Thirty-plus GHSA advisories cleared today, and the useful signal clusters around install-time and load-time primitives rather than one blockbuster CVE. NLTK shipped a second, still-incomplete fix for JVM argument injection in its Stanford wrappers; Kirby CMS picked up a third disclosure in two days (system-path exposure in REST API error messages), continuing the pattern from yesterday's upload and path-traversal bugs.
pnpm took the sharpest hits: an untrusted pnpm-workspace.yaml can exfiltrate environment secrets through proxy env-placeholder expansion, and a trust-lockfile install path can plant dependency symlinks outside the project — both textbook install-time supply-chain vectors that ride in config and lockfiles rather than packages. MLflow's pickle-deserialization killswitch turned out not to cover the statsmodels flavor, the same "safety flag isn't a real allowlist" pattern seen in prior mlflow RCEs, and browserslist — a transitive dependency of nearly every JS build — picked up two memory/crash bugs from untrusted stats files. Filament had a bad day for MFA (recovery-code bypass, TOTP reuse, password-validity leak) and league/commonmark disclosed four DoS/XSS bugs in its Attributes extension at once. On the bright side: Socket, Phylum, and CISA KEV all came back with nothing new for today specifically — every KEV entry in the 30-day window was already covered on the day it was added, and no active malicious-package campaign surfaced.
→ Operational priority for the night if you run pnpm in CI against forked PRs or third-party templates, treat pnpm-workspace.yaml and lockfiles as untrusted until you've upgraded — that's the pair with the clearest exploitation path tonight. Queue MLflow, browserslist, and Filament patches for tomorrow's first window if you run any of the three.