge without a known vulnerability, so the version already locked (1.3.1) stays available and the exposure is reported rather than the package removed; the view this run resolves against has to keep serving that version for the unit to re-lock at all"},{"event":"view_readmission","package_name":"parseuri","version":"0.0.6","rationale":"the strict view serves no version of parseuri without a known vulnerability, so the version already locked (0.0.6) stays available and the exposure is reported rather than the package removed; the view this run resolves against has to keep serving that version for the unit to re-lock at all"},{"event":"view_readmission","package_name":"sprintf-js","version":"1.0.3","rationale":"the strict view serves no version of sprintf-js without a known vulnerability, so the version already locked (1.0.3, 1.1.3) stays available and the exposure is reported rather than the package removed; the view this run resolves against has to keep serving that version for the unit to re-lock at all"},{"event":"view_readmission","package_name":"sprintf-js","version":"1.1.3","rationale":"the strict view serves no version of sprintf-js without a known vulnerability, so the version already locked (1.0.3, 1.1.3) stays available and the exposure is reported rather than the package removed; the view this run resolves against has to keep serving that version for the unit to re-lock at all"},{"event":"admittance_tool_resolved","node_version":"v24.21.0","semver_version":"7.8.4","module_path":"/app/node_modules/semver"},{"event":"admittance_edge","package_name":"@babel/core","locked_version":"7.24.7","parent_name":"","parent_version":"","declared_range":"^7.24.7","status":"reachable","admitting_versions":["7.29.6","7.29.7"],"detail":"the range admits 2 version(s) the view serves"},{"event":"admittance_edge","package_name":"@babel/core","locked_version":"7.24.7","parent_name":"istanbul-lib-instrument","parent_version":"6.0.3","declared_range":"^7.23.9","status":"reachable","admitting_versions":["7.29.6","7.29.7"],"detail":"the range admits 2 version(s) the view serves"},{"event":"admittance_edge","package_name":"@babel/plugin-transform-modules-systemjs","locked_version":"7.24.7","parent_name":"@babel/preset-env","parent_version":"7.24.7","declared_range":"^7.24.7","status":"reachable","admitting_versions":["7.29.4","7.29.7","7.29.8"],"detail":"the range admits 3 version(s) the view serves"},{"event":"admittance_edge","package_name":"ajv","locked_version":"8.16.0","parent_name":"ajv-formats","parent_version":"2.1.1","declared_range":"^8.0.0","status":"reachable","admitting_versions":["8.18.0","8.20.0"],"detail":"the range admits 2 version(s) the view serves"},{"event":"admittance_edge","package_name":"ajv","locked_version":"8.16.0","parent_name":"schema-utils","parent_version":"4.3.3","declared_range":"^8.9.0","status":"reachable","admitting_versions":["8.18.0","8.20.0"],"detail":"the range admits 2 version(s) the view serves"},{"event":"admittance_edge","package_name":"axios","locked_version":"1.12.2","parent_name":"cmake-js","parent_version":"7.3.0","declared_range":"^1.6.5","status":"reachable","admitting_versions":["1.20.0"],"detail":"the range admits 1 version(s) the view serves"},{"event":"admittance_edge","package_name":"baseline-browser-mapping","locked_version":"2.8.15","parent_name":"browserslist","parent_version":"4.26.3","declared_range":"^2.8.9","status":"reachable","admitting_versions":["2.11.0","2.11.1","2.11.3","2.11.4","2.11.5","2.11.6","2.11.7","2.11.8","2.11.9","2.11.10","2.11.11","2.11.12","2.11.13","2.11.14","2.11.15","2.11.16","2.11.17","2.11.18","2.11.19","2.11.20","2.11.21","2.11.22","2.11.23","2.11.24","2.11.25","2.11.26","2.11.27","2.11.28"],"detail":"the range admits 28 version(s) the view serves"},{"event":"admittance_edge","package_name":"basic-ftp","locked_version":"5.0.5","parent_name":"get-uri","parent_version":"6.0.3","declared_range":"^5.0.2","status":"capped","admitting_versions":[],"detail":"get-uri caps basic-ftp at ^5.0.2, which admits none of the 3 version(s) the strict view serves"},{"event":"admittance_edge","package_name":"body-parser","locked_version":"1.20.3","parent_name":"express","parent_version":"4.21.2","declared_range":"1.20.3","status":"capped","admitting_versions":[],"detail":"express caps body-parser at 1.20.3, which admits none of the 3 version(s) the strict view serves"},{"event":"admittance_edge","package_name":"brace-expansion","locked_version":"2.0.2","parent_name":"minimatch","parent_version":"9.0.5","declared_range":"^2.0.1","status":"reachable","admitting_versions":["2.1.7"],"detail":"the range admits 1 version(s) the view serves"},{"event":"admittance_edge","package_name":"brace-expansion","locked_version":"2.1.7","parent_name":"minimatch","parent_version":"9.0.9","declared_range":"^2.0.2","status":"reachable","admitting_versions":["2.1.7"],"detail":"the range admits 1 version(s) the view serves"},{"event":"admittance_edge","package_name":"brace-expansion","locked_version":"2.0.2","parent_name":"minimatch","parent_version":"9.0.5","declared_range":"^2.0.1","status":"reachable","admitting_versions":["2.1.7"],"detail":"the range admits 1 version(s) the view serves"},{"event":"admittance_edge","package_name":"brace-expansion","locked_version":"2.1.7","parent_name":"minimatch","parent_version":"9.0.9","declared_range":"^2.0.2","status":"reachable","admitting_versions":["2.1.7"],"detail":"the range admits 1 version(s) the view serves"},{"event":"admittance_edge","package_name":"brace-expansion","locked_version":"2.1.7","parent_name":"minimatch","parent_version":"9.0.9","declared_range":"^2.0.2","status":"reachable","admitting_versions":["2.1.7"],"detail":"the range admits 1 version(s) the view serves"},{"event":"admittance_edge","package_name":"brace-expansion","locked_version":"2.0.2","parent_name":"minimatch","parent_version":"9.0.5","declared_range":"^2.0.1","status":"reachable","admitting_versions":["2.1.7"],"detail":"the range admits 1 version(s) the view serves"},{"event":"admittance_edge","package_name":"brace-expansion","locked_version":"1.1.12","parent_name":"minimatch","parent_version":"3.1.2","declared_range":"^1.1.7","status":"reachable","admitting_versions":["1.1.21"],"detail":"the range admits 1 version(s) the view serves"},{"event":"admittance_edge","package_name":"brace-expansion","locked_version":"2.1.7","parent_name":"minimatch","parent_version":"5.1.9","declared_range":"^2.0.1","status":"reachable","admitting_versions":["2.1.7"],"detail":"the range admits 1 version(s) the view serves"},{"event":"admittance_edge","package_name":"brace-expansion","locked_version":"2.0.2","parent_name":"minimatch","parent_version":"5.1.6","declared_range":"^2.0.1","status":"reachable","admitting_versions":["2.1.7"],"detail":"the range admits 1 version(s) the view serves"},{"event":"admittance_edge","package_name":"brace-expansion","locked_version":"2.0.2","parent_name":"minimatch","parent_version":"5.1.6","declared_range":"^2.0.1","status":"reachable","admitting_versions":["2.1.7"],"detail":"the range admits 1 version(s) the view serves"},{"event":"admittance_edge","package_name":"brace-expansion","locked_version":"2.0.2","parent_name":"minimatch","parent_version":"10.0.1","declared_range":"^2.0.1","status":"reachable","admitting_versions":["2.1.7"],"detail":"the range admits 1 version(s) the view serves"},{"event":"admittance_edge","package_name":"brace-expansion","locked_version":"2.0.2","parent_name":"minimatch","parent_version":"9.0.5","declared_range":"^2.0.1","status":"reachable","admitting_versions":["2.1.7"],"detail":"the range admits 1 version(s) the view serves"},{"event":"admittance_edge","package_name":"browserslist","locked_version":"4.26.3","parent_name":"@babel/helper-compilation-targets","parent_version":"7.24.7","declared_range":"^4.22.2","status":"reachable","admitting_versions":["4.28.7","4.28.8","4.28.9","4.29.0","4.29.1","4.29.2","4.29.3"],"detail":"the range admits 7 version(s) the view serves"},{"event":"admittance_edge","package_name":"browserslist","locked_version":"4.26.3","parent_name":"core-js-compat","parent_version":"3.37.1","declared_range":"^4.23.0","status":"reachable","admitting_versions":["4.28.7","4.28.8","4.28.9","4.29.0","4.29.1","4.29.2","4.29.3"],"detail":"the range admits 7 version(s) the view serves"},{"event":"admittance_edge","package_name":"browserslist","locked_version":"4.26.3","parent_name":"webpack","parent_version":"5.102.1","declared_range":"^4.26.3","status":"reachable","admitting_versions":["4.28.7","4.28.8","4.28.9","4.29.0","4.29.1","4.29.2","4.29.3"],"detail":"the range admits 7 version(s) the view serves"},{"event":"admittance_edge","package_name":"diff","locked_version":"8.0.4","parent_name":"@wdio/reporter","parent_version":"9.31.2","declared_range":"^8.0.2","status":"reachable","admitting_versions":["8.0.3","8.0.4"],"detail":"the range admits 2 version(s) the view serves"},{"event":"admittance_edge","package_name":"diff","locked_version":"5.2.0","parent_name":"mocha","parent_version":"10.8.2","declared_range":"^5.2.0","status":"reachable","admitting_versions":["5.2.2"],"detail":"the range admits 1 version(s) the view serves"},{"event":"admittance_edge","package_name":"diff","locked_version":"4.0.2","parent_name":"ts-node","parent_version":"10.9.2","declared_range":"^4.0.1","status":"reachable","admitting_versions":["4.0.4"],"detail":"the range admits 1 version(s) the view serves"},{"event":"admittance_edge","package_name":"follow-redirects","locked_version":"1.15.9","parent_name":"axios","parent_version":"1.12.2","declared_range":"^1.15.6","status":"reachable","admitting_versions":["1.16.0","1.16.1"],"detail":"the range admits 2 version(s) the view serves"},{"event":"admittance_edge","package_name":"glob","locked_version":"10.4.5","parent_name":"@rollup/plugin-commonjs","parent_version":"26.0.1","declared_range":"^10.4.1","status":"reachable","admitting_versions":["10.5.0"],"detail":"the range admits 1 version(s) the view serves"},{"event":"admittance_edge","package_name":"glob","locked_version":"10.5.0","parent_name":"@wdio/config","parent_version":"9.31.9","declared_range":"^10.2.2","status":"reachable","admitting_versions":["10.5.0"],"detail":"the range admits 1 version(s) the view serves"},{"event":"admittance_edge","package_name":"glob","locked_version":"10.4.5","parent_name":"@wdio/config","parent_version":"8.46.0","declared_range":"^10.2.2","status":"reachable","admitting_versions":["10.5.0"],"detail":"the range admits 1 version(s) the view serves"},{"event":"admittance_edge","package_name":"glob","locked_version":"10.5.0","parent_name":"@wdio/config","parent_version":"9.31.9","declared_range":"^10.2.2","status":"reachable","admitting_versions":["10.5.0"],"detail":"the range admits 1 version(s) the view serves"},{"event":"admittance_edge","package_name":"glob","locked_version":"10.5.0","parent_name":"@wdio/config","parent_version":"9.31.9","declared_range":"^10.2.2","status":"reachable","admitting_versions":["10.5.0"],"detail":"the range admits 1 version(s) the view serves"},{"event":"admittance_edge","package_name":"glob","locked_version":"10.4.5","parent_name":"archiver-utils","parent_version":"5.0.2","declared_range":"^10.0.0","status":"reachable","admitting_versions":["10.5.0"],"detail":"the range admits 1 version(s) the view serves"},{"event":"admittance_edge","package_name":"glob","locked_version":"7.2.3","parent_name":"rimraf","parent_version":"2.7.1","declared_range":"^7.1.3","status":"capped","admitting_versions":[],"detail":"rimraf caps glob at ^7.1.3, which admits none of the 2 version(s) the strict view serves"},{"event":"admittance_edge","package_name":"glob","locked_version":"7.2.3","parent_name":"rimraf","parent_version":"3.0.2","declared_range":"^7.1.3","status":"capped","admitting_versions":[],"detail":"rimraf caps glob at ^7.1.3, which admits none of the 2 version(s) the strict view serves"},{"event":"admittance_edge","package_name":"glob","locked_version":"7.2.3","parent_name":"nyc","parent_version":"17.0.0","declared_range":"^7.1.6","status":"capped","admitting_versions":[],"detail":"nyc caps glob at ^7.1.6, which admits none of the 2 version(s) the strict view serves"},{"event":"admittance_edge","package_name":"glob","locked_version":"7.2.3","parent_name":"rimraf","parent_version":"3.0.2","declared_range":"^7.1.3","status":"capped","admitting_versions":[],"detail":"rimraf caps glob at ^7.1.3, which admits none of the 2 version(s) the strict view serves"},{"event":"admittance_edge","package_name":"glob","locked_version":"7.2.3","parent_name":"rimraf","parent_version":"3.0.2","declared_range":"^7.1.3","status":"capped","admitting_versions":[],"detail":"rimraf caps glob at ^7.1.3, which admits none of the 2 version(s) the strict view serves"},{"event":"admittance_edge","package_name":"glob","locked_version":"7.2.3","parent_name":"test-exclude","parent_version":"6.0.0","declared_range":"^7.1.4","status":"capped","admitting_versions":[],"detail":"test-exclude caps glob at ^7.1.4, which admits none of the 2 version(s) the strict view serves"},{"event":"admittance_edge","package_name":"glob","locked_version":"8.1.0","parent_name":"mocha","parent_version":"10.8.2","declared_range":"^8.1.0","status":"capped","admitting_versions":[],"detail":"mocha caps glob at ^8.1.0, which admits none of the 2 version(s) the strict view serves"},{"event":"admittance_edge","package_name":"glob","locked_version":"11.0.0","parent_name":"rimraf","parent_version":"6.0.0","declared_range":"^11.0.0","status":"reachable","admitting_versions":["11.1.0"],"detail":"the range admits 1 version(s) the view serves"},{"event":"admittance_edge","package_name":"ip-address","locked_version":"9.0.5","parent_name":"socks","parent_version":"2.8.3","declared_range":"^9.0.5","status":"capped","admitting_versions":[],"detail":"socks caps ip-address at ^9.0.5, which admits none of the 4 version(s) the strict view serves"},{"event":"admittance_edge","package_name":"js-yaml","locked_version":"3.14.1","parent_name":"@istanbuljs/load-nyc-config","parent_version":"1.1.0","declared_range":"^3.13.1","status":"reachable","admitting_versions":["3.15.2"],"detail":"the range admits 1 version(s) the view serves"},{"event":"admittance_edge","package_name":"js-yaml","locked_version":"4.1.0","parent_name":"mocha","parent_version":"10.8.2","declared_range":"^4.1.0","status":"reachable","admitting_versions":["4.3.2"],"detail":"the range admits 1 version(s) the view serves"},{"event":"admittance_edge","package_name":"lodash","locked_version":"4.17.21","parent_name":"archiver-utils","parent_version":"5.0.2","declared_range":"^4.17.15","status":"reachable","admitting_versions":["4.18.0","4.18.1"],"detail":"the range admits 2 version(s) the view serves"},{"event":"admittance_edge","package_name":"lodash","locked_version":"4.17.21","parent_name":"benchmark","parent_version":"2.1.4","declared_range":"^4.17.4","status":"reachable","admitting_versions":["4.18.0","4.18.1"],"detail":"the range admits 2 version(s) the view serves"},{"event":"admittance_edge","package_name":"minimatch","locked_version":"9.0.5","parent_name":"glob","parent_version":"10.4.5","declared_range":"^9.0.4","status":"reachable","admitting_versions":["9.0.7","9.0.8","9.0.9"],"detail":"the range admits 3 version(s) the view serves"},{"event":"admittance_edge","package_name":"minimatch","locked_version":"9.0.9","parent_name":"glob","parent_version":"10.5.0","declared_range":"^9.0.4","status":"reachable","admitting_versions":["9.0.7","9.0.8","9.0.9"],"detail":"the range admits 3 version(s) the view serves"},{"event":"admittance_edge","package_name":"minimatch","locked_version":"9.0.5","parent_name":"glob","parent_version":"10.4.5","declared_range":"^9.0.4","status":"reachable","admitting_versions":["9.0.7","9.0.8","9.0.9"],"detail":"the range admits 3 version(s) the view serves"},{"event":"admittance_edge","package_name":"minimatch","locked_version":"9.0.9","parent_name":"glob","parent_version":"10.5.0","declared_range":"^9.0.4","status":"reachable","admitting_versions":["9.0.7","9.0.8","9.0.9"],"detail":"the range admits 3 version(s) the view serves"},{"event":"admittance_edge","package_name":"minimatch","locked_version":"9.0.9","parent_name":"glob","parent_version":"10.5.0","declared_range":"^9.0.4","status":"reachable","admitting_versions":["9.0.7","9.0.8","9.0.9"],"detail":"the range admits 3 version(s) the view serves"},{"event":"admittance_edge","package_name":"minimatch","locked_version":"9.0.5","parent_name":"glob","parent_version":"10.4.5","declared_range":"^9.0.4","status":"reachable","admitting_versions":["9.0.7","9.0.8","9.0.9"],"detail":"the range admits 3 version(s) the view serves"},{"event":"admittance_edge","package_name":"minimatch","locked_version":"5.1.9","parent_name":"filelist","parent_version":"1.0.6","declared_range":"^5.0.1","status":"reachable","admitting_versions":["5.1.8","5.1.9"],"detail":"the range admits 2 version(s) the view serves"},{"event":"admittance_edge","package_name":"minimatch","locked_version":"3.1.2","parent_name":"glob","parent_version":"7.2.3","declared_range":"^3.1.1","status":"reachable","admitting_versions":["3.1.4","3.1.5"],"detail":"the range admits 2 version(s) the view serves"},{"event":"admittance_edge","package_name":"minimatch","locked_version":"3.1.2","parent_name":"recursive-readdir","parent_version":"2.2.3","declared_range":"^3.0.5","status":"reachable","admitting_versions":["3.1.4","3.1.5"],"detail":"the range admits 2 version(s) the view serves"},{"event":"admittance_edge","package_name":"minimatch","locked_version":"3.1.2","parent_name":"test-exclude","parent_version":"6.0.0","declared_range":"^3.0.4","status":"reachable","admitting_versions":["3.1.4","3.1.5"],"detail":"the range admits 2 version(s) the view serves"},{"event":"admittance_edge","package_name":"minimatch","locked_version":"5.1.6","parent_name":"mocha","parent_version":"10.8.2","declared_range":"^5.1.6","status":"reachable","admitting_versions":["5.1.8","5.1.9"],"detail":"the range admits 2 version(s) the view serves"},{"event":"admittance_edge","package_name":"minimatch","locked_version":"5.1.6","parent_name":"glob","parent_version":"8.1.0","declared_range":"^5.0.1","status":"reachable","admitting_versions":["5.1.8","5.1.9"],"detail":"the range admits 2 version(s) the view serves"},{"event":"admittance_edge","package_name":"minimatch","locked_version":"5.1.6","parent_name":"readdir-glob","parent_version":"1.1.3","declared_range":"^5.1.0","status":"reachable","admitting_versions":["5.1.8","5.1.9"],"detail":"the range admits 2 version(s) the view serves"},{"event":"admittance_edge","package_name":"minimatch","locked_version":"10.0.1","parent_name":"glob","parent_version":"11.0.0","declared_range":"^10.0.0","status":"reachable","admitting_versions":["10.2.3","10.2.4","10.2.5","10.2.6"],"detail":"the range admits 4 version(s) the view serves"},{"event":"admittance_edge","package_name":"minimatch","locked_version":"9.0.5","parent_name":"webdriverio","parent_version":"8.46.0","declared_range":"^9.0.0","status":"reachable","admitting_versions":["9.0.7","9.0.8","9.0.9"],"detail":"the range admits 3 version(s) the view serves"},{"event":"admittance_edge","package_name":"path-to-regexp","locked_version":"0.1.12","parent_name":"express","parent_version":"4.21.2","declared_range":"0.1.12","status":"capped","admitting_versions":[],"detail":"express caps path-to-regexp at 0.1.12, which admits none of the 7 version(s) the strict view serves"},{"event":"admittance_edge","package_name":"picomatch","locked_version":"4.0.7","parent_name":"jest-message-util","parent_version":"30.5.1","declared_range":"^4.0.3","status":"reachable","admitting_versions":["4.0.4","4.0.5","4.0.6","4.0.7"],"detail":"the range admits 4 version(s) the view serves"},{"event":"admittance_edge","package_name":"picomatch","locked_version":"4.0.7","parent_name":"jest-util","parent_version":"30.5.1","declared_range":"^4.0.3","status":"reachable","admitting_versions":["4.0.4","4.0.5","4.0.6","4.0.7"],"detail":"the range admits 4 version(s) the view serves"},{"event":"admittance_edge","package_name":"picomatch","locked_version":"2.3.1","parent_name":"@rollup/pluginutils","parent_version":"5.1.0","declared_range":"^2.3.1","status":"reachable","admitting_versions":["2.3.2"],"detail":"the range admits 1 version(s) the view serves"},{"event":"admittance_edge","package_name":"picomatch","locked_version":"2.3.1","parent_name":"anymatch","parent_version":"3.1.3","declared_range":"^2.0.4","status":"reachable","admitting_versions":["2.3.2"],"detail":"the range admits 1 version(s) the view serves"},{"event":"admittance_edge","package_name":"picomatch","locked_version":"2.3.1","parent_name":"micromatch","parent_version":"4.0.8","declared_range":"^2.3.1","status":"reachable","admitting_versions":["2.3.2"],"detail":"the range admits 1 version(s) the view serves"},{"event":"admittance_edge","package_name":"picomatch","locked_version":"2.3.1","parent_name":"readdirp","parent_version":"3.6.0","declared_range":"^2.2.1","status":"reachable","admitting_versions":["2.3.2"],"detail":"the range admits 1 version(s) the view serves"},{"event":"admittance_edge","package_name":"proxy-addr","locked_version":"2.0.7","parent_name":"express","parent_version":"4.21.2","declared_range":"~2.0.7","status":"reachable","admitting_versions":["2.0.8"],"detail":"the range admits 1 version(s) the view serves"},{"event":"admittance_edge","package_name":"qs","locked_version":"6.13.0","parent_name":"body-parser","parent_version":"1.20.3","declared_range":"6.13.0","status":"capped","admitting_versions":[],"detail":"body-parser caps qs at 6.13.0, which admits none of the 1 version(s) the strict view serves"},{"event":"admittance_edge","package_name":"qs","locked_version":"6.13.0","parent_name":"express","parent_version":"4.21.2","declared_range":"6.13.0","status":"capped","admitting_versions":[],"detail":"express caps qs at 6.13.0, which admits none of the 1 version(s) the strict view serves"},{"event":"admittance_edge","package_name":"qs","locked_version":"6.13.0","parent_name":"superagent","parent_version":"9.0.2","declared_range":"^6.11.0","status":"reachable","admitting_versions":["6.16.0"],"detail":"the range admits 1 version(s) the view serves"},{"event":"admittance_edge","package_name":"rollup","locked_version":"2.79.2","parent_name":"","parent_version":"","declared_range":"^2.79.1","status":"reachable","admitting_versions":["2.80.0"],"detail":"the range admits 1 version(s) the view serves"},{"event":"admittance_edge","package_name":"serialize-javascript","locked_version":"7.1.2","parent_name":"@rollup/plugin-terser","parent_version":"1.0.0","declared_range":"^7.0.3","status":"reachable","admitting_versions":["7.0.5","7.0.6","7.0.7","7.1.0","7.1.1","7.1.2"],"detail":"the range admits 6 version(s) the view serves"},{"event":"admittance_edge","package_name":"serialize-javascript","locked_version":"6.0.2","parent_name":"mocha","parent_version":"10.8.2","declared_range":"^6.0.2","status":"capped","admitting_versions":[],"detail":"mocha caps serialize-javascript at ^6.0.2, which admits none of the 6 version(s) the strict view serves"},{"event":"admittance_edge","package_name":"serialize-javascript","locked_version":"6.0.2","parent_name":"terser-webpack-plugin","parent_version":"5.3.14","declared_range":"^6.0.2","status":"capped","admitting_versions":[],"detail":"terser-webpack-plugin caps serialize-javascript at ^6.0.2, which admits none of the 6 version(s) the strict view serves"},{"event":"admittance_edge","package_name":"socket.io-parser","locked_version":"3.3.4","parent_name":"socket.io-client-v2","parent_version":"2.5.0","declared_range":"~3.3.0","status":"reachable","admitting_versions":["3.3.6"],"detail":"the range admits 1 version(s) the view serves"},{"event":"admittance_edge","package_name":"tar","locked_version":"6.2.1","parent_name":"cmake-js","parent_version":"7.3.0","declared_range":"^6.2.0","status":"capped","admitting_versions":[],"detail":"cmake-js caps tar at ^6.2.0, which admits none of the 2 version(s) the strict view serves"},{"event":"admittance_edge","package_name":"tar-fs","locked_version":"3.0.4","parent_name":"@puppeteer/browsers","parent_version":"1.9.1","declared_range":"3.0.4","status":"capped","admitting_versions":[],"detail":"@puppeteer/browsers caps tar-fs at 3.0.4, which admits none of the 6 version(s) the strict view serves"},{"event":"admittance_edge","package_name":"tar-fs","locked_version":"3.1.3","parent_name":"@puppeteer/browsers","parent_version":"2.13.2","declared_range":"^3.1.1","status":"reachable","admitting_versions":["3.1.1","3.1.2","3.1.3"],"detail":"the range admits 3 version(s) the view serves"},{"event":"admittance_edge","package_name":"tar-fs","locked_version":"3.1.3","parent_name":"@puppeteer/browsers","parent_version":"2.13.2","declared_range":"^3.1.1","status":"reachable","admitting_versions":["3.1.1","3.1.2","3.1.3"],"detail":"the range admits 3 version(s) the view serves"},{"event":"admittance_edge","package_name":"tar-fs","locked_version":"3.1.3","parent_name":"@puppeteer/browsers","parent_version":"2.13.2","declared_range":"^3.1.1","status":"reachable","admitting_versions":["3.1.1","3.1.2","3.1.3"],"detail":"the range admits 3 version(s) the view serves"},{"event":"admittance_edge","package_name":"tar-fs","locked_version":"3.1.3","parent_name":"@puppeteer/browsers","parent_version":"2.13.2","declared_range":"^3.1.1","status":"reachable","admitting_versions":["3.1.1","3.1.2","3.1.3"],"detail":"the range admits 3 version(s) the view serves"},{"event":"admittance_edge","package_name":"tar-fs","locked_version":"3.1.1","parent_name":"geckodriver","parent_version":"4.2.1","declared_range":"^3.0.4","status":"reachable","admitting_versions":["3.1.1","3.1.2","3.1.3"],"detail":"the range admits 3 version(s) the view serves"},{"event":"admittance_edge","package_name":"tar-fs","locked_version":"3.1.1","parent_name":"geckodriver","parent_version":"4.4.1","declared_range":"^3.0.6","status":"reachable","admitting_versions":["3.1.1","3.1.2","3.1.3"],"detail":"the range admits 3 version(s) the view serves"},{"event":"admittance_edge","package_name":"tar-fs","locked_version":"2.1.4","parent_name":"prebuild-install","parent_version":"7.1.2","declared_range":"^2.0.0","status":"reachable","admitting_versions":["2.1.4","2.1.5"],"detail":"the range admits 2 version(s) the view serves"},{"event":"admittance_edge","package_name":"uuid","locked_version":"8.3.2","parent_name":"istanbul-lib-processinfo","parent_version":"2.0.3","declared_range":"^8.3.2","status":"capped","admitting_versions":[],"detail":"istanbul-lib-processinfo caps uuid at ^8.3.2, which admits none of the 4 version(s) the strict view serves"},{"event":"scoped_override_applied","package_name":"basic-ftp","parent_name":"get-uri","version":"6.2.1","location":"package.json:overrides","scope":"get-uri>basic-ftp","detail":"get-uri caps basic-ftp at ^5.0.2, so the fix is delivered by a single scoped override pinning get-uri>basic-ftp to 6.2.1 in package.json:overrides; checked 26 released version(s) of get-uri up to 8.0.1 for one whose requirement reaches the menu served for basic-ftp (floor 6.2.1) — 0.1.0, 0.1.1, 0.1.2, 0.1.3, 0.1.4 and 16 more excluded (not a bump: it is at or below the version already locked); none of them do"},{"event":"rung2_blocker_bump","package_name":"express","blocked_package_name":"body-parser","blocked_floor_version":"1.20.6","old_range":"^4.19.2","picked_version":"4.22.0","within_customer_range":true,"hop":1,"evidence":"checked 290 released version(s) of express up to 5.3.0 for one whose requirement reaches the menu served for body-parser (floor 1.20.6) — 0.14.0, 0.14.1, 1.0.0, 1.0.1, 1.0.2 and 232 more excluded (not a bump: it is at or below the version already locked); 1.0.0-beta, 1.0.0-beta2, 1.0.0-rc, 1.0.0-rc2, 1.0.0-rc3 and 38 more excluded (a pre-release, which no resolver should be steered onto by a bump); 4.22.0 is the lowest that does and it stays inside the declared ^4.19.2"},{"event":"scoped_override_applied","package_name":"glob","parent_name":"rimraf","version":"10.5.0","location":"package.json:overrides","scope":"rimraf>glob","detail":"rimraf caps glob at ^7.1.3, so the fix is delivered by a single scoped override pinning rimraf>glob to 10.5.0 in package.json:overrides; checked 86 released version(s) of rimraf up to 6.1.3 for one whose requirement reaches the menu served for glob (floor 10.5.0) — 1.0.0, 1.0.1, 1.0.2, 1.0.4, 1.0.5 and 43 more excluded (not a bump: it is at or below the version already locked); 4.0.0 is the lowest that does but it sits outside every range that declares the blocker today; checked 46 released version(s) of fstream up to 1.0.12 for one whose requirement reaches the menu served for rimraf (floor 4.0.0) — 0.0.0, 0.0.1, 0.1.0, 0.1.1, 0.1.2 and 41 more excluded (not a bump: it is at or below the version already locked); none of them do"},{"event":"scoped_override_applied","package_name":"glob","parent_name":"nyc","version":"10.5.0","location":"package.json:overrides","scope":"nyc>glob","detail":"nyc caps glob at ^7.1.6, so the fix is delivered by a single scoped override pinning nyc>glob to 10.5.0 in package.json:overrides; checked 166 released version(s) of nyc up to 18.0.0 for one whose requirement reaches the menu served for glob (floor 10.5.0) — 1.1.0, 1.1.1, 1.1.2, 1.1.3, 1.1.4 and 108 more excluded (not a bump: it is at or below the version already locked); 4.0.0-alpha, 6.2.0-alpha, 6.2.0-alpha1, 6.2.0-alpha3, 6.4.0-next and 46 more excluded (a pre-release, which no resolver should be steered onto by a bump); none of them do"},{"event":"scoped_override_applied","package_name":"glob","parent_name":"test-exclude","version":"10.5.0","location":"package.json:overrides","scope":"test-exclude>glob","detail":"test-exclude caps glob at ^7.1.4, so the fix is delivered by a single scoped override pinning test-exclude>glob to 10.5.0 in package.json:overrides; checked 40 released version(s) of test-exclude up to 8.0.0 for one whose requirement reaches the menu served for glob (floor 10.5.0) — 1.0.0, 1.1.0, 2.0.0, 2.1.0, 2.1.1 and 26 more excluded (not a bump: it is at or below the version already locked); 6.0.0-alhpa.3, 6.0.0-alpha.0, 6.0.0-alpha.1, 6.0.0-alpha.2, 6.0.0-alpha.3 excluded (a pre-release, which no resolver should be steered onto by a bump); 7.0.0 is the lowest that does but it sits outside every range that declares the blocker today; checked 166 released version(s) of nyc up to 18.0.0 for one whose requirement reaches the menu served for test-exclude (floor 7.0.0) — 1.1.0, 1.1.1, 1.1.2, 1.1.3, 1.1.4 and 108 more excluded (not a bump: it is at or below the version already locked); 4.0.0-alpha, 6.2.0-alpha, 6.2.0-alpha1, 6.2.0-alpha3, 6.4.0-next and 46 more excluded (a pre-release, which no resolver should be steered onto by a bump); none of them do"},{"event":"scoped_override_applied","package_name":"glob","parent_name":"mocha","version":"10.5.0","location":"package.json:overrides","scope":"mocha>glob","detail":"mocha caps glob at ^8.1.0, so the fix is delivered by a single scoped override pinning mocha>glob to 10.5.0 in package.json:overrides; checked 251 released version(s) of mocha up to 12.0.3 for one whose requirement reaches the menu served for glob (floor 10.5.0) — 0.0.1-alpha1, 0.0.1-alpha2, 0.0.1-alpha3, 0.0.1-alpha4, 0.0.1-alpha5 and 34 more excluded (a pre-release, which no resolver should be steered onto by a bump); 0.0.1, 0.0.2, 0.0.3, 0.0.4, 0.0.5 and 184 more excluded (not a bump: it is at or below the version already locked); 11.0.1 is the lowest that does but it sits outside every range that declares the blocker today; checked 438 released version(s) of @wdio/mocha-framework up to 10.1.0-alpha.30 for one whose requirement reaches the menu served for mocha (floor 11.0.1) — 5.0.0-beta.5, 5.0.0-beta.6, 5.0.0-beta.7, 5.0.0-beta.8, 5.0.0-beta.9 and 89 more excluded (a pre-release, which no resolver should be steered onto by a bump); 5.0.0, 5.0.3, 5.1.0, 5.2.2, 5.2.3 and 336 more excluded (not a bump: it is at or below the version already locked); none of them do"},{"event":"rung2_blocker_bump","package_name":"socks","blocked_package_name":"ip-address","blocked_floor_version":"10.7.1","old_range":"^2.8.3","picked_version":"2.8.7","within_customer_range":true,"hop":1,"evidence":"checked 56 released version(s) of socks up to 2.8.10 for one whose requirement reaches the menu served for ip-address (floor 10.7.1) — 0.0.1, 1.0.0, 1.1.5, 1.1.6, 1.1.7 and 43 more excluded (not a bump: it is at or below the version already locked); 2.6.0-beta.1 excluded (a pre-release, which no resolver should be steered onto by a bump); 2.8.7 is the lowest that does and it stays inside the declared ^2.8.3"},{"event":"rung2_blocker_bump","package_name":"express","blocked_package_name":"path-to-regexp","blocked_floor_version":"0.1.13","old_range":"^4.19.2","picked_version":"4.22.0","within_customer_range":true,"hop":1,"evidence":"checked 290 released version(s) of express up to 5.3.0 for one whose requirement reaches the menu served for path-to-regexp (floor 0.1.13) — 0.14.0, 0.14.1, 1.0.0, 1.0.1, 1.0.2 and 232 more excluded (not a bump: it is at or below the version already locked); 1.0.0-beta, 1.0.0-beta2, 1.0.0-rc, 1.0.0-rc2, 1.0.0-rc3 and 38 more excluded (a pre-release, which no resolver should be steered onto by a bump); 4.22.0 is the lowest that does and it stays inside the declared ^4.19.2"},{"event":"rung2_blocker_bump","package_name":"express","blocked_package_name":"body-parser","blocked_floor_version":"1.20.8","old_range":"^4.19.2","picked_version":"4.22.0","within_customer_range":true,"hop":2,"evidence":"checked 290 released version(s) of express up to 5.3.0 for one whose requirement reaches the menu served for body-parser (floor 1.20.8) — 0.14.0, 0.14.1, 1.0.0, 1.0.1, 1.0.2 and 232 more excluded (not a bump: it is at or below the version already locked); 1.0.0-beta, 1.0.0-beta2, 1.0.0-rc, 1.0.0-rc2, 1.0.0-rc3 and 38 more excluded (a pre-release, which no resolver should be steered onto by a bump); 4.22.0 is the lowest that does and it stays inside the declared ^4.19.2"},{"event":"rung2_blocker_bump","package_name":"body-parser","blocked_package_name":"qs","blocked_floor_version":"6.16.0","old_range":"1.20.3","picked_version":"1.20.8","within_customer_range":false,"hop":1,"evidence":"checked 3 released version(s) of body-parser up to 2.3.0 for one whose requirement reaches the menu served for qs (floor 6.16.0); 1.20.8 is the lowest that does but it sits outside every range that declares the blocker today"},{"event":"rung2_blocker_bump","package_name":"express","blocked_package_name":"qs","blocked_floor_version":"6.16.0","old_range":"^4.19.2","picked_version":"4.22.3","within_customer_range":true,"hop":1,"evidence":"checked 290 released version(s) of express up to 5.3.0 for one whose requirement reaches the menu served for qs (floor 6.16.0) — 0.14.0, 0.14.1, 1.0.0, 1.0.1, 1.0.2 and 232 more excluded (not a bump: it is at or below the version already locked); 1.0.0-beta, 1.0.0-beta2, 1.0.0-rc, 1.0.0-rc2, 1.0.0-rc3 and 38 more excluded (a pre-release, which no resolver should be steered onto by a bump); 4.22.3 is the lowest that does and it stays inside the declared ^4.19.2"},{"event":"constraint_relaxation","package_name":"mocha","table":"devDependencies","old_specifier":"^10.6.0","new_specifier":"^12.0.0","forcing_vulnerability_ids":[],"rationale":"the declared range excluded every version the strict view serves; 12.0.0 is the lowest it serves without moving below the locked version"},{"event":"scoped_override_applied","package_name":"mocha","parent_name":"","version":"^12.0.0","location":"package.json:overrides","scope":"mocha","detail":"the existing unscoped override for mocha was rewritten to ^12.0.0 in package.json:overrides to match the widened declaration"},{"event":"constraint_relaxation","package_name":"@wdio/mocha-framework","table":"devDependencies","old_specifier":"^9.31.9","new_specifier":"^10.0.0","forcing_vulnerability_ids":[],"rationale":"the declared range excluded every version the strict view serves; 10.0.0 is the lowest it serves without moving below the locked version"},{"event":"rung2_blocker_bump","package_name":"@wdio/mocha-framework","blocked_package_name":"mocha","blocked_floor_version":"12.0.0","old_range":"^9.31.9","picked_version":"10.0.0","within_customer_range":false,"hop":2,"evidence":"checked 438 released version(s) of @wdio/mocha-framework up to 10.1.0-alpha.30 for one whose requirement reaches the menu served for mocha (floor 12.0.0) — 5.0.0-beta.5, 5.0.0-beta.6, 5.0.0-beta.7, 5.0.0-beta.8, 5.0.0-beta.9 and 89 more excluded (a pre-release, which no resolver should be steered onto by a bump); 5.0.0, 5.0.3, 5.1.0, 5.2.2, 5.2.3 and 336 more excluded (not a bump: it is at or below the version already locked); 10.0.0 is the lowest that does but it sits outside every range that declares the blocker today"},{"event":"rung2_blocker_bump","package_name":"mocha","blocked_package_name":"serialize-javascript","blocked_floor_version":"7.0.5","old_range":"^10.6.0, ^10.8.2","picked_version":"12.0.0","within_customer_range":false,"hop":1,"evidence":"checked 251 released version(s) of mocha up to 12.0.3 for one whose requirement reaches the menu served for serialize-javascript (floor 7.0.5) — 0.0.1-alpha1, 0.0.1-alpha2, 0.0.1-alpha3, 0.0.1-alpha4, 0.0.1-alpha5 and 34 more excluded (a pre-release, which no resolver should be steered onto by a bump); 0.0.1, 0.0.2, 0.0.3, 0.0.4, 0.0.5 and 184 more excluded (not a bump: it is at or below the version already locked); 12.0.0 is the lowest that does but it sits outside every range that declares the blocker today"},{"event":"rung2_blocker_bump","package_name":"terser-webpack-plugin","blocked_package_name":"serialize-javascript","blocked_floor_version":"7.0.5","old_range":"^5.3.11","picked_version":"5.3.17","within_customer_range":true,"hop":1,"evidence":"checked 89 released version(s) of terser-webpack-plugin up to 5.6.1 for one whose requirement reaches the menu served for serialize-javascript (floor 7.0.5) — 1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.2.0 and 77 more excluded (not a bump: it is at or below the version already locked); 5.3.17 is the lowest that does and it stays inside the declared ^5.3.11"},{"event":"rung2_blocker_bump","package_name":"@fails-components/webtransport-transport-http3-quiche","blocked_package_name":"cmake-js","blocked_floor_version":"8.0.0","old_range":"^1.1.4","picked_version":"1.5.3","within_customer_range":true,"hop":2,"evidence":"checked 38 released version(s) of @fails-components/webtransport-transport-http3-quiche up to 1.6.10 for one whose requirement reaches the menu served for cmake-js (floor 8.0.0) — 1.0.0-rc.1 excluded (a pre-release, which no resolver should be steered onto by a bump); 1.0.1, 1.0.4, 1.0.6, 1.0.8, 1.0.9 and 19 more excluded (not a bump: it is at or below the version already locked); 1.5.3 is the lowest that does and it stays inside the declared ^1.1.4"},{"event":"rung2_blocker_bump","package_name":"cmake-js","blocked_package_name":"tar","blocked_floor_version":"7.5.21","old_range":"^7.2.1","picked_version":"8.0.0","within_customer_range":false,"hop":1,"evidence":"checked 88 released version(s) of cmake-js up to 8.0.0 for one whose requirement reaches the menu served for tar (floor 7.5.21) — 0.8.0, 0.8.1, 0.8.2, 0.8.3, 0.8.4 and 76 more excluded (not a bump: it is at or below the version already locked); 7.0.0-0, 7.0.0-1, 7.0.0-2, 7.0.0-3 excluded (a pre-release, which no resolver should be steered onto by a bump); 8.0.0 is the lowest that does but it sits outside every range that declares the blocker today"},{"event":"rung2_blocker_bump","package_name":"webdriverio","blocked_package_name":"webdriver","blocked_floor_version":"9.0.0","old_range":"9.31.9","picked_version":"9.31.9","within_customer_range":true,"hop":5,"evidence":"checked 842 released version(s) of webdriverio up to 10.1.0-alpha.30 for one whose requirement reaches the menu served for webdriver (floor 9.0.0) — 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.1.2 and 610 more excluded (not a bump: it is at or below the version already locked); 4.12.0-beta.1, 5.0.0-alpha.2, 5.0.0-alpha.3, 5.0.0-alpha.4, 5.0.0-alpha.5 and 112 more excluded (a pre-release, which no resolver should be steered onto by a bump); 9.31.9 is the lowest that does and it stays inside the declared 9.31.9"},{"event":"rung2_blocker_bump","package_name":"webdriver","blocked_package_name":"@wdio/config","blocked_floor_version":"9.0.0","old_range":"8.46.0","picked_version":"9.0.0","within_customer_range":false,"hop":4,"evidence":"checked 582 released version(s) of webdriver up to 10.1.0-alpha.30 for one whose requirement reaches the menu served for @wdio/config (floor 9.0.0) — 0.0.1, 0.0.2, 0.0.3, 0.0.4, 5.0.0 and 381 more excluded (not a bump: it is at or below the version already locked); 5.0.0-alpha.2, 5.0.0-alpha.3, 5.0.0-alpha.4, 5.0.0-alpha.5, 5.0.0-alpha.6 and 107 more excluded (a pre-release, which no resolver should be steered onto by a bump); 9.0.0 is the lowest that does but it sits outside every range that declares the blocker today"},{"event":"rung2_blocker_bump","package_name":"webdriverio","blocked_package_name":"@wdio/config","blocked_floor_version":"9.0.0","old_range":"9.31.9","picked_version":"9.31.9","within_customer_range":true,"hop":4,"evidence":"checked 842 released version(s) of webdriverio up to 10.1.0-alpha.30 for one whose requirement reaches the menu served for @wdio/config (floor 9.0.0) — 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.1.2 and 610 more excluded (not a bump: it is at or below the version already locked); 4.12.0-beta.1, 5.0.0-alpha.2, 5.0.0-alpha.3, 5.0.0-alpha.4, 5.0.0-alpha.5 and 112 more excluded (a pre-release, which no resolver should be steered onto by a bump); 9.31.9 is the lowest that does and it stays inside the declared 9.31.9"},{"event":"rung2_blocker_bump","package_name":"@wdio/config","blocked_package_name":"@wdio/utils","blocked_floor_version":"9.0.0","old_range":"8.46.0","picked_version":"9.0.0","within_customer_range":false,"hop":3,"evidence":"checked 420 released version(s) of @wdio/config up to 10.1.0-alpha.30 for one whose requirement reaches the menu served for @wdio/utils (floor 9.0.0) — 5.0.0-beta.5, 5.0.0-beta.6, 5.0.0-beta.7, 5.0.0-beta.8, 5.0.0-beta.9 and 90 more excluded (a pre-release, which no resolver should be steered onto by a bump); 5.0.0, 5.0.3, 5.1.0, 5.2.2, 5.2.3 and 253 more excluded (not a bump: it is at or below the version already locked); 9.0.0 is the lowest that does but it sits outside every range that declares the blocker today"},{"event":"rung2_blocker_bump","package_name":"webdriverio","blocked_package_name":"webdriver","blocked_floor_version":"9.0.0","old_range":"9.31.9","picked_version":"9.31.9","within_customer_range":true,"hop":4,"evidence":"checked 842 released version(s) of webdriverio up to 10.1.0-alpha.30 for one whose requirement reaches the menu served for webdriver (floor 9.0.0) — 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.1.2 and 610 more excluded (not a bump: it is at or below the version already locked); 4.12.0-beta.1, 5.0.0-alpha.2, 5.0.0-alpha.3, 5.0.0-alpha.4, 5.0.0-alpha.5 and 112 more excluded (a pre-release, which no resolver should be steered onto by a bump); 9.31.9 is the lowest that does and it stays inside the declared 9.31.9"},{"event":"rung2_blocker_bump","package_name":"webdriver","blocked_package_name":"@wdio/utils","blocked_floor_version":"9.0.0","old_range":"8.46.0","picked_version":"9.0.0","within_customer_range":false,"hop":3,"evidence":"checked 582 released version(s) of webdriver up to 10.1.0-alpha.30 for one whose requirement reaches the menu served for @wdio/utils (floor 9.0.0) — 0.0.1, 0.0.2, 0.0.3, 0.0.4, 5.0.0 and 381 more excluded (not a bump: it is at or below the version already locked); 5.0.0-alpha.2, 5.0.0-alpha.3, 5.0.0-alpha.4, 5.0.0-alpha.5, 5.0.0-alpha.6 and 107 more excluded (a pre-release, which no resolver should be steered onto by a bump); 9.0.0 is the lowest that does but it sits outside every range that declares the blocker today"},{"event":"rung2_blocker_bump","package_name":"webdriverio","blocked_package_name":"@wdio/utils","blocked_floor_version":"9.0.0","old_range":"9.31.9","picked_version":"9.31.9","within_customer_range":true,"hop":3,"evidence":"checked 842 released version(s) of webdriverio up to 10.1.0-alpha.30 for one whose requirement reaches the menu served for @wdio/utils (floor 9.0.0) — 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.1.2 and 610 more excluded (not a bump: it is at or below the version already locked); 4.12.0-beta.1, 5.0.0-alpha.2, 5.0.0-alpha.3, 5.0.0-alpha.4, 5.0.0-alpha.5 and 112 more excluded (a pre-release, which no resolver should be steered onto by a bump); 9.31.9 is the lowest that does and it stays inside the declared 9.31.9"},{"event":"rung2_blocker_bump","package_name":"@wdio/utils","blocked_package_name":"@puppeteer/browsers","blocked_floor_version":"2.2.4","old_range":"8.46.0","picked_version":"9.0.0","within_customer_range":false,"hop":2,"evidence":"checked 381 released version(s) of @wdio/utils up to 10.1.0-alpha.30 for one whose requirement reaches the menu served for @puppeteer/browsers (floor 2.2.4) — 5.4.20, 5.6.0, 5.6.3, 5.6.4, 5.7.0 and 226 more excluded (not a bump: it is at or below the version already locked); 5.13.0-alpha.0, 6.0.0-alpha.0, 6.0.0-alpha.1, 6.0.0-beta.0, 7.0.0-beta.0 and 78 more excluded (a pre-release, which no resolver should be steered onto by a bump); 9.0.0 is the lowest that does but it sits outside every range that declares the blocker today"},{"event":"rung2_blocker_bump","package_name":"webdriverio","blocked_package_name":"puppeteer-core","blocked_floor_version":"22.13.1","old_range":"9.31.9","picked_version":"9.31.9","within_customer_range":true,"hop":3,"evidence":"checked 842 released version(s) of webdriverio up to 10.1.0-alpha.30 for one whose requirement reaches the menu served for puppeteer-core (floor 22.13.1) — 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.1.2 and 610 more excluded (not a bump: it is at or below the version already locked); 4.12.0-beta.1, 5.0.0-alpha.2, 5.0.0-alpha.3, 5.0.0-alpha.4, 5.0.0-alpha.5 and 112 more excluded (a pre-release, which no resolver should be steered onto by a bump); 9.31.9 is the lowest that does and it stays inside the declared 9.31.9"},{"event":"rung2_blocker_bump","package_name":"puppeteer-core","blocked_package_name":"@puppeteer/browsers","blocked_floor_version":"2.2.4","old_range":"^21.11.0","picked_version":"22.13.1","within_customer_range":false,"hop":2,"evidence":"checked 350 released version(s) of puppeteer-core up to 25.14.0 for one whose requirement reaches the menu served for @puppeteer/browsers (floor 2.2.4) — 1.7.0, 1.8.0, 1.9.0, 1.10.0, 1.11.0 and 191 more excluded (not a bump: it is at or below the version already locked); 22.13.1 is the lowest that does but it sits outside every range that declares the blocker today"},{"event":"rung2_blocker_bump","package_name":"@puppeteer/browsers","blocked_package_name":"tar-fs","blocked_floor_version":"3.1.1","old_range":"^1.6.0, 1.9.1","picked_version":"2.2.4","within_customer_range":false,"hop":1,"evidence":"checked 88 released version(s) of @puppeteer/browsers up to 3.2.5 for one whose requirement reaches the menu served for tar-fs (floor 3.1.1) — 0.0.1, 0.0.2, 0.0.3, 0.0.4, 0.0.5 and 30 more excluded (not a bump: it is at or below the version already locked); 2.2.4 is the lowest that does but it sits outside every range that declares the blocker today"},{"event":"constraint_relaxation","package_name":"nyc","table":"devDependencies","old_specifier":"^17.0.0","new_specifier":"^18.0.0","forcing_vulnerability_ids":[],"rationale":"the declared range excluded every version the strict view serves; 18.0.0 is the lowest it serves without moving below the locked version"},{"event":"scoped_override_applied","package_name":"nyc","parent_name":"","version":"^18.0.0","location":"package.json:overrides","scope":"nyc","detail":"the existing unscoped override for nyc was rewritten to ^18.0.0 in package.json:overrides to match the widened declaration"},{"event":"rung2_blocker_bump","package_name":"nyc","blocked_package_name":"istanbul-lib-processinfo","blocked_floor_version":"3.0.1","old_range":"^17.0.0","picked_version":"18.0.0","within_customer_range":false,"hop":2,"evidence":"checked 166 released version(s) of nyc up to 18.0.0 for one whose requirement reaches the menu served for istanbul-lib-processinfo (floor 3.0.1) — 1.1.0, 1.1.1, 1.1.2, 1.1.3, 1.1.4 and 108 more excluded (not a bump: it is at or below the version already locked); 4.0.0-alpha, 6.2.0-alpha, 6.2.0-alpha1, 6.2.0-alpha3, 6.4.0-next and 46 more excluded (a pre-release, which no resolver should be steered onto by a bump); 18.0.0 is the lowest that does but it sits outside every range that declares the blocker today"},{"event":"rung2_blocker_bump","package_name":"istanbul-lib-processinfo","blocked_package_name":"uuid","blocked_floor_version":"11.1.1","old_range":"^2.0.2","picked_version":"3.0.1","within_customer_range":false,"hop":1,"evidence":"checked 7 released version(s) of istanbul-lib-processinfo up to 3.0.1 for one whose requirement reaches the menu served for uuid (floor 11.1.1) — 1.0.0, 2.0.0, 2.0.1, 2.0.2, 2.0.3 excluded (not a bump: it is at or below the version already locked); 3.0.1 is the lowest that does but it sits outside every range that declares the blocker today"},{"event":"resolver_invocation","attempt":1,"argv":["/usr/local/bin/corepack","npm@11","install","--package-lock-only","--ignore-scripts","--no-audit","--no-fund","--registry","http://127.0.0.1:42259/resolution/remediation/93cf469a-0ffe-433f-bb2f-ada9e3188e23/npm"],"exit_code":0,"stderr_excerpt":"npm warn EBADENGINE Unsupported engine {\nnpm warn EBADENGINE   package: 'eiows@7.1.0',\nnpm warn EBADENGINE   required: { node: '>=16 <23.0' },\nnpm warn EBADENGINE   current: { node: 'v24.21.0', npm: '11.21.0' }\nnpm warn EBADENGINE }\nup to date in 4s","eresolve_report":"","resolver":"npm"},{"event":"resolver_invocation_resources","resolver_name":"npm","wall_seconds":5.687733071000025,"peak_rss_mb":3740,"worker_peak_rss_mb":3740},{"event":"resolver_invocation","attempt":1,"argv":["/usr/local/bin/corepack","npm@11","update","@babel/core","@babel/plugin-transform-modules-systemjs","@fails-components/webtransport-transport-http3-quiche","@puppeteer/browsers","@wdio/config","@wdio/mocha-framework","@wdio/utils","ajv","axios","baseline-browser-mapping","basic-ftp","body-parser","brace-expansion","browserslist","cmake-js","diff","express","follow-redirects","glob","ip-address","istanbul-lib-processinfo","js-yaml","lodash","minimatch","mocha","nyc","path-to-regexp","picomatch","proxy-addr","puppeteer-core","qs","rollup","serialize-javascript","socket.io-parser","socks","tar","tar-fs","terser-webpack-plugin","uuid","webdriver","webdriverio","webpack","--package-lock-only","--ignore-scripts","--no-audit","--no-fund","--registry","http://127.0.0.1:42259/resolution/remediation/93cf469a-0ffe-433f-bb2f-ada9e3188e23/npm"],"exit_code":1,"stderr_excerpt":"npm error code ETARGET\nnpm error notarget No matching version found for tar-fs@3.0.4.\nnpm error notarget In most cases you or one of your dependencies are requesting a package version that doesn't exist.\nnpm error Log files were not written due to the config logs-max=0","eresolve_report":"","resolver":"npm"},{"event":"resolver_invocation_resources","resolver_name":"npm","wall_seconds":10.401351099999943,"peak_rss_mb":3740,"worker_peak_rss_mb":3740},{"event":"rung_classification","package_name":"tar-fs","spec":"3.0.4","classification":"needs_rung23","detail":"a package the error does not name caps tar-fs at 3.0.4, which admits no version the strict view serves; clearing it needs the declaring package bumped or the edge documented"},{"event":"scoped_override_applied","package_name":"tar-fs","parent_name":"@puppeteer/browsers","version":"3.1.3","location":"package.json:overrides","scope":"@puppeteer/browsers>tar-fs","detail":"@puppeteer/browsers caps tar-fs at 3.0.4, so the fix is delivered by a single scoped override pinning @puppeteer/browsers>tar-fs to 3.1.3 in package.json:overrides; checked 88 released version(s) of @puppeteer/browsers up to 3.2.5 for one whose requirement reaches the menu served for tar-fs (floor 3.1.3) — 0.0.1, 0.0.2, 0.0.3, 0.0.4, 0.0.5 and 30 more excluded (not a bump: it is at or below the version already locked); 2.2.4 is the lowest that does but it sits outside every range that declares the blocker today; checked 381 released version(s) of @wdio/utils up to 10.1.0-alpha.30 for one whose requirement reaches the menu served for @puppeteer/browsers (floor 2.2.4) — 5.4.20, 5.6.0, 5.6.3, 5.6.4, 5.7.0 and 293 more excluded (not a bump: it is at or below the version already locked); 5.13.0-alpha.0, 6.0.0-alpha.0, 6.0.0-alpha.1, 6.0.0-beta.0, 7.0.0-beta.0 and 78 more excluded (a pre-release, which no resolver should be steered onto by a bump); none of them do"},{"event":"rung2_blocker_bump","package_name":"prebuild-install","blocked_package_name":"tar-fs","blocked_floor_version":"3.1.3","old_range":"^7.1.1","picked_version":"7.1.3","within_customer_range":true,"hop":1,"evidence":"checked 48 released version(s) of prebuild-install up to 7.1.3 for one whose requirement reaches the menu served for tar-fs (floor 3.1.3) — 1.0.0, 1.0.1, 1.0.2, 1.1.0, 2.0.0 and 42 more excluded (not a bump: it is at or below the version already locked); 7.1.3 is the lowest that does and it stays inside the declared ^7.1.1"},{"event":"resolver_invocation","attempt":2,"argv":["/usr/local/bin/corepack","npm@11","install","--package-lock-only","--ignore-scripts","--no-audit","--no-fund","--registry","http://127.0.0.1:42259/resolution/remediation/93cf469a-0ffe-433f-bb2f-ada9e3188e23/npm"],"exit_code":0,"stderr_excerpt":"npm warn EBADENGINE Unsupported engine {\nnpm warn EBADENGINE   package: 'eiows@7.1.0',\nnpm warn EBADENGINE   required: { node: '>=16 <23.0' },\nnpm warn EBADENGINE   current: { node: 'v24.21.0', npm: '11.21.0' }\nnpm warn EBADENGINE }\nup to date in 2s","eresolve_report":"","resolver":"npm"},{"event":"resolver_invocation_resources","resolver_name":"npm","wall_seconds":2.313499987,"peak_rss_mb":3740,"worker_peak_rss_mb":3740},{"event":"resolver_invocation","attempt":2,"argv":["/usr/local/bin/corepack","npm@11","update","@babel/core","@babel/plugin-transform-modules-systemjs","@fails-components/webtransport-transport-http3-quiche","@puppeteer/browsers","@wdio/config","@wdio/mocha-framework","@wdio/utils","ajv","axios","baseline-browser-mapping","basic-ftp","body-parser","brace-expansion","browserslist","cmake-js","diff","express","follow-redirects","glob","ip-address","istanbul-lib-processinfo","js-yaml","lodash","minimatch","mocha","nyc","path-to-regexp","picomatch","prebuild-install","proxy-addr","puppeteer-core","qs","rollup","serialize-javascript","socket.io-parser","socks","tar","tar-fs","terser-webpack-plugin","uuid","webdriver","webdriverio","webpack","--package-lock-only","--ignore-scripts","--no-audit","--no-fund","--registry","http://127.0.0.1:42259/resolution/remediation/93cf469a-0ffe-433f-bb2f-ada9e3188e23/npm"],"exit_code":0,"stderr_excerpt":"npm warn EBADENGINE Unsupported engine {\nnpm warn EBADENGINE   package: 'eiows@7.1.0',\nnpm warn EBADENGINE   required: { node: '>=16 <23.0' },\nnpm warn EBADENGINE   current: { node: 'v24.21.0', npm: '11.21.0' }\nnpm warn EBADENGINE }\nup to date in 10s","eresolve_report":"","resolver":"npm"},{"event":"resolver_invocation_resources","resolver_name":"npm","wall_seconds":10.377499207000028,"peak_rss_mb":3740,"worker_peak_rss_mb":3740},{"event":"rung_classification","package_name":"","spec":"","classification":"off_registry_lock_entry","detail":"1 locked entr(ies) come from outside any registry and were not held to the view, which never offered them: uWebSockets.js@20.56.0"},{"event":"final_outcome","status":"partial","summary":"npm converged on attempt 2, carrying 13 documented residue entr(ies)","residue":[{"package_name":"braces","spec":"","classification":"documented_readmission","detail":"the strict view serves no version of braces without a known vulnerability, so the version already locked (3.0.3) stays available and the exposure is reported rather than the package removed; the view this run resolves against has to keep serving that version for the unit to re-lock at all","vulnerability_ids":[],"admittance_gap":0,"reachability":null},{"package_name":"deepmerge-ts","spec":"","classification":"documented_readmission","detail":"the strict view serves no version of deepmerge-ts without a known vulnerability, so the version already locked (5.1.0, 8.0.2) stays available and the exposure is reported rather than the package removed; the view this run resolves against has to keep serving that version for the unit to re-lock at all","vulnerability_ids":[],"admittance_gap":0,"reachability":null},{"package_name":"extract-zip","spec":"","classification":"documented_readmission","detail":"the strict view serves no version of extract-zip without a known vulnerability, so the version already locked (2.0.1) stays available and the exposure is reported rather than the package removed; the view this run resolves against has to keep serving that version for the unit to re-lock at all","vulnerability_ids":[],"admittance_gap":0,"reachability":null},{"package_name":"http-cache-semantics","spec":"","classification":"documented_readmission","detail":"the strict view serves no version of http-cache-semantics without a known vulnerability, so the version already locked (4.2.0) stays available and the exposure is reported rather than the package removed; the view this run resolves against has to keep serving that version for the unit to re-lock at all","vulnerability_ids":[],"admittance_gap":0,"reachability":null},{"package_name":"node-forge","spec":"","classification":"documented_readmission","detail":"the strict view serves no version of node-forge without a known vulnerability, so the version already locked (1.3.1) stays available and the exposure is reported rather than the package removed; the view this run resolves against has to keep serving that version for the unit to re-lock at all","vulnerability_ids":[],"admittance_gap":0,"reachability":null},{"package_name":"parseuri","spec":"","classification":"documented_readmission","detail":"the strict view serves no version of parseuri without a known vulnerability, so the version already locked (0.0.6) stays available and the exposure is reported rather than the package removed; the view this run resolves against has to keep serving that version for the unit to re-lock at all","vulnerability_ids":[],"admittance_gap":0,"reachability":null},{"package_name":"sprintf-js","spec":"","classification":"documented_readmission","detail":"the strict view serves no version of sprintf-js without a known vulnerability, so the version already locked (1.0.3, 1.1.3) stays available and the exposure is reported rather than the package removed; the view this run resolves against has to keep serving that version for the unit to re-lock at all","vulnerability_ids":[],"admittance_gap":0,"reachability":null},{"package_name":"basic-ftp","spec":"^5.0.2","classification":"scoped_override_residue","detail":"get-uri caps basic-ftp at ^5.0.2, so the fix is delivered by a single scoped override pinning get-uri>basic-ftp to 6.2.1 in package.json:overrides; checked 26 released version(s) of get-uri up to 8.0.1 for one whose requirement reaches the menu served for basic-ftp (floor 6.2.1) — 0.1.0, 0.1.1, 0.1.2, 0.1.3, 0.1.4 and 16 more excluded (not a bump: it is at or below the version already locked); none of them do","vulnerability_ids":[],"admittance_gap":0,"reachability":null},{"package_name":"glob","spec":"^7.1.3","classification":"scoped_override_residue","detail":"rimraf caps glob at ^7.1.3, so the fix is delivered by a single scoped override pinning rimraf>glob to 10.5.0 in package.json:overrides; checked 86 released version(s) of rimraf up to 6.1.3 for one whose requirement reaches the menu served for glob (floor 10.5.0) — 1.0.0, 1.0.1, 1.0.2, 1.0.4, 1.0.5 and 43 more excluded (not a bump: it is at or below the version already locked); 4.0.0 is the lowest that does but it sits outside every range that declares the blocker today; checked 46 released version(s) of fstream up to 1.0.12 for one whose requirement reaches the menu served for rimraf (floor 4.0.0) — 0.0.0, 0.0.1, 0.1.0, 0.1.1, 0.1.2 and 41 more excluded (not a bump: it is at or below the version already locked); none of them do","vulnerability_ids":[],"admittance_gap":0,"reachability":null},{"package_name":"glob","spec":"^7.1.6","classification":"scoped_override_residue","detail":"nyc caps glob at ^7.1.6, so the fix is delivered by a single scoped override pinning nyc>glob to 10.5.0 in package.json:overrides; checked 166 released version(s) of nyc up to 18.0.0 for one whose requirement reaches the menu served for glob (floor 10.5.0) — 1.1.0, 1.1.1, 1.1.2, 1.1.3, 1.1.4 and 108 more excluded (not a bump: it is at or below the version already locked); 4.0.0-alpha, 6.2.0-alpha, 6.2.0-alpha1, 6.2.0-alpha3, 6.4.0-next and 46 more excluded (a pre-release, which no resolver should be steered onto by a bump); none of them do","vulnerability_ids":[],"admittance_gap":0,"reachability":null},{"package_name":"glob","spec":"^7.1.4","classification":"scoped_override_residue","detail":"test-exclude caps glob at ^7.1.4, so the fix is delivered by a single scoped override pinning test-exclude>glob to 10.5.0 in package.json:overrides; checked 40 released version(s) of test-exclude up to 8.0.0 for one whose requirement reaches the menu served for glob (floor 10.5.0) — 1.0.0, 1.1.0, 2.0.0, 2.1.0, 2.1.1 and 26 more excluded (not a bump: it is at or below the version already locked); 6.0.0-alhpa.3, 6.0.0-alpha.0, 6.0.0-alpha.1, 6.0.0-alpha.2, 6.0.0-alpha.3 excluded (a pre-release, which no resolver should be steered onto by a bump); 7.0.0 is the lowest that does but it sits outside every range that declares the blocker today; checked 166 released version(s) of nyc up to 18.0.0 for one whose requirement reaches the menu served for test-exclude (floor 7.0.0) — 1.1.0, 1.1.1, 1.1.2, 1.1.3, 1.1.4 and 108 more excluded (not a bump: it is at or below the version already locked); 4.0.0-alpha, 6.2.0-alpha, 6.2.0-alpha1, 6.2.0-alpha3, 6.4.0-next and 46 more excluded (a pre-release, which no resolver should be steered onto by a bump); none of them do","vulnerability_ids":[],"admittance_gap":0,"reachability":null},{"package_name":"glob","spec":"^8.1.0","classification":"scoped_override_residue","detail":"mocha caps glob at ^8.1.0, so the fix is delivered by a single scoped override pinning mocha>glob to 10.5.0 in package.json:overrides; checked 251 released version(s) of mocha up to 12.0.3 for one whose requirement reaches the menu served for glob (floor 10.5.0) — 0.0.1-alpha1, 0.0.1-alpha2, 0.0.1-alpha3, 0.0.1-alpha4, 0.0.1-alpha5 and 34 more excluded (a pre-release, which no resolver should be steered onto by a bump); 0.0.1, 0.0.2, 0.0.3, 0.0.4, 0.0.5 and 184 more excluded (not a bump: it is at or below the version already locked); 11.0.1 is the lowest that does but it sits outside every range that declares the blocker today; checked 438 released version(s) of @wdio/mocha-framework up to 10.1.0-alpha.30 for one whose requirement reaches the menu served for mocha (floor 11.0.1) — 5.0.0-beta.5, 5.0.0-beta.6, 5.0.0-beta.7, 5.0.0-beta.8, 5.0.0-beta.9 and 89 more excluded (a pre-release, which no resolver should be steered onto by a bump); 5.0.0, 5.0.3, 5.1.0, 5.2.2, 5.2.3 and 336 more excluded (not a bump: it is at or below the version already locked); none of them do","vulnerability_ids":[],"admittance_gap":0,"reachability":null},{"package_name":"tar-fs","spec":"3.0.4","classification":"scoped_override_residue","detail":"@puppeteer/browsers caps tar-fs at 3.0.4, so the fix is delivered by a single scoped override pinning @puppeteer/browsers>tar-fs to 3.1.3 in package.json:overrides; checked 88 released version(s) of @puppeteer/browsers up to 3.2.5 for one whose requirement reaches the menu served for tar-fs (floor 3.1.3) — 0.0.1, 0.0.2, 0.0.3, 0.0.4, 0.0.5 and 30 more excluded (not a bump: it is at or below the version already locked); 2.2.4 is the lowest that does but it sits outside every range that declares the blocker today; checked 381 released version(s) of @wdio/utils up to 10.1.0-alpha.30 for one whose requirement reaches the menu served for @puppeteer/browsers (floor 2.2.4) — 5.4.20, 5.6.0, 5.6.3, 5.6.4, 5.7.0 and 293 more excluded (not a bump: it is at or below the version already locked); 5.13.0-alpha.0, 6.0.0-alpha.0, 6.0.0-alpha.1, 6.0.0-beta.0, 7.0.0-beta.0 and 78 more excluded (a pre-release, which no resolver should be steered onto by a bump); none of them do","vulnerability_ids":[],"admittance_gap":0,"reachability":null}]},{"event":"verify_result","verdict":"residue_documented","cleared":["GHSA-23c5-xmqv-rm74","GHSA-23hp-3jrh-7fpw","GHSA-2883-xcg3-v3hh","GHSA-2g4f-4pwh-qvx6","GHSA-2m8v-j782-fhvr","GHSA-34x7-hfp2-rc4v","GHSA-35jp-ww65-95wh","GHSA-37ch-88jc-xwx2","GHSA-38r7-794h-5758","GHSA-3g43-6gmg-66jw","GHSA-3jxr-9vmj-r5cp","GHSA-3p68-rc4w-qgx5","GHSA-3ppc-4f35-3m26","GHSA-3v7f-55p6-f55p","GHSA-3w6x-2g7m-8v23","GHSA-42h9-826w-cgv3","GHSA-43fc-jf86-j433","GHSA-445q-vr5w-6q77","GHSA-4hqw-qxg8-jxx2","GHSA-4mjr-xmp4-gh2g","GHSA-4x5r-pxfx-6jf8","GHSA-52cp-r559-cp3m","GHSA-5c6j-r48x-rmvq","GHSA-5c9x-8gcm-mpgx","GHSA-5j98-mcp5-4vw2","GHSA-5p4m-2wfm-xmqj","GHSA-5rq4-664w-9x2c","GHSA-62hf-57xw-28j9","GHSA-677m-j7p3-52f9","GHSA-6chq-wfr3-2hj9","GHSA-6j4f-fj2g-mc7p","GHSA-6rw7-vpxm-498p","GHSA-6v7q-wjvx-w8wg","GHSA-73rr-hh4g-fpgx","GHSA-73wf-gq98-2v4g","GHSA-777c-7fjr-54vf","GHSA-7q8q-rj6j-mhjq","GHSA-7r86-cg39-jmmj","GHSA-83g3-92jg-28cx","GHSA-898c-q2cr-xwhg","GHSA-8fgc-7cc6-rx7x","GHSA-8qq5-rm4j-mr97","GHSA-8x88-c5mf-7j5w","GHSA-9fr6-4gfg-395g","GHSA-9ppj-qmqm-q256","GHSA-c2c7-rcm5-vvqj","GHSA-c475-qrg2-pj4r","GHSA-c83g-rgw3-j3cx","GHSA-f23m-r3pf-42rh","GHSA-f886-m6hf-6m8v","GHSA-fv7c-fp4j-7gwp","GHSA-fvcv-3m26-pcqx","GHSA-gvwx-54wh-qm9j","GHSA-h3mg-xc3c-68pw","GHSA-h67p-54hq-rp68","GHSA-hfxv-24rg-xrqf","GHSA-j5f8-grm9-p9fc","GHSA-j6r3-76f7-8jcv","GHSA-j8rh-479h-cp32","GHSA-jqcg-44mw-7w3h","GHSA-jqh4-m9w3-8hp9","GHSA-m7pr-hjqh-92cm","GHSA-mh29-5h37-fv8m","GHSA-mh99-v99m-4gvg","GHSA-mmx7-hfxf-jppx","GHSA-mw96-cpmx-2vgc","GHSA-mwp4-54f8-5fhr","GHSA-p92q-9vqr-4j8v","GHSA-pf86-5x62-jrwf","GHSA-pmv8-rq9r-6j72","GHSA-pmwg-cvhr-8vh7","GHSA-q2hr-2g5m-vwhr","GHSA-q8mj-m7cp-5q26","GHSA-q8qp-cvcw-x6jj","GHSA-qffp-2rhf-9h96","GHSA-qhr7-859c-m2p7","GHSA-qj8w-gfj5-8c6v","GHSA-r292-9mhp-454m","GHSA-r4q5-vmmm-2653","GHSA-r5fr-rjxr-66jc","GHSA-r6q2-hw4h-h46w","GHSA-rgw5-rvv9-x895","GHSA-rp42-5vxx-qpwr","GHSA-rpmf-866q-6p89","GHSA-rpw4-54j3-4h4q","GHSA-v2v4-37r5-5v8g","GHSA-v422-hmwv-36x6","GHSA-vf2m-468p-8v99","GHSA-vh66-26gq-q6x8","GHSA-vmf3-w455-68vh","GHSA-w5hq-g745-h8pq","GHSA-w5vr-8v7q-w6rv","GHSA-w7fw-mjwx-w883","GHSA-w8wr-v893-vjvp","GHSA-w9j2-pvgh-6h63","GHSA-xhjh-pmcv-23jw","GHSA-xx6v-rp6x-q39c","GHSA-xxjr-mmjv-4gpg"],"cleared_scoped":[],"accounted":[{"vulnerability_id":"GHSA-vfj7-8cjw-p6xm","package_name":"braces","trace_event_index":35,"trace_event":"major_line_floor_applied","detail":"- **major line floor** `braces` major line `0` **excluded** — no CVE-free version exists on this line (tier `no_discrimination`): every viable braces 0.x version carries an identical vulnerability set; staying on the best available version 0.1.5 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","reachability":"cannot_determine","reachability_hop":null},{"vulnerability_id":"GHSA-ggr8-5vv4-36mx","package_name":"deepmerge-ts","trace_event_index":44,"trace_event":"major_line_floor_applied","detail":"- **major line floor** `deepmerge-ts` major line `1` **excluded** — no CVE-free version exists on this line (tier `no_discrimination`): every viable deepmerge-ts 1.x version carries an identical vulnerability set; staying on the best available version 1.1.7 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","reachability":"cannot_determine","reachability_hop":null},{"vulnerability_id":"GHSA-7pqw-9j4j-h8q3","package_name":"extract-zip","trace_event_index":59,"trace_event":"major_line_floor_applied","detail":"- **major line floor** `extract-zip` major line `1` **excluded** — no CVE-free version exists on this line (tier `no_discrimination`): every viable extract-zip 1.x version carries an identical vulnerability set; staying on the best available version 1.7.0 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","reachability":"cannot_determine","reachability_hop":null},{"vulnerability_id":"GHSA-jmr9-qjv8-65gv","package_name":"extract-zip","trace_event_index":59,"trace_event":"major_line_floor_applied","detail":"- **major line floor** `extract-zip` major line `1` **excluded** — no CVE-free version exists on this line (tier `no_discrimination`): every viable extract-zip 1.x version carries an identical vulnerability set; staying on the best available version 1.7.0 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","reachability":"cannot_determine","reachability_hop":null},{"vulnerability_id":"GHSA-ch52-4w7c-c8xp","package_name":"http-cache-semantics","trace_event_index":74,"trace_event":"major_line_floor_applied","detail":"- **major line floor** `http-cache-semantics` major line `1` **excluded** — no CVE-free version exists on this line (tier `no_discrimination`): every viable http-cache-semantics 1.x version carries an identical vulnerability set; staying on the best available version 1.0.0 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","reachability":"cannot_determine","reachability_hop":null},{"vulnerability_id":"GHSA-2328-f5f3-gj25","package_name":"node-forge","trace_event_index":107,"trace_event":"major_line_floor_applied","detail":"- **major line floor** `node-forge` major line `0` **excluded** — no CVE-free version exists on this line (tier `no_discrimination`): every viable node-forge 0.x version carries an identical vulnerability set; staying on the best available version 0.10.0 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","reachability":"cannot_determine","reachability_hop":null},{"vulnerability_id":"GHSA-554w-wpv2-vw27","package_name":"node-forge","trace_event_index":107,"trace_event":"major_line_floor_applied","detail":"- **major line floor** `node-forge` major line `0` **excluded** — no CVE-free version exists on this line (tier `no_discrimination`): every viable node-forge 0.x version carries an identical vulnerability set; staying on the best available version 0.10.0 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","reachability":"cannot_determine","reachability_hop":null},{"vulnerability_id":"GHSA-5gfm-wpxj-wjgq","package_name":"node-forge","trace_event_index":107,"trace_event":"major_line_floor_applied","detail":"- **major line floor** `node-forge` major line `0` **excluded** — no CVE-free version exists on this line (tier `no_discrimination`): every viable node-forge 0.x version carries an identical vulnerability set; staying on the best available version 0.10.0 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","reachability":"cannot_determine","reachability_hop":null},{"vulnerability_id":"GHSA-5m6q-g25r-mvwx","package_name":"node-forge","trace_event_index":107,"trace_event":"major_line_floor_applied","detail":"- **major line floor** `node-forge` major line `0` **excluded** — no CVE-free version exists on this line (tier `no_discrimination`): every viable node-forge 0.x version carries an identical vulnerability set; staying on the best available version 0.10.0 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","reachability":"cannot_determine","reachability_hop":null},{"vulnerability_id":"GHSA-65ch-62r8-g69g","package_name":"node-forge","trace_event_index":107,"trace_event":"major_line_floor_applied","detail":"- **major line floor** `node-forge` major line `0` **excluded** — no CVE-free version exists on this line (tier `no_discrimination`): every viable node-forge 0.x version carries an identical vulnerability set; staying on the best available version 0.10.0 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","reachability":"cannot_determine","reachability_hop":null},{"vulnerability_id":"GHSA-86w9-cpqp-85rv","package_name":"node-forge","trace_event_index":107,"trace_event":"major_line_floor_applied","detail":"- **major line floor** `node-forge` major line `0` **excluded** — no CVE-free version exists on this line (tier `no_discrimination`): every viable node-forge 0.x version carries an identical vulnerability set; staying on the best available version 0.10.0 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","reachability":"cannot_determine","reachability_hop":null},{"vulnerability_id":"GHSA-ppp5-5v6c-4jwp","package_name":"node-forge","trace_event_index":107,"trace_event":"major_line_floor_applied","detail":"- **major line floor** `node-forge` major line `0` **excluded** — no CVE-free version exists on this line (tier `no_discrimination`): every viable node-forge 0.x version carries an identical vulnerability set; staying on the best available version 0.10.0 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","reachability":"cannot_determine","reachability_hop":null},{"vulnerability_id":"GHSA-q67f-28xg-22rw","package_name":"node-forge","trace_event_index":107,"trace_event":"major_line_floor_applied","detail":"- **major line floor** `node-forge` major line `0` **excluded** — no CVE-free version exists on this line (tier `no_discrimination`): every viable node-forge 0.x version carries an identical vulnerability set; staying on the best available version 0.10.0 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","reachability":"cannot_determine","reachability_hop":null},{"vulnerability_id":"GHSA-6fx8-h7jm-663j","package_name":"parseuri","trace_event_index":109,"trace_event":"major_line_floor_applied","detail":"- **major line floor** `parseuri` major line `0` **excluded** — no CVE-free version exists on this line (tier `no_discrimination`): every viable parseuri 0.x version carries an identical vulnerability set; keeping the locked version 0.0.6 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","reachability":"cannot_determine","reachability_hop":null},{"vulnerability_id":"GHSA-hp3w-g68c-fv3c","package_name":"sprintf-js","trace_event_index":142,"trace_event":"major_line_floor_applied","detail":"- **major line floor** `sprintf-js` major line `0` **excluded** — no CVE-free version exists on this line (tier `no_discrimination`): every viable sprintf-js 0.x version carries an identical vulnerability set; staying on the best available version 0.0.7 rather than forcing churn for zero gain (M7). The strict view excludes the whole line; keeping it is a re-admission the loop has to record.","reachability":"cannot_determine","reachability_hop":null}],"unaccounted":[],"unverified":[],"diverged_packages":[]},{"event":"context_source","mode":"db_first","advisory_corpus_age_days":0,"external_calls":0,"packages_by_layer":{}}]}