You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
-**Project:**[Builder.io](https://github.com/BuilderIO/builder)— visual development / headless CMS platform with drag-and-drop editing, Figma-to-code, and SDKs for React, Vue, Svelte, Qwik, Angular, Next.js, and more
11
+
-**Project:**[Builder.io](https://github.com/BuilderIO/builder)- visual development / headless CMS platform with drag-and-drop editing, Figma-to-code, and SDKs for React, Vue, Svelte, Qwik, Angular, Next.js, and more
-**Baseline findings:** 315 unique vulnerable packages (32 critical · 164 high · 100 medium · 19 low)
@@ -17,25 +17,25 @@
17
17
-**Validated fix command groups generated:** 2
18
18
-**First-pass coverage:** 2 of 315 findings have confident copy-and-run commands
19
19
-**yarn npm audit --all (same lockfile, default workspace scope):** 2 vulnerability entries on root direct deps (1 high · 1 moderate)
20
-
-**Remediation applied in this study:**none — baseline scan and generated fix plan only
20
+
-**Remediation applied in this study:**two root-level direct fix commands applied cumulatively on a test checkout of BuilderIO/builder@1219cc4 (2026-06-22), rescanned through the committed lockfile fixture after each pass
21
21
22
22
---
23
23
24
24
## What this case study demonstrates
25
25
26
-
Builder.io adds **visual CMS / page-builder SDK monorepo** coverage — distinct from Mitosis (cross-framework compiler) while sharing the Builder.io ecosystem. The upstream repo is a **Yarn Berry + Nx monorepo** at **5,655 resolved packages** — one of the largest Yarn Berry lockfiles in the CVE Lite portfolio.
26
+
Builder.io adds **visual CMS / page-builder SDK monorepo** coverage - distinct from Mitosis (cross-framework compiler) while sharing the Builder.io ecosystem. The upstream repo is a **Yarn Berry + Nx monorepo** at **5,655 resolved packages**, one of the largest Yarn Berry lockfiles in the CVE Lite portfolio.
27
27
28
-
The **313 unknown** relationship rows define this scan: on a lockfile-only snapshot, CVE Lite cannot classify framework examples, plugins, and SDK sandboxes as direct or transitive. Only **two root direct findings**— `octokit` and `zx` — have confident auto-generated fix commands amid massive sandbox noise.
28
+
The **313 unknown** relationship rows define this scan: on a lockfile-only snapshot, CVE Lite cannot classify framework examples, plugins, and SDK sandboxes as direct or transitive. Only **two root direct findings**(`octokit` and `zx`) have confident auto-generated fix commands amid massive sandbox noise.
29
29
30
30
**Two confident direct fixes:**
31
31
-`octokit@2.1.0` (high, direct · dev) → `yarn add octokit@3.1.2` (breaking major flagged)
32
32
-`zx@7.2.1` (medium, direct · dev) → `yarn add zx@8.8.5` (breaking major flagged)
33
33
34
-
**Critical sandbox/SDK cluster (unknown relationship):**`@angular/ssr`, `@builder.io/qwik`, `@builder.io/qwik-city`, `@nguniversal/*`, `@remix-run/node`, `next`, `handlebars`, `form-data`, `nuxt`, `simple-git`, `vitest`— framework example and SDK e2e paths, not Builder npm consumer surface.
34
+
**Critical sandbox/SDK cluster (unknown relationship):**`@angular/ssr`, `@builder.io/qwik`, `@builder.io/qwik-city`, `@nguniversal/*`, `@remix-run/node`, `next`, `handlebars`, `form-data`, `nuxt`, `simple-git`, `vitest`- framework example and SDK e2e paths, not Builder npm consumer surface.
35
35
36
36
**Version fragmentation at scale:** multiple majors of `esbuild`, `axios`, `minimatch`, `semver`, `rollup`, `vite`, `svelte`, and `lodash` across examples and plugins.
37
37
38
-
This fixture pins the **root**`package.json` and `yarn.lock` only. Builder.io upstream spans `packages/*`, `plugins/*`, `starters/*`, and dozens of framework `examples/*` workspaces — all resolved into the single root lockfile.
38
+
This fixture pins the **root**`package.json` and `yarn.lock` only. Builder.io upstream spans `packages/*`, `plugins/*`, `starters/*`, and dozens of framework `examples/*` workspaces - all resolved into the single root lockfile.
39
39
40
40
---
41
41
@@ -59,36 +59,51 @@ Both tools were run against the same `yarn.lock` on the same machine on 2026-06-
59
59
60
60
**Why the totals differ:**
61
61
62
-
By default, `yarn npm audit --all` on this lockfile-only snapshot checks **direct dependencies for the active workspace** only —**two advisories** on `octokit@2.1.0` (high) and `zx@7.2.1` (moderate).
62
+
By default, `yarn npm audit --all` on this lockfile-only snapshot checks **direct dependencies for the active workspace** only:**two advisories** on `octokit@2.1.0` (high) and `zx@7.2.1` (moderate).
63
63
64
-
CVE Lite parses the entire **`yarn.lock`** — including React/Vue/Angular/Qwik/Remix/Nuxt examples, plugins, and SDK integration graphs — and reports **315 unique vulnerable package versions**.
64
+
CVE Lite parses the entire **`yarn.lock`**, including React/Vue/Angular/Qwik/Remix/Nuxt examples, plugins, and SDK integration graphs, and reports **315 unique vulnerable package versions**.
65
65
66
-
**Fix guidance:** CVE Lite generates exactly **two** validated direct upgrades matching what `yarn npm audit` surfaces — but also reveals **313 additional vulnerable packages** in framework sandboxes that default Yarn audit never reaches.
66
+
**Fix guidance:** CVE Lite generates exactly **two** validated direct upgrades matching what `yarn npm audit` surfaces, but also reveals **313 additional vulnerable packages** in framework sandboxes that default Yarn audit never reaches.
67
67
68
68
---
69
69
70
70
## Before vs After
71
71
72
-
No remediation pass was performed for this study.
72
+
Remediation results from applying the scanner's two direct fix commands one at a time on a test checkout of [BuilderIO/builder@1219cc4](https://github.com/BuilderIO/builder/commit/1219cc4ed49ed657a7ee5e7548ca13aeabafa725), rescanned through the committed `examples/builder` lockfile fixture after each pass (CVE Lite v1.25.0 · 2026-06-22). The 2026-06-14 baseline recorded **315 findings**; OSV advisory updates produce a **336-finding** starting count on this remeasurement date.
73
73
74
74
| Stage | Findings | Critical | High | Medium | Low | Direct | Transitive | Unknown | Command groups |
| After high direct fix (`octokit@3.1.2`) | 332 | 32 | 163 | 108 | 29 | 1 | 17 | 314 | 5 |
78
+
| After medium direct fix (`zx@8.8.5`) | 331 | 32 | 163 | 107 | 29 | 0 | 16 | 315 | 4 |
77
79
78
-
The first-pass plan covers **2 of 315** findings. The remaining **313** appear in the skipped section — overwhelmingly **unknown** relationship packages where Yarn Berry path reconstruction is incomplete in this MVP.
80
+
Both **direct levers cleared** by pass 2. Total findings dropped **336 → 331** across two breaking major bumps. The **315 unknown** sandbox rows remain structural; these two commands only address what Builder controls at the root manifest.
81
+
82
+
The first-pass plan covers **2 of 315** findings at the original 2026-06-14 baseline. The remaining **313** appear in the skipped section: overwhelmingly **unknown** relationship packages where Yarn Berry path reconstruction is incomplete in this MVP.
79
83
80
84
---
81
85
82
86
## Fix Journey
83
87
84
-
These commands were **generated by the scanner but not run** against the upstream Builder.io repository.
88
+
Both commands are **breaking major** bumps flagged by CVE Lite. They address the only two root direct findings. The **32 critical** sandbox rows (Qwik, Next.js, Angular SSR, Remix, Nuxt, `simple-git`, `handlebars`) require maintainer triage across framework examples, not direct installs.
89
+
90
+
**Pass 1 - high direct fix:**
85
91
86
92
```bash
87
93
yarn add octokit@3.1.2
94
+
```
95
+
96
+
Clears the high direct `octokit@2.1.0` row. Findings **336 → 332**; direct **2 → 1** (2026-06-22 remeasurement baseline).
97
+
98
+
**Pass 2 - medium direct fix:**
99
+
100
+
```bash
88
101
yarn add zx@8.8.5
89
102
```
90
103
91
-
Both are **breaking major** bumps flagged by CVE Lite. They address the only two root direct findings. The **32 critical** sandbox rows — Qwik, Next.js, Angular SSR, Remix, Nuxt, `simple-git`, `handlebars` — require maintainer triage across framework examples, not direct installs.
104
+
Clears the medium direct `zx@7.2.1` row. Findings **332 → 331**; direct **1 → 0**; medium **108 → 107**.
105
+
106
+
After two passes, **331 findings remain** - almost entirely **unknown** sandbox/toolchain rows with no confident first-pass command. Command groups dropped from **5 to 4**.
92
107
93
108
---
94
109
@@ -108,7 +123,7 @@ Run from the Builder.io repository root or from the `examples/builder` directory
108
123
cve-lite . --verbose --all
109
124
```
110
125
111
-
The example lockfile reflects Builder.io at revision `1219cc4ed49ed657a7ee5e7548ca13aeabafa725`. OSV advisory data changes over time — re-scanning may show different counts on the same revision.
126
+
The example lockfile reflects Builder.io at revision `1219cc4ed49ed657a7ee5e7548ca13aeabafa725`. OSV advisory data changes over time - re-scanning may show different counts on the same revision.
112
127
113
128
Every number in this case study comes from a live scan of the committed fixture at `examples/builder/` in the CVE Lite CLI repository.
114
129
@@ -118,7 +133,7 @@ Every number in this case study comes from a live scan of the committed fixture
118
133
| CLI version | v1.22.0 |
119
134
| CVE Lite command |`node dist/index.js examples/builder --verbose --all --json`|
-**164 high:** version fragmentation across `esbuild`, `axios`, `minimatch`, `rollup`, Angular, Remix, SvelteKit
@@ -164,7 +179,7 @@ Verified scan on 2026-06-14 (revision `1219cc4`). Given **315 total rows**, this
164
179
165
180
### Critical (32 packages)
166
181
167
-
> **About fix hints:** The **Fix hint** column shows the **earliest patched release recorded in the OSV advisory**, not necessarily the right upgrade for your installed version line. Because OSV aggregates fixes across all affected ranges, the earliest patched version can appear *lower* than what you have installed — for example, several `next@14.x`/`next@15.x` rows show a fix hint of `12.3.5`. That is not a recommendation to downgrade; it is the lowest version the advisory marks as patched. Always verify against the upstream advisory and the project's security page (e.g. the [Next.js security advisories](https://github.com/vercel/next.js/security/advisories)) and upgrade *forward* within your major before relying on these hints. The `⊘` marker denotes findings with no confident auto-generated fix command.
182
+
> **About fix hints:** The **Fix hint** column shows the **earliest patched release recorded in the OSV advisory**, not necessarily the right upgrade for your installed version line. Because OSV aggregates fixes across all affected ranges, the earliest patched version can appear *lower* than what you have installed - for example, several `next@14.x`/`next@15.x` rows show a fix hint of `12.3.5`. That is not a recommendation to downgrade; it is the lowest version the advisory marks as patched. Always verify against the upstream advisory and the project's security page (e.g. the [Next.js security advisories](https://github.com/vercel/next.js/security/advisories)) and upgrade *forward* within your major before relying on these hints. The `⊘` marker denotes findings with no confident auto-generated fix command.
168
183
169
184
| Package | Version | Severity | Relationship | Fix hint | Advisory IDs |
170
185
|---|---|---|---|---|---|
@@ -246,7 +261,7 @@ Verified scan on 2026-06-14 (revision `1219cc4`). Given **315 total rows**, this
*134 additional high, 100 medium, and 19 low findings are omitted from this table for readability — counts and severities match the verified scan JSON.*
264
+
*134 additional high, 100 medium, and 19 low findings are omitted from this table for readability; counts and severities match the verified scan JSON.*
0 commit comments