Teire
ChangesScanDocsTrust
Teire

When upstream breaks, Teire fixes your code.

teire-dev/teireSystem status
Built on
  • NVIDIA NemotronNVIDIA Nemotron
  • Nebius Token FactoryNebius Token Factory
  • dependabot-coredependabot-core
  • Cloudflare

Product

Scan a repoChangesInstall on GitHubDashboardDemo video

Developers

DocsGitHubCLI and MCPteire.yml schemanpm

Trust

How Teire runsSource code
Worker running
Watching 44 sources · checked 7 h ago

Changes

2158
in the catalog
1153
new this week
62
dated ahead
  • Google Gemini7 h ago · 57
  • Goon demand · 87
  • Maven · Gradleon demand · 44
  • npmon demand · 913
  • Groq15 h ago · 43
  • Cargoon demand · 108
  • PyPIon demand · 243
  • Twitch15 h ago · 5
  • Bitbucket16 h ago · 0
  • GitLab16 h ago · 43
  • Context716 h ago · 0
  • RubyGems16 h ago · 83
  • Tavily16 h ago · 0
  • GitHub16 h ago · 23
  • Stripe16 h ago · 167

What's new

  • npm packages14 h agominimatch 3.1.5 → 11.0.3: changes the arguments of 2 function(s)●breaks on upgrade+13
  • RubyGems packages15 h agoactivesupport: Possible DoS vulnerability in Active Support safe_constantize✕security+8
  • RubyGems packages15 h ago

Picked up, last 30 days

one dot per day · bigger is more
  • npm

Every change

activestorage: Possible arbitrary file read and remote code execution in Active Storage video previews, analysis and image processing
✕security
+6
  • RubyGems packages15 h agoactionview: Possible XSS vulnerability in Action View highlight helper✕security+3
  • RubyGems packages15 h agoactionpack: Possible sensitive session information leak in Active Storage proxy mode✕security+6
  • RubyGems packages15 h agoactionmailbox: Possible signature replay in Action Mailbox Mailgun ingress✕security
  • PyPI packages15 h agoopenai 0.28.1 → 3.41.0: changes parameters of 5 function(s)●breaks on upgrade+21
  • Cargo packages15 h agopin-utils: `pin-utils` is unmaintained✕security
  • GitLab16 h agometrics.prometheus.port deprecated–notice+42
  • npm packages2 d ago@ruby/prism 1.9.0 → 2.1.0: removes 12 API(s)●breaks on upgrade+5
  • GitHub2 d agorerank-multilingual-v2.0 shutdown✕already broken+22
  • npm packages2 d agoopenai 4.104.0 → 7.45.1: removes 38 import path(s)●breaks on upgrade+34
    • 913
    : 110 on 2026-10-27, 18 on 2026-10-28, 22 on 2026-10-29, 738 on 2026-10-30, 6 on 2026-10-31, 5 on 2026-11-02, 5 on 2026-11-03, 6 on 2026-11-04, 3 on 2026-11-05
  • PyPI243: 143 on 2026-10-27, 9 on 2026-10-28, 3 on 2026-10-29, 76 on 2026-10-30, 3 on 2026-10-31, 3 on 2026-11-02, 3 on 2026-11-03, 3 on 2026-11-05
  • Stripe167: 167 on 2026-10-27
  • OpenAI145: 145 on 2026-10-27
  • Cargo108: 20 on 2026-10-27, 56 on 2026-10-28, 31 on 2026-10-30, 1 on 2026-11-05
  • Go87: 7 on 2026-10-27, 43 on 2026-10-28, 37 on 2026-10-30
  • RubyGems83: 17 on 2026-10-27, 6 on 2026-10-28, 16 on 2026-10-30, 4 on 2026-10-31, 7 on 2026-11-01, 12 on 2026-11-02, 21 on 2026-11-05
  • Perplexity59: 35 on 2026-10-27, 3 on 2026-10-30, 21 on 2026-11-03
  • Google Gemini57: 57 on 2026-10-27
  • Maven · Gradle44: 28 on 2026-10-27, 3 on 2026-10-29, 4 on 2026-10-30, 9 on 2026-10-31
    • 10-08today

    Coming up

    1. Nebius Token FactoryNebius Token FactoryNebius Token Factory · 11in 3 days
    2. Google GeminiGoogle Gemini · 5in 11 days
    3. relay-linkapi.relay.linkin 18 days
    361–420 of 2158

    2026-11

    • npm packages
      fast-uri: fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references
      npm · fast-uri✕security
      Quote
      “fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references”
      osv.dev ›
    • npm packages
      fast-uri: fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding
      npm · fast-uri✕security
      Quote
      “fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding”
      osv.dev ›
    • npm packages
      fast-uri: fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization
      npm · fast-uri✕security
      Quote
      “fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization”
      osv.dev ›
    • npm packages
      fast-uri: fast-uri vulnerable to improper path equivalence in relative reference normalization
      npm · fast-uri✕security
      Quote
      “fast-uri vulnerable to improper path equivalence in relative reference normalization”
      osv.dev ›
    • npm packages
      flatted: flatted vulnerable to unbounded recursion DoS in parse() revive phase
      npm · flatted✕security
      Quote
      “flatted vulnerable to unbounded recursion DoS in parse() revive phase”
      osv.dev ›
    • npm packages
      flatted: Prototype Pollution via parse() in NodeJS flatted
      npm · flatted✕security
      Quote
      “Prototype Pollution via parse() in NodeJS flatted”
      osv.dev ›
    • npm packages
      form-data: form-data uses unsafe random function in form-data for choosing boundary
      npm · form-data✕security
      Quote
      “form-data uses unsafe random function in form-data for choosing boundary”
      osv.dev ›
    • npm packages
      form-data: form-data: CRLF injection in form-data via unescaped multipart field names and filenames
      npm · form-data✕security
      Quote
      “form-data: CRLF injection in form-data via unescaped multipart field names and filenames”
      osv.dev ›
    • npm packages
      glob-parent: glob-parent vulnerable to Regular Expression Denial of Service in enclosure regex
      npm · glob-parent✕security
      Quote
      “glob-parent vulnerable to Regular Expression Denial of Service in enclosure regex”
      osv.dev ›
    • npm packages
      glob: Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal
      npm · glob✕security
      Quote
      “Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal”
      osv.dev ›
    • npm packages
      js-yaml: js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources
      npm · js-yaml✕security
      Quote
      “js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources”
      osv.dev ›
    • npm packages
      js-yaml: js-yaml: YAML merge-key chains can force quadratic CPU consumption
      npm · js-yaml✕security
      Quote
      “js-yaml: YAML merge-key chains can force quadratic CPU consumption”
      osv.dev ›
    • npm packages
      js-yaml: JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported
      npm · js-yaml✕security
      Quote
      “JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported”
      osv.dev ›
    • npm packages
      js-yaml: JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases
      npm · js-yaml✕security
      Quote
      “JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases”
      osv.dev ›
    • npm packages
      js-yaml: js-yaml has prototype pollution in merge (<<)
      npm · js-yaml✕security
      Quote
      “js-yaml has prototype pollution in merge (<<)”
      osv.dev ›
    • npm packages
      json-schema: json-schema is vulnerable to Prototype Pollution
      npm · json-schema✕security
      Quote
      “json-schema is vulnerable to Prototype Pollution”
      osv.dev ›

    2026-10

    • npm packages
      fast-uri: fast-uri vulnerable to host confusion via failed IDN canonicalization
      npm · fast-uri✕security
      Quote
      “fast-uri vulnerable to host confusion via failed IDN canonicalization”
      osv.dev ›
    • npm packages
      fast-uri: fast-uri vulnerable to host confusion via backslash authority introducer
      npm · fast-uri✕security
      Quote
      “fast-uri vulnerable to host confusion via backslash authority introducer”
      osv.dev ›
    • npm packages
      fast-uri: fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization
      npm · fast-uri✕security
      Quote
      “fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization”
      osv.dev ›
    • npm packages
      fast-uri: fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets
      npm · fast-uri✕security
      Quote
      “fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets”
      osv.dev ›
    • npm packages
      fast-uri: fast-uri vulnerable to host confusion via percent-encoded scheme normalization
      npm · fast-uri✕security
      Quote
      “fast-uri vulnerable to host confusion via percent-encoded scheme normalization”
      osv.dev ›
    • npm packages
      fast-uri: fast-uri vulnerable to path traversal via percent-encoded dot segments
      npm · fast-uri✕security
      Quote
      “fast-uri vulnerable to path traversal via percent-encoded dot segments”
      osv.dev ›
    • npm packages
      fast-uri: fast-uri vulnerable to authority injection via an unvalidated port in serialize
      npm · fast-uri✕security
      Quote
      “fast-uri vulnerable to authority injection via an unvalidated port in serialize”
      osv.dev ›
    • npm packages
      fast-uri: fast-uri vulnerable to host confusion via literal backslash authority delimiter
      npm · fast-uri✕security
      Quote
      “fast-uri vulnerable to host confusion via literal backslash authority delimiter”
      osv.dev ›
    • npm packages
      fast-uri: fast-uri vulnerable to host confusion via percent-encoded authority delimiters
      npm · fast-uri✕security
      Quote
      “fast-uri vulnerable to host confusion via percent-encoded authority delimiters”
      osv.dev ›
    • npm packages
      follow-redirects: follow-redirects sensitiveHeaders regex escaping can expose credential headers
      npm · follow-redirects✕security
      Quote
      “follow-redirects sensitiveHeaders regex escaping can expose credential headers”
      osv.dev ›
    • npm packages
      follow-redirects: follow-redirects' Proxy-Authorization header kept across hosts
      npm · follow-redirects✕security
      Quote
      “follow-redirects' Proxy-Authorization header kept across hosts”
      osv.dev ›
    • npm packages
      follow-redirects: Follow Redirects improperly handles URLs in the url.parse() function
      npm · follow-redirects✕security
      Quote
      “Follow Redirects improperly handles URLs in the url.parse() function”
      osv.dev ›
    • npm packages
      follow-redirects: follow-redirects array-form headers bypass cross-origin credential stripping
      npm · follow-redirects✕security
      Quote
      “follow-redirects array-form headers bypass cross-origin credential stripping”
      osv.dev ›
    • npm packages
      follow-redirects: follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets
      npm · follow-redirects✕security
      Quote
      “follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets”
      osv.dev ›
    • npm packages
      fs: Malicious code in fs (npm)
      npm · fs✕security
      Quote
      “Malicious code in fs (npm)”
      osv.dev ›
    • npm packages
      get-func-name: Chaijs/get-func-name vulnerable to ReDoS
      npm · get-func-name✕security
      Quote
      “Chaijs/get-func-name vulnerable to ReDoS”
      osv.dev ›
    • npm packages
      glob: glob CLI: Command injection via -c/--cmd executes matches with shell:true
      npm · glob✕security
      Quote
      “glob CLI: Command injection via -c/--cmd executes matches with shell:true”
      osv.dev ›
    • npm packages
      got: Got allows a redirect to a UNIX socket
      npm · got✕security
      Quote
      “Got allows a redirect to a UNIX socket”
      osv.dev ›
    • npm packages
      handlebars: Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection
      npm · handlebars✕security
      Quote
      “Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection”
      osv.dev ›
    • npm packages
      handlebars: Handlebars.js has JavaScript Injection via AST Type Confusion
      npm · handlebars✕security
      Quote
      “Handlebars.js has JavaScript Injection via AST Type Confusion”
      osv.dev ›
    • npm packages
      handlebars: Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block
      npm · handlebars✕security
      Quote
      “Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block”
      osv.dev ›
    • npm packages
      handlebars: Handlebars.js has a Property Access Validation Bypass in container.lookup
      npm · handlebars✕security
      Quote
      “Handlebars.js has a Property Access Validation Bypass in container.lookup”
      osv.dev ›
    • npm packages
      handlebars: Handlebars.js has a Prototype Method Access Control Gap via Missing __lookupSetter__ Blocklist Entry
      npm · handlebars✕security
      Quote
      “Handlebars.js has a Prototype Method Access Control Gap via Missing __lookupSetter__ Blocklist Entry”
      osv.dev ›
    • npm packages
      handlebars: Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)
      npm · handlebars✕security
      Quote
      “Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)”
      osv.dev ›
    • npm packages
      handlebars: Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation
      npm · handlebars✕security
      Quote
      “Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation”
      osv.dev ›
    • npm packages
      handlebars: Handlebars: JavaScript Injection via Own Property Check Bypass
      npm · handlebars✕security
      Quote
      “Handlebars: JavaScript Injection via Own Property Check Bypass”
      osv.dev ›
    • npm packages
      handlebars: Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial
      npm · handlebars✕security
      Quote
      “Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial”
      osv.dev ›
    • npm packages
      handlebars: Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options
      npm · handlebars✕security
      Quote
      “Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options”
      osv.dev ›
    • npm packages
      handlebars: Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates
      npm · handlebars✕security
      Quote
      “Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates”
      osv.dev ›
    • npm packages
      http-cache-semantics: http-cache-semantics vulnerable to Regular Expression Denial of Service
      npm · http-cache-semantics✕security
      Quote
      “http-cache-semantics vulnerable to Regular Expression Denial of Service”
      osv.dev ›
    • npm packages
      immutable: Immutable.js `List` 32-bit trie overflow → unrecoverable DoS
      npm · immutable✕security
      Quote
      “Immutable.js List 32-bit trie overflow → unrecoverable DoS”
      osv.dev ›
    • npm packages
      immutable: Immutable is vulnerable to Prototype Pollution
      npm · immutable✕security
      Quote
      “Immutable is vulnerable to Prototype Pollution”
      osv.dev ›
    • npm packages
      immutable: Immutable: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set
      npm · immutable✕security
      Quote
      “Immutable: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set”
      osv.dev ›
    • npm packages
      ip-address: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checks
      npm · ip-address✕security
      Quote
      “ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checks”
      osv.dev ›
    • npm packages
      ip-address: ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass
      npm · ip-address✕security
      Quote
      “ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass”
      osv.dev ›
    • npm packages
      ip-address: ip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checks
      npm · ip-address✕security
      Quote
      “ip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checks”
      osv.dev ›
    • npm packages
      ip-address: ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process
      npm · ip-address✕security
      Quote
      “ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process”
      osv.dev ›
    • npm packages
      ip-address: ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range
      npm · ip-address✕security
      Quote
      “ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range”
      osv.dev ›
    • npm packages
      ip-address: ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass
      npm · ip-address✕security
      Quote
      “ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass”
      osv.dev ›
    • npm packages
      ip-address: ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts
      npm · ip-address✕security
      Quote
      “ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts”
      osv.dev ›
    • npm packages
      ip-address: ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process
      npm · ip-address✕security
      Quote
      “ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process”
      osv.dev ›
    • npm packages
      ip: ip SSRF improper categorization in isPublic
      npm · ip✕security
      Quote
      “ip SSRF improper categorization in isPublic”
      osv.dev ›
    • npm packages
      ip: NPM IP package incorrectly identifies some private IP addresses as public
      npm · ip✕security
      Quote
      “NPM IP package incorrectly identifies some private IP addresses as public”
      osv.dev ›
    • npm packages
      json5: Prototype Pollution in JSON5 via Parse Method
      npm · json5✕security
      Quote
      “Prototype Pollution in JSON5 via Parse Method”
      osv.dev ›
    ‹ Previous7 / 36Next ›
  • AnthropicAnthropicclaude-sonnet-4-5-20250929in 24 days
  • OpenAIOpenAIOpenAI · 3in 25 days
    • 14 more ›