payload@4.0.0-canary.27
Review before merging.
15 known advisories (worst: critical), no fixed version found on this major.
Why this verdict
- 15 known advisories (worst: critical), no fixed version found on this major.Evidence
- New major version after 3.92.0: expect breaking changes.Evidence
- Published without build provenance, unlike 3.92.0.Evidence
Confidence 100% · algorithm v1 · computed 2026-10-23. How verdicts work
Supply chain and security
- Malware reports
- None known (OSV)
- Known advisories
- 15 known
- License
- MIT
- Install scripts
- None
- Build provenance
- No provenancelost since previous version
- Weekly downloads
- 16
- GHSA-238x-w2j9-gwwrPayload vulnerable to API key disclosure through ordinary document reads
- GHSA-2g7p-5934-q4w7Payload: ReDoS in Multipart Content-Type Validation
- GHSA-2pwp-2369-8fg3Payload: Bypassed sanitization of user uploaded SVGs
- GHSA-66wr-7vmr-p5jqPayload authentication token field handling issue
- GHSA-7c34-32v3-j575Payload relationship-query authorization bypass
- GHSA-97rh-rhh2-7vjvPayload: Remote Code Execution through first-register
- GHSA-9qpg-3cf8-w33xPayload: Uploaded XML files could execute same-origin JavaScript
- GHSA-f7hx-52q9-hcrfPayload: Unauthorized update to collection documents
- GHSA-fpww-c55p-cjv6Payload: Polymorphic join queries could disclose hidden fields
- GHSA-fx49-4h83-wjv9Payload didn't enforce field-level password update restrictions
Compatibility
New major version after 3.92.0: expect breaking changes.
Check the official release notes below for behaviour changes before merging.
Release notes
Read the package page on npm for this version’s features and fixes.
Deprecations and deadlines
The maintainer has not deprecated this version on npm.