[ralyodio]

Fleet dependency upgrade (2026-10-26). Driver: Next.js unauthenticated RCE (GHSA-2464-fhr4-w9xw, GHSA-673q-mjm6-r5xr) and the critical @sentry/nextjs advisory (<10.75.2).

Root (bun)

• next 16.3.8 -> 16.4.3, eslint-config-next 16.4.3
• @sentry/nextjs 10.56.0 -> 11.9.0: withSentryConfig moved to @sentry/nextjs/config (next.config.ts updated)
• Majors taken: @sentry/nextjs 11, eslint 10, vitest 5, lint-staged 17, @testing-library/jest-dom 7, @types/node 26, typescript 5 -> 6, @supabase/ssr 0.12, @profullstack/stack 0.5, x402-gateway 0.13
• Held: typescript 7.0.2 (typescript-eslint peer is <6.1.0, eslint crashes "does not support TS 7.0"), kept on 6.0.3; jsdom 30 (vitest under bun --bun fails "addEventListener called on an object that is not a valid instance of EventTarget"), kept on 29.1.1
• bun.lock regenerated; stale range overrides removed (they pinned vulnerable versions)
• .nixpacks/Dockerfile oven/bun 1.4.0-slim -> 1.4.4-slim

electron/ (pnpm): electron 39 -> 45, electron-vite 5 -> 6, vite 7 -> 8, typescript 7, electron-builder 26.18; build passes
mobile/ (pnpm): held on Expo SDK 52 / RN 0.76 (latest SDK 58 is 6 majors and cannot be verified without paid EAS builds); lock refreshed in range plus overrides for tar, @xmldom/xmldom, postcss
cli/: no dependencies, unchanged

Audit crit/high (advisories)

• root bun audit: 3 critical / 37 high -> 0 / 0
• electron pnpm audit: 1 / 53 -> 0 / 0
• mobile pnpm audit: 2 / 60 -> 0 / 3 (image-size via metro, fix only in 2.x; node-forge via @expo/cli, no fix)

Gate (local): typecheck clean, lint 0 errors (1 pre-existing warning), 306/306 tests, next build OK, electron build OK, mobile tsc + expo config OK.

🤖 Generated with Claude Code

[github-actions]

ThreatCrush Security Scan

12 finding(s)

HIGH/CRITICAL: 2 | MEDIUM: 4 | LOW: 6

Severity	Rule	Location
HIGH	sh-unquoted-expansion-destructive	public/install.sh:67
HIGH	sh-remote-script-execution	public/install.sh:89
MEDIUM	sh-remote-script-execution	public/install.sh:133
MEDIUM	js-open-redirect	src/app/numbers/page.tsx:178
MEDIUM	js-open-redirect	src/components/inbox-client.tsx:35
MEDIUM	js-unescaped-html-sink	src/components/pit-footer.tsx:17
LOW	secret-generic-credential	src/lib/providers/__tests__/twilio.test.ts:24
LOW	secret-generic-credential	src/lib/providers/__tests__/twilio.test.ts:46
LOW	secret-generic-credential	src/lib/providers/__tests__/twilio.test.ts:60
LOW	secret-generic-credential	src/lib/providers/__tests__/twilio.test.ts:78
LOW	secret-generic-credential	supabase/config.toml:287
LOW	secret-generic-credential	supabase/config.toml:319

Snippets are redacted; ThreatCrush never prints matched credential material.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	next@​16.3.8 ⏵ 16.4.3	+1	+75	+1
	eslint-config-next@​16.3.8 ⏵ 16.4.3			+2
	electron-builder@​26.15.0 ⏵ 26.18.0
	@​typescript-eslint/​parser@​8.57.1 ⏵ 8.72.0			+1
	@​types/​react-dom@​19.2.3 ⏵ 19.3.0	+1		+1
	@​profullstack/​profile@​0.1.3 ⏵ 0.1.6	+1		+1
	electron-updater@​6.8.3 ⏵ 6.8.11			+1	+1
	@​profullstack/​footer@​0.2.1 ⏵ 0.2.6	+4		+1	+5
	@​types/​react@​19.2.14 ⏵ 19.3.0
	@​babel/​runtime@​7.29.7 ⏵ 7.29.10
	vitest@​4.1.8 ⏵ 5.0.5		+2	+1	+2
	@​typescript-eslint/​eslint-plugin@​8.57.1 ⏵ 8.72.0			+1
	@​profullstack/​stack@​0.1.3 ⏵ 0.5.0	+8		+1	+7
	@​types/​node@​25.5.0 ⏵ 26.6.5	+1		+1
	postcss@​8.5.15 ⏵ 8.5.31	+1	+18		-1
	@​sentry/​nextjs@​10.56.0 ⏵ 11.9.0	+2	+75	-9
	vite@​7.3.5 ⏵ 8.3.5	+1	+21	+1
	tailwindcss@​4.3.0 ⏵ 4.3.3	+1		+1	+2
	react@​19.2.4 ⏵ 19.3.1	+1		+1
	@​eslint/​eslintrc@​3.3.5 ⏵ 3.3.7
	@​testing-library/​jest-dom@​6.9.1 ⏵ 7.0.1
	@​supabase/​supabase-js@​2.107.0 ⏵ 2.118.0	+7			+2
	@​profullstack/​x402-gateway@​0.11.0 ⏵ 0.13.1			+1	+1
	typescript@​7.0.2
	@​testing-library/​react@​16.3.2 ⏵ 16.3.3	+1
	typescript@​6.0.3
	react-dom@​19.2.7 ⏵ 19.3.1			+1
	lint-staged@​16.4.0 ⏵ 17.6.0	+1			-1
	electron-vite@​5.0.0 ⏵ 6.0.0			+1	+2
	@​testing-library/​user-event@​14.6.1 ⏵ 14.6.8
	eslint@​9.39.4 ⏵ 10.13.0	+1			+45
See 4 more rows in the dashboard

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority	Alert  (click "▶" to expand/collapse)	Action
	License policy violation: npm @sentry/server-runtime-injection under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/build/THIRD-PARTY-LICENSES.txt) From: package.json → npm/@sentry/nextjs@11.9.0 → npm/@sentry/server-runtime-injection@11.9.0 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@sentry/server-runtime-injection@11.9.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Publisher changed: npm bser is now published by fb-watchman Author: fb-watchman From: mobile/pnpm-lock.yaml → npm/react-native@0.76.9 → npm/bser@2.1.2 ℹ Read more on: This package | This alert | What is unstable ownership? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Try to reduce the number of authors you depend on to reduce the risk to malicious actors gaining access to your supply chain. Packages should remove inactive collaborators with publishing rights from packages on npm. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/bser@2.1.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Publisher changed: npm fb-watchman is now published by fb-watchman Author: fb-watchman From: mobile/pnpm-lock.yaml → npm/react-native@0.76.9 → npm/fb-watchman@2.0.4 ℹ Read more on: This package | This alert | What is unstable ownership? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Try to reduce the number of authors you depend on to reduce the risk to malicious actors gaining access to your supply chain. Packages should remove inactive collaborators with publishing rights from packages on npm. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/fb-watchman@2.0.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm playwright-core under ms-azure-data-studio License: ms-azure-data-studio - The applicable license policy does not permit this license (5) (package/ThirdPartyNotices.txt) License: MIT WITH Google-Patent-WebM - The applicable license policy does not permit this license (5) (package/lib/webp_codec.LICENSE) From: package.json → npm/@playwright/test@1.64.1 → npm/playwright-core@1.64.1 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/playwright-core@1.64.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm playwright under ms-azure-data-studio License: ms-azure-data-studio - The applicable license policy does not permit this license (5) (package/ThirdPartyNotices.txt) From: package.json → npm/@playwright/test@1.64.1 → npm/playwright@1.64.1 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/playwright@1.64.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm rollup under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/LICENSE.md) From: package.json → npm/@sentry/nextjs@11.9.0 → npm/rollup@4.65.1 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/rollup@4.65.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm sentry License: The package entry has license metadata, but it could not be parsed - This license was not allowed or given any lesser classification by the applicable policy (npm metadata) License: FSL-1.1-Apache-2.0 - This license classifier is not allowed by the applicable policy (package/package.json) License: LicenseRef-FSL-1.1-ALv2 - The applicable license policy does not permit this license (5) (package/LICENSE.md) From: package.json → npm/@sentry/nextjs@11.9.0 → npm/sentry@0.45.0 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/sentry@0.45.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Low adoption: npm @profullstack/stack Location: Package overview From: package.json → npm/@profullstack/stack@0.5.0 ℹ Read more on: This package | This alert | What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@profullstack/stack@0.5.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Deprecated by its maintainer: npm uuid Reason: uuid@10 and below is no longer supported. For ESM codebases, update to uuid@latest. For CommonJS codebases, use uuid@11 (but be aware this version will likely be deprecated in 2028). From: mobile/pnpm-lock.yaml → npm/expo@52.0.49 → npm/expo-constants@17.0.8 → npm/uuid@7.0.3 ℹ Read more on: This package | This alert | What is a deprecated package? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Research the state of the package and determine if there are non-deprecated versions that can be used, or if it should be replaced with a new, supported solution. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/uuid@7.0.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Deprecated by its maintainer: npm uuid Reason: uuid@10 and below is no longer supported. For ESM codebases, update to uuid@latest. For CommonJS codebases, use uuid@11 (but be aware this version will likely be deprecated in 2028). From: mobile/pnpm-lock.yaml → npm/expo@52.0.49 → npm/uuid@8.3.2 ℹ Read more on: This package | This alert | What is a deprecated package? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Research the state of the package and determine if there are non-deprecated versions that can be used, or if it should be replaced with a new, supported solution. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/uuid@8.3.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm @typescript/typescript-aix-ppc64 under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/NOTICE.txt) From: electron/pnpm-lock.yaml → npm/typescript@7.0.2 → npm/@typescript/typescript-aix-ppc64@7.0.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-aix-ppc64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm @typescript/typescript-darwin-arm64 under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/NOTICE.txt) From: electron/pnpm-lock.yaml → npm/typescript@7.0.2 → npm/@typescript/typescript-darwin-arm64@7.0.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-darwin-arm64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm @typescript/typescript-darwin-x64 under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/NOTICE.txt) From: electron/pnpm-lock.yaml → npm/typescript@7.0.2 → npm/@typescript/typescript-darwin-x64@7.0.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-darwin-x64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm @typescript/typescript-freebsd-arm64 under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/NOTICE.txt) From: electron/pnpm-lock.yaml → npm/typescript@7.0.2 → npm/@typescript/typescript-freebsd-arm64@7.0.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-freebsd-arm64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm @typescript/typescript-freebsd-x64 under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/NOTICE.txt) From: electron/pnpm-lock.yaml → npm/typescript@7.0.2 → npm/@typescript/typescript-freebsd-x64@7.0.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-freebsd-x64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm @typescript/typescript-linux-arm under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/NOTICE.txt) From: electron/pnpm-lock.yaml → npm/typescript@7.0.2 → npm/@typescript/typescript-linux-arm@7.0.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-linux-arm@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm @typescript/typescript-linux-arm64 under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/NOTICE.txt) From: electron/pnpm-lock.yaml → npm/typescript@7.0.2 → npm/@typescript/typescript-linux-arm64@7.0.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-linux-arm64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm @typescript/typescript-linux-loong64 under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/NOTICE.txt) From: electron/pnpm-lock.yaml → npm/typescript@7.0.2 → npm/@typescript/typescript-linux-loong64@7.0.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-linux-loong64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm @typescript/typescript-linux-mips64el under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/NOTICE.txt) From: electron/pnpm-lock.yaml → npm/typescript@7.0.2 → npm/@typescript/typescript-linux-mips64el@7.0.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-linux-mips64el@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm @typescript/typescript-linux-ppc64 under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/NOTICE.txt) From: electron/pnpm-lock.yaml → npm/typescript@7.0.2 → npm/@typescript/typescript-linux-ppc64@7.0.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-linux-ppc64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm @typescript/typescript-linux-riscv64 under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/NOTICE.txt) From: electron/pnpm-lock.yaml → npm/typescript@7.0.2 → npm/@typescript/typescript-linux-riscv64@7.0.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-linux-riscv64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm @typescript/typescript-linux-s390x under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/NOTICE.txt) From: electron/pnpm-lock.yaml → npm/typescript@7.0.2 → npm/@typescript/typescript-linux-s390x@7.0.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-linux-s390x@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm @typescript/typescript-linux-x64 under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/NOTICE.txt) From: electron/pnpm-lock.yaml → npm/typescript@7.0.2 → npm/@typescript/typescript-linux-x64@7.0.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-linux-x64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm @typescript/typescript-netbsd-arm64 under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/NOTICE.txt) From: electron/pnpm-lock.yaml → npm/typescript@7.0.2 → npm/@typescript/typescript-netbsd-arm64@7.0.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-netbsd-arm64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
See 8 more rows in the dashboard

View full report