dubinc/dub dependency check
The modern link attribution platform. Loved by world-class marketing teams like Framer, Perplexity, Superhuman, Twilio, Buffer and more.
dubinc/dub: 11 critical findings, each with a fixed version. Plus 20 warnings.
Last checked against GitHub, OSV.dev, deps.dev, CISA KEV, FIRST EPSS, npm and endoflife.date.
31 things your coding agent doesn’t know about this repo
dubinc/dub on GitHub (opens in a new tab)
11 critical20 warnings43 low priority
One task with every fix, most urgent first, the file to change and why. Paste it into Claude Code, Cursor or Codex.
- CriticalVulnerabilitypackages/embeds/react/package.json
15 known vulnerabilities in vite 5.2.9
Exploited in the wild (CISA)EPSS: top 1%Dev only1 rated high or critical. Most serious: CVE-2025-31125, Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query. Upgrading to 6.4.3 fixes all of them.
- CriticalVulnerabilityapps/web/package.json
31 known vulnerabilities in next 15.5.8
EPSS: top 3%15 rated high or critical. Most serious: CVE-2025-67779, Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up. Upgrading to 15.5.27 fixes all of them.
- CriticalVulnerabilitypackages/email/package.json
15 known vulnerabilities in nodemailer 6.9.3
EPSS: top 20%5 rated high or critical. Most serious: CVE-2026-92596, Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address list. Upgrading to 10.0.6 fixes all of them.
- CriticalVulnerabilityapps/web/package.json
6 known vulnerabilities in fast-xml-parser 5.0.6
EPSS: top 39%3 rated high or critical. Most serious: CVE-2026-26278, fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit). Upgrading to 5.7.0 fixes all of them.
- CriticalVulnerabilityapps/web/package.json
CVE-2026-46625 in js-cookie 3.0.5
EPSS: top 39%JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection. Fixed in 3.0.7.
- CriticalVulnerabilityapps/web/package.json
CVE-2026-8657 in jsondiffpatch 0.7.3
EPSS: top 50%jsondiffpatch patch APIs are vulnerable to prototype pollution. Fixed in 0.7.6.
- CriticalVulnerabilityapps/web/package.json
4 known vulnerabilities in nanoid 5.0.1
EPSS: top 50%3 rated high or critical. Most serious: CVE-2026-67213, nanoid: custom generators can loop indefinitely when size is zero. Upgrading to 5.1.16 fixes all of them.
- CriticalVulnerabilitypackages/cli/package.json
4 known vulnerabilities in nanoid 5.0.7
EPSS: top 50%3 rated high or critical. Most serious: CVE-2026-67213, nanoid: custom generators can loop indefinitely when size is zero. Upgrading to 5.1.16 fixes all of them.
- CriticalVulnerabilityapps/web/package.json
3 known vulnerabilities in minimatch 10.1.1
EPSS: top 53%3 rated high or critical. Most serious: CVE-2026-27903, minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments. Upgrading to 10.2.3 fixes all of them.
- CriticalVulnerabilityapps/web/package.json
CVE-2025-27611 in base-x 5.0.0
EPSS: top 63%Homograph attack allows Unicode lookalike characters to bypass validation. Fixed in 5.0.1.
- CriticalVulnerabilityapps/web/package.json
10 known vulnerabilities in undici 7.29.0
EPSS: top 67%2 rated high or critical. Most serious: CVE-2026-19534, undici vulnerable to Denial of Service via unrequested WebSocket subprotocol. Upgrading to 7.29.1 fixes all of them.
- WarningVulnerabilityapps/web/package.json
5 known vulnerabilities in vite 7.2.2
EPSS: top 15%Dev onlyMost serious: CVE-2026-39363, Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket. Upgrading to 7.3.5 fixes all of them.
- WarningVulnerabilityapps/web/package.json
2 known vulnerabilities in vitest 4.0.8
EPSS: top 42%Dev onlyMost serious: CVE-2026-47429, When Vitest UI server is listening, arbitrary file can be read and executed. Upgrading to 4.1.11 fixes all of them.
- WarningVulnerabilityapps/web/package.json
4 known vulnerabilities in postcss 8.4.31
EPSS: top 53%Dev onlyMost serious: CVE-2026-45623, PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments. Upgrading to 8.5.23 fixes all of them.
- WarningVulnerabilityapps/web/package.json
2 known vulnerabilities in file-type 20.4.1
EPSS: top 63%Most serious: CVE-2026-32630, file-type: ZIP Decompression Bomb DoS via [Content_Types].xml entry. Upgrading to 21.3.2 fixes all of them.
- WarningVulnerabilityapps/web/package.json
CVE-2026-41907 in uuid 11.0.3
EPSS: top 70%uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided. Fixed in 11.1.1.
- WarningVulnerabilityapps/web/package.json
3 known vulnerabilities in sanitize-html 2.17.0
EPSS: top 76%Most serious: CVE-2026-63670, ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close. Upgrading to 2.17.7 fixes all of them.
- WarningVulnerabilityapps/web/package.json
CVE-2026-9673 in json-2-csv 5.5.0
EPSS: top 87%json-2-csv vulnerable to CSV Injection via the preventCsvInjection optio. Fixed in 5.5.11.
- WarningEnd of lifeapps/web/package.json
Next.js 15 reaches end-of-life in 6 days
Support ends 2026-10-21. Plan an upgrade to Next.js 16 LTS.
- WarningMaintenanceapps/web/package.json
@team-plain/typescript-sdk is deprecated on npm
The maintainers' deprecation notice: "This package is now deprecated. Please use @team-plain/graphql, @team-plain/webhooks and @team-plain/ui-components (https://github.com/team-plain/sdk)"
- WarningMaintenanceapps/web/package.json
@types/base-x is deprecated on npm
The maintainers' deprecation notice: "This is a stub types definition. base-x provides its own type definitions, so you do not need this installed."
- WarningMaintenanceapps/web/package.json
@types/bcryptjs is deprecated on npm
The maintainers' deprecation notice: "This is a stub types definition. bcryptjs provides its own type definitions, so you do not need this installed."
- WarningMaintenanceapps/web/package.json
@types/buffer-crc32 is deprecated on npm
The maintainers' deprecation notice: "This is a stub types definition. buffer-crc32 provides its own type definitions, so you do not need this installed."
- WarningMaintenanceapps/web/package.json
@vercel/edge-config is deprecated on npm
The maintainers' deprecation notice: "This package has been renamed to @vercel/global-config. Install @vercel/global-config instead."
- WarningOutdatedapps/web/package.json
@boxyhq/saml-jackson 1.52.1 is 25 major versions behind
Latest release is 26.2.0.
- WarningOutdatedapps/web/package.json
@mendable/firecrawl-js 1.29.1 is 3 major versions behind
Latest release is 4.46.0.
- WarningOutdatedapps/web/package.json
@stripe/stripe-js 7.3.1 is 3 major versions behind
Latest release is 10.1.0.
- WarningOutdatedapps/web/package.json
@visx/geo 2.10.0 is 2 major versions behind
Latest release is 4.0.0.
- WarningOutdatedapps/web/package.json
@visx/grid 2.12.2 is 2 major versions behind
Latest release is 4.0.0.
- WarningOutdatedapps/web/package.json
@visx/responsive 2.10.0 is 2 major versions behind
Latest release is 4.0.0.
- WarningOutdatedapps/web/package.json
@visx/shape 2.12.2 is 2 major versions behind
Latest release is 4.0.0.
Checked 241 packages from package.json and pnpm-lock.yaml against:
Add this badge to your README
It shows today’s result and links to this report, so anyone opening the repo sees what needs fixing.
[](https://stackprism.ai/check/github/dubinc/dub)What next
Want your agent to check before it adds a package? Connect Claude Code, Cursor or Codex to StackPrism. Setup steps
Ask Prism Agent about dubinc/dub
Map the repo (free) and ask what to fix first, whether an upgrade is safe, or what breaks if a service goes down. Prism Agent checks live sources before it answers.
How this report works
StackPrism read package.json and pnpm-lock.yaml from the default branch of dubinc/dub and checked its 241 packages against GitHub, OSV.dev, deps.dev, CISA KEV, FIRST EPSS, npm and endoflife.date. Nothing was installed or run, and there’s no AI in the findings: each one comes from a source you can open.
Vulnerabilities come from OSV.dev, with known-exploited ones from CISA marked and listed first. Runtimes, frameworks and base images are checked against endoflife.date, and packages against their registry for deprecations and major versions you’ve fallen behind. The fix task above lists every change with the file to edit.
This page refreshes every few hours; after you push a fix, “Check again” runs it now. Only the repo’s root is read. For an app in a sub-folder, paste the folder’s link into the dependency check, and for a private repo, connect GitHub.