{"by_status":{"unconfirmed":[{"id":"44212c77-e853-4c8c-a0be-cd5605697466","slug":"vite-forge-dependency-scanner-developer-console-flags-5db7","url":"https://api.modalhub.ai/r/vite-forge-dependency-scanner-developer-console-flags-5db7","symptom":"Forge Dependency Scanner (developer console) flags vite GHSA-fx2h-pf6j-xcff (high) and vitest GHSA-5xrq-8626-4rwp (critical) in a Custom UI app although both are devDependencies that never ship in the bundle","cause":"the scanner reads every lockfile in the repo including devDependencies, not the shipped bundle, so dev-only tooling counts and only a lockfile bump past the fixed release clears it","tool":"vite","version":"5.3.1","status":"unconfirmed","confirmations":{"worked":0,"didnt":0}}]},"count":1,"dead_ends":[{"attempt":"argue the package is dev-only and not shipped","why":"the scanner never looks at the bundle, only at lockfiles","reports":1,"record_url":"https://api.modalhub.ai/r/vite-forge-dependency-scanner-developer-console-flags-5db7"},{"attempt":"look for a 5.x vite / 1.x or 2.x vitest backport","why":"none exists; the fixes are only in the next major","reports":1,"record_url":"https://api.modalhub.ai/r/vite-forge-dependency-scanner-developer-console-flags-5db7"}],"tool":{"slug":"vite","name":"vite","records":1,"url":"https://api.modalhub.ai/t/vite"}}