ROOT-APP-NPM-GHSA-GV7W-RQVM-QJHR GHSA-gv7w-rqvm-qjhr in esbuild - Patched by Root

Root has patched GHSA-gv7w-rqvm-qjhr in the esbuild package for Root:npm. Multiple fixed versions available...

03-gs-ee-6 (0.3.5), @adhd/workspace-codegen-nx (>=0.1.3, <=0.1.5) +3135 more potentially affected by CVE-2026-102278 via brace-expansion (>=4.0.0, <=5.0.9)

brace-expansion NPM version =4.0.0, =0.1.3, =0.0.1-alpha.5, =0.0.4, =1.1.7, =1.1.8 - @angranit/fantom-virma 0.1.0 - @angranit/first-step-to-get-tea 0.1.0 - @angranit/hapeipons 1.1.2 - @angranit/nearly-vm 0.1.0 - @angranit/newme-project 0.1.0 - @angranit/npmjs-for-tea-project 0.1.0 and more Source...

@algolia/coquille (>=0.0.2, <=0.0.13), @candlelabs/sdk (>=1.0.1, <=1.0.2) +28 more potentially affected by CVE-2026-102276 via brace-expansion (>=1.1.0, <=1.1.16)

brace-expansion NPM version =1.1.0, =0.0.2, =1.0.1, =0.0.1, =0.1.0, =1.0.0, =1.0.0, =2.9.6-canary.2, =0.0.3, =0.1.0 and more Source cves: CVE-2026-102276 Source advisory: SNYK:JS-BRACEEXPANSION-20244952...

0.extends.fc (1.0.65), 0.extends.react (1.0.51) +10440 more potentially affected by CVE-2026-100701 via nodemailer (>=5.0.0, <=10.0.1)

nodemailer NPM version =5.0.0, =1.0.49, =1.0.1, =1.0.0, =1.0.0, =0.2.9, =0.2.19 and more Source cves: CVE-2026-100701 Source advisory: OSV:GHSA-6VJ9-MWQ6-2F5V...

@aliceo2/bookkeeping (>=1.19.0, <=1.20.0), @beyondnet/evolith-cli (>=1.2.0, <=1.3.2) +67 more potentially affected by CVE-2026-88932 via multer (>=2.2.0, <=2.3.0)

multer NPM version =2.2.0, =1.19.0, =1.2.0, =1.2.0, =2026.7.0, =5.7.5, =11.1.29-depup.0, =0.1.0, =0.1.0, =11.0.62, =1.2.34, =12.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.1 and more Source cves: CVE-2026-88932 Source advisory: GHSA-3PPH-FPJX-JG34...

@142vip/egg-grpc-client (>=0.0.1-alpha.3, <=0.0.1-alpha.4), @142vip/egg-grpc-server (>=0.0.1-alpha.3, <=0.0.1-alpha.5) +244 more potentially affected by CVE-2026-101916 via @grpc/grpc-js (>=1.14.0, <=1.14.4)

@grpc/grpc-js NPM version =1.14.0, =0.0.1-alpha.3, =0.0.1-alpha.3, =0.0.1-alpha.2, =0.26.4, =3.2.4, =1.13.0, =2.0.2, =0.1.0-alpha.0, =0.1.0, =2.1.0, =2.2.2, =2.0.0, =0.0.4, =0.0.35 and more Source cves: CVE-2026-101916 Source advisory: SNYK:JS-GRPCGRPCJS-20251010...

10xscale-agentflow-cli (0.1.5), 360solutions-bc-mcp (>=0.5.3, <=0.5.7) +1689 more potentially affected by CVE-2026-102267 via pyjwt (>=2.0.0a2, <=2.13.0)

pyjwt PYPI version =2.0.0a2, =0.5.3, =2.3.0, =0.1.0, =1.0.0, =1.8.26, =1.1.0rc1, =1.0.1, =0.1.0.post1, =0.1.5, =2.3.10rc8, =0.0.9rc17, =1.2.0, =1.2.1 - adminui 1.5.2 and more Source cves: CVE-2026-102267 Source advisory: SNYK:PYTHON-PYJWT-20250951...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @diviops/mcp-server (>=1.5.40, <=1.5.43) +32 more potentially affected by CVE-2026-84292 via fast-uri (>=3.0.1, <=3.1.6)

fast-uri NPM version =3.0.1, =0.3.1, =1.5.40, =1.6.0, =1.4.2, =1.2.0, =0.17.1, =5.4.3, =0.2.0-alpha.5, =0.1.0, =0.1.27 and more Source cves: CVE-2026-84292 Source advisory: GHSA-QW65-CVWX-89V3...

10xscale-agentflow-cli (0.1.5), 360solutions-bc-mcp (>=0.5.3, <=0.5.7) +1591 more potentially affected by CVE-2026-102275 via pyjwt (>=2.1.0, <=2.14.0)

pyjwt PYPI version =2.1.0, =0.5.3, =2.3.0, =0.1.0, =1.0.0, =1.8.26, =1.1.0rc1, =1.0.1, =0.1.0.post1, =0.1.5, =2.3.10rc8, =0.0.9rc17, =1.2.0, =1.5.2, =1.5.6 and more Source cves: CVE-2026-102275 Source advisory: OSV:PYSEC-2026-4183...

@algolia/coquille (>=0.0.2, <=0.0.13), @candlelabs/sdk (>=1.0.1, <=1.0.2) +29 more potentially affected by CVE-2026-102278 via brace-expansion (>=0.0.0, <=1.1.16)

brace-expansion NPM version =0.0.0, =0.0.2, =1.0.1, =0.0.1, =0.1.0, =1.0.0, =1.0.0, =2.9.6-canary.2, =0.0.0, =2.0.0 - beelinejs-todo-mvc 0.1.1 - byte-common 1.0.0 - candlelabssdk 1.0.0 - capacitor-firebase-authentication 1.0.0 and more Source cves: CVE-2026-102278 Source advisory:...

@algolia/coquille (>=0.0.2, <=0.0.13), @candlelabs/sdk (>=1.0.1, <=1.0.2) +29 more potentially affected by CVE-2026-102277 via brace-expansion (>=0.0.0, <=1.1.16)

brace-expansion NPM version =0.0.0, =0.0.2, =1.0.1, =0.0.1, =0.1.0, =1.0.0, =1.0.0, =2.9.6-canary.2, =0.0.0, =2.0.0 - beelinejs-todo-mvc 0.1.1 - byte-common 1.0.0 - candlelabssdk 1.0.0 - capacitor-firebase-authentication 1.0.0 and more Source cves: CVE-2026-102277 Source advisory:...

03-gs-ee-6 (0.3.5), @adhd/workspace-codegen-nx (>=0.1.3, <=0.1.5) +3135 more potentially affected by CVE-2026-102277 via brace-expansion (>=4.0.0, <=5.0.9)

brace-expansion NPM version =4.0.0, =0.1.3, =0.0.1-alpha.5, =0.0.4, =1.1.7, =1.1.8 - @angranit/fantom-virma 0.1.0 - @angranit/first-step-to-get-tea 0.1.0 - @angranit/hapeipons 1.1.2 - @angranit/nearly-vm 0.1.0 - @angranit/newme-project 0.1.0 - @angranit/npmjs-for-tea-project 0.1.0 and more Source...

ai.pipestream.proto-toolchain:ai.pipestream.proto-toolchain.gradle.plugin (>=0.7.24, <=0.7.26), ai.pipestream:quarkus-buf-grpc-generator (>=0.7.24, <=0.7.26) +2142 more potentially affected by CVE-2026-83557 via tools.jackson.core:jackson-databind (>=3.2.0, <=3.2.1)

tools.jackson.core:jackson-databind MAVEN version =3.2.0, =0.7.24, =0.7.24, =2.2.0, =2.2.0, =2.2.0, =2.2.0, =2.2.0, =2.2.0, =2.0.0-alpha4, =2.0.0-alpha4, =2.0.0-alpha4, =2.0.0-alpha4, =2.0.0-alpha4, =2.0.0-alpha6 - at.meks.quarkiverse.axonframework-extension:quarkus-axon-metrics...

ac.pao:reports-web (1.0.0), ai.agentican:agentican-quarkus-deployment (>=0.1.0-alpha.1, <=0.1.0-alpha.4) +34584 more potentially affected by CVE-2026-83557 via com.fasterxml.jackson.core:jackson-databind (>=2.19.0, <=2.21.5)

com.fasterxml.jackson.core:jackson-databind MAVEN version =2.19.0, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.1, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.6 and more Source cves:...

ai.covia:covia-claude-code (>=0.9.3, <=0.9.10), ai.covia:covia-discord (>=0.9.4, <=0.9.9) +9469 more potentially affected by CVE-2026-83557 via com.fasterxml.jackson.core:jackson-databind (>=2.22.0, <=2.22.1)

com.fasterxml.jackson.core:jackson-databind MAVEN version =2.22.0, =0.9.3, =0.9.4, =0.9.7, =0.8.0, =0.9.9, =0.9.6, =0.7.0, =0.9.3, =0.9.9, =0.7.0, =0.7.0, =0.1.0-beta.1, =1.4.0, =1.4.0, =1.4.0, =2.0.0 and more Source cves: CVE-2026-83557 Source advisory: OSV:GHSA-GX83-3VF8-GH7J...

@aikidosec/broker-client (1.0.51), @app4you/n8n-nodes-portal-invoices (>=0.3.1, <=0.3.11) +43 more potentially affected by CVE-2026-101910 via ip-address (>=10.2.0, <=10.5.0)

ip-address NPM version =10.2.0, =0.3.1, =1.5.40, =1.6.0, =4.2.2, =0.17.1, =2.7.9, =4.0.3, =3.1.58, =2.6.55, =3.7.6, =2.7.130, =3.1.50, =4.0.4, =4.0.27 and more Source cves: CVE-2026-101910 Source advisory: OSV:GHSA-2VR4-CQ9G-PVRC...

360solutions-bc-mcp (>=0.5.3, <=0.5.7), a-beta-scalekit (>=2.3.0, <=4.0.2) +731 more potentially affected by CVE-2026-102274 via pyjwt (>=2.9.0, <=2.13.0)

pyjwt PYPI version =2.9.0, =0.5.3, =2.3.0, =1.1.0rc1, =1.0.1, =2.4.2rc9, =1.2.0, =0.1.1, =3.0.0, =0.1.8, =0.0.116, =0.1.31, =0.1.0, =0.1.5 and more Source cves: CVE-2026-102274 Source advisory: MEND:CVE-2026-102274...

10xscale-agentflow-cli (0.1.5), 360solutions-bc-mcp (>=0.5.3, <=0.5.7) +2347 more potentially affected by CVE-2026-102271 via pyjwt (>=1.0.1, <=2.13.0)

pyjwt PYPI version =1.0.1, =0.5.3, =2.3.0, =0.1.0, =1.0.0, =0.1.1, =1.8.26, =1.1.0rc1, =1.0.1, =0.1.0.post1, =0.1.5, =2.3.10rc8, =0.0.9rc17, =0.8.44.4rc1, =0.9.2.1 and more Source cves: CVE-2026-102271 Source advisory: MEND:CVE-2026-102271...

360solutions-bc-mcp (0.5.7), acapy-agent (>=1.6.1rc0, <=1.7.0) +197 more potentially affected by CVE-2026-102266 via pyjwt (2.13.0)

pyjwt PYPI version 2.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - 360solutions-bc-mcp 0.5.7 - acapy-agent =1.6.1rc0, =0.1.8, =0.0.116, =1.420.5, =26.6.0, =0.25.0, =0.57.0, =0.1.0, =0.1.0, =1.1.0, =3.8.0, =3.9.3 and...

ai.covia:covia-claude-code (>=0.9.3, <=0.9.10), ai.covia:covia-discord (>=0.9.4, <=0.9.9) +9469 more potentially affected by CVE-2026-68497 via com.fasterxml.jackson.core:jackson-databind (>=2.22.0, <=2.22.1)

com.fasterxml.jackson.core:jackson-databind MAVEN version =2.22.0, =0.9.3, =0.9.4, =0.9.7, =0.8.0, =0.9.9, =0.9.6, =0.7.0, =0.9.3, =0.9.9, =0.7.0, =0.7.0, =0.1.0-beta.1, =1.4.0, =1.4.0, =1.4.0, =2.0.0 and more Source cves: CVE-2026-68497 Source advisory: GHSA-Q4XH-88C3-WMH7...