Problem
OSV-Scanner flags 3 vulnerabilities in docs/remotion/package-lock.json (transitive deps). The Security workflow fails on main because of them (google/osv-scanner-action, --exit-code 1).
- fast-uri < 3.1.2 — percent-encoded authority/path-segment decoding enables URI authority confusion and path-normalization allowlist bypass.
- ws < 8.20.1 — uninitialized memory disclosure when a
TypedArray is passed as the close() reason.
All three are pulled in transitively by remotion under docs/remotion/; the app's own runtime deps are unaffected (zero-dependency core).
Fix
Update docs/remotion/ so the lockfile resolves fast-uri ≥ 3.1.2 and ws ≥ 8.20.1. Likely covered by the open Dependabot remotion bumps (e.g. remotion 4.0.468); otherwise add explicit overrides in docs/remotion/package.json and regenerate the lockfile.
Acceptance
Filed via /ai-issue. CVE data from the repo code-scanning alerts (OSV-Scanner).
Problem
OSV-Scanner flags 3 vulnerabilities in
docs/remotion/package-lock.json(transitive deps). The Security workflow fails onmainbecause of them (google/osv-scanner-action,--exit-code 1).fast-urifast-uriwsTypedArrayis passed as theclose()reason.All three are pulled in transitively by
remotionunderdocs/remotion/; the app's own runtime deps are unaffected (zero-dependency core).Fix
Update
docs/remotion/so the lockfile resolvesfast-uri ≥ 3.1.2andws ≥ 8.20.1. Likely covered by the open Dependabot remotion bumps (e.g.remotion 4.0.468); otherwise add explicit overrides indocs/remotion/package.jsonand regenerate the lockfile.Acceptance
docs/remotion/package-lock.jsonresolvesfast-uri ≥ 3.1.2andws ≥ 8.20.1mainFiled via /ai-issue. CVE data from the repo code-scanning alerts (OSV-Scanner).