Hi,
Both GHSA-2943-5xfg-gq5f and GHSA-66mm-25pp-rfff were published > a month ago (2026-07-13), and (AFAIK) still haven't been reviewed by GitHub...
As a result, npm audit and other security tooling do not pick them up:
Given the popularity of the library and the severity of the vulnerabilities, this is rather suboptimal, I think.
Hi,
Both GHSA-2943-5xfg-gq5f and GHSA-66mm-25pp-rfff were published > a month ago (2026-07-13), and (AFAIK) still haven't been reviewed by GitHub...
As a result,
npm auditand other security tooling do not pick them up:Given the popularity of the library and the severity of the vulnerabilities, this is rather suboptimal, I think.