88 items tracked, 15 not monitored yet because details are missing.
Edit config/inventory.yaml to change this list. The next scan picks it up.
| Item | Version | Where | Checked through | Last check | Open | Needs |
|---|---|---|---|---|---|---|
| Next.js | 16.1.1 | App / API | OSV | OK 2026-11-05 01:42 | 19 | |
| React (Next.js app) | 19.2.1 | App / API | OSV | OK 2026-11-05 01:42 | 0 | |
| React DOM (Next.js app) | 19.2.1 | App / API | OSV | OK 2026-11-05 01:42 | 0 | |
| Capacitor | 8.0.0 | App / API | OSV | OK 2026-11-05 01:42 | 0 | |
| NextAuth.js | 4.24.13 | App / API | OSV | OK 2026-11-05 01:42 | 2 | |
| Redux Toolkit | 2.11.1 | App / API | OSV | OK 2026-11-05 01:42 | 0 | |
| MobX | 6.15.0 | App / API | OSV | OK 2026-11-05 01:42 | 0 | |
| Bootstrap | 5.3.8 | App / API | OSV | OK 2026-11-05 01:42 | 0 | |
| React-Bootstrap | 2.10.10 | App / API | OSV | OK 2026-11-05 01:42 | 0 | |
| Tailwind CSS | 3.4.17 | App / API | OSV | OK 2026-11-05 01:42 | 0 | |
| Contentful SDK (JS) | 11.9.0 | App / API | OSV | OK 2026-11-05 01:42 | 0 | |
| Application Insights (JS) | – | App / API | Not monitored | – | 0 | Sheet says 'various' – add the exact version |
| Azure Monitor OpenTelemetry Exporter | – | App / API | Not monitored | – | 0 | Sheet says 'various' – add the exact version |
| .NET 6 runtime Out of Microsoft support since November 2024 – no security fixes |
6.* | App / API | NVD | OK 2026-11-05 01:42 | 37 | |
| Azure Functions SDK | 4.1.3 | App / API | OSV | OK 2026-11-05 01:42 | 0 | |
| Azure.Identity (.NET 6 app) | – | App / API | Not monitored | – | 0 | Sheet says 'various' – add the exact version |
| Azure Key Vault Secrets (.NET 6 app) | – | App / API | Not monitored | – | 0 | Sheet says 'various' – add the exact version |
| Application Insights (.NET 6 app) | – | App / API | Not monitored | – | 0 | Sheet says 'various' – add the exact version |
| ASP.NET Core 8 | 8.* | App / API | NVD | OK 2026-11-05 01:42 | 9 | |
| Microsoft.Identity.Web | 1.25.3 | App / API | OSV | OK 2026-11-05 01:42 | 0 | |
| Contentful .NET SDK | 7.2.2 | App / API | OSV | OK 2026-11-05 01:42 | 0 | |
| Microsoft Graph SDK | – | App / API | Not monitored | – | 0 | Sheet says 'various' – add the exact version |
| Azure App Configuration | – | App / API | Not monitored | – | 0 | Sheet says 'various' – add the exact version |
| Azure.Identity (.NET 8 app) | – | App / API | Not monitored | – | 0 | Sheet says 'various' – add the exact version |
| Feature Management | – | App / API | Not monitored | – | 0 | Sheet says 'various' – add the exact version |
| zxcvbn-ts core | 2.0.0 | App / API | OSV | OK 2026-11-05 01:42 | 0 | Loaded from a CDN – make sure SRI hashes are set |
| TanStack Router | 1.157.16 | App / API | OSV | OK 2026-11-05 01:42 | 0 | Confirm package: @tanstack/react-router or @tanstack/react-start? |
| React (TanStack app) | 19.0.0 | App / API | OSV | OK 2026-11-05 01:42 | 0 | |
| NestJS | 11.0.0 | App / API | OSV | OK 2026-11-05 01:42 | 0 | |
| Node.js | 22.16.0 | App / API | NVD | OK 2026-11-05 01:42 | 10 | |
| OpenJDK JDK 24 was a short-term release and no longer receives updates |
24.* | Workstation tool | NVD | OK 2026-11-05 01:42 | 0 | |
| Apache Maven | 3.9.* | Workstation tool | NVD | OK 2026-11-05 01:42 | 0 | |
| PostgreSQL | 18.* | Workstation tool | NVD | OK 2026-11-05 01:42 | 29 | |
| SQLite | 3.46.* | Test dependency | NVD | OK 2026-11-05 01:42 | 10 | |
| Podman | 6.0.0 | Workstation tool | NVD | OK 2026-11-05 01:42 | 1 | |
| Google Chrome | latest | Workstation tool | NVD, recent CVEs | OK 2026-11-05 01:42 | 588 | |
| Microsoft Edge | latest | Workstation tool | NVD, recent CVEs | OK 2026-11-05 01:42 | 13 | |
| Mozilla Firefox | latest | Workstation tool | NVD, recent CVEs | OK 2026-11-05 01:42 | 1 | |
| Git | 2.55.0 | Workstation tool | NVD | OK 2026-11-05 01:42 | 0 | |
| VS Code | 1.96.* | Workstation tool | NVD | OK 2026-11-05 01:42 | 36 | |
| Visual Studio Community | latest | Workstation tool | NVD, recent CVEs | OK 2026-11-05 01:42 | 0 | |
| IntelliJ IDEA CE | 2025.3.2 | Workstation tool | NVD | OK 2026-11-05 01:42 | 11 | |
| Azure CLI | 2.70.* | Workstation tool | NVD | OK 2026-11-05 01:42 | 0 | |
| Windows Terminal | 1.21.* | Workstation tool | NVD | OK 2026-11-05 01:42 | 0 | |
| Windows SDK | latest | Workstation tool | NVD, recent CVEs | OK 2026-11-05 01:42 | 0 | |
| Oracle Client | latest | Workstation tool | NVD, recent CVEs | OK 2026-11-05 01:42 | 0 | |
| Oracle SQL Developer | latest | Workstation tool | NVD, recent CVEs | OK 2026-11-05 01:42 | 0 | Sheet says 1.5.5, which is very old – confirm the installed version |
| Insomnia | 10.* | Workstation tool | NVD | OK 2026-11-05 01:42 | 0 | |
| Beyond Compare | 5.2.3 | Workstation tool | NVD | OK 2026-11-05 01:42 | 0 | |
| Fiddler Classic | latest | Workstation tool | NVD, recent CVEs | OK 2026-11-05 01:42 | 0 | |
| Allure Report CLI | 2.29.* | Workstation tool | NVD | OK 2026-11-05 01:42 | 0 | |
| WinAppDriver | 1.2.1 | Workstation tool | CISA exploited list only | OK 2026-11-05 01:42 | 0 | Unmaintained upstream |
| NVM | 0.40.* | Workstation tool | CISA exploited list only | OK 2026-11-05 01:42 | 0 | |
| Scoop | 0.5.3 | Workstation tool | CISA exploited list only | OK 2026-11-05 01:42 | 0 | |
| Wireshark | 4.6.6 | Workstation tool | NVD | OK 2026-11-05 01:42 | 13 | |
| SecureCRT | 9.7.3 | Workstation tool | NVD | OK 2026-11-05 01:42 | 0 | |
| PuTTY | 0.84 | Workstation tool | NVD | OK 2026-11-05 01:42 | 0 | |
| MTPuTTY | 1.8 | Workstation tool | CISA exploited list only | OK 2026-11-05 01:42 | 0 | Wraps PuTTY – PuTTY CVEs are the real exposure |
| iperf3 | 3.17 | Workstation tool | NVD | OK 2026-11-05 01:42 | 1 | |
| OpenSSL | 3.6.2 | Workstation tool | NVD | OK 2026-11-05 01:42 | 23 | |
| WinSCP | 6.5.* | Workstation tool | NVD | OK 2026-11-05 01:42 | 0 | |
| FileZilla Client | 3.70.6 | Workstation tool | NVD | OK 2026-11-05 01:42 | 0 | |
| Playwright | 1.61.1 | Test dependency | OSV | OK 2026-11-05 01:42 | 0 | |
| Azure Playwright Reporter | 1.61.1 | Test dependency | Not monitored | – | 0 | Add the exact npm package name |
| Azure DevOps Node API | 14.* | Test dependency | OSV (approximate) | OK 2026-11-05 01:42 | 0 | |
| BrowserStack Node SDK | – | Test dependency | Not monitored | – | 0 | Sheet says 'Latest' – add the pinned version |
| Selenium Java | 3.141.59 | Test dependency | OSV | OK 2026-11-05 01:42 | 0 | 2018 release, and Appium 9.x needs Selenium 4 – confirm the real version |
| TestNG | 7.11.* | Test dependency | OSV (approximate) | OK 2026-11-05 01:42 | 0 | |
| Allure TestNG | 2.29.* | Test dependency | OSV (approximate) | OK 2026-11-05 01:42 | 0 | |
| Appium Java client | 9.* | Test dependency | OSV (approximate) | OK 2026-11-05 01:42 | 1 | |
| Gson | 2.8.5 | Test dependency | OSV | OK 2026-11-05 01:42 | 1 | |
| Apache Commons Lang | 3.12.0 | Test dependency | OSV | OK 2026-11-05 01:42 | 0 | Sheet just says org.apache.commons – confirm the artifact |
| Maven Compiler Plugin | 3.5.2 | Test dependency | OSV | OK 2026-11-05 01:42 | 0 | Confirm which Maven plugins are used |
| JavaFaker | 0.15 | Test dependency | OSV | OK 2026-11-05 01:42 | 0 | Unmaintained; pulls in an old SnakeYAML |
| Jackson Databind | 2.17.* | Test dependency | OSV (approximate) | OK 2026-11-05 01:42 | 5 | |
| Jackson Dataformat | 2.17.* | Test dependency | Not monitored | – | 0 | Which format – jackson-dataformat-yaml, -xml or -csv? |
| Monte Screen Recorder | 0.7.7 | Test dependency | OSV | OK 2026-11-05 01:42 | 0 | |
| REST Assured | 5.4.0 | Test dependency | OSV | OK 2026-11-05 01:42 | 0 | |
| Tess4J | 5.15.* | Test dependency | OSV (approximate) | OK 2026-11-05 01:42 | 0 | |
| org.json | 20240303 | Test dependency | OSV | OK 2026-11-05 01:42 | 0 | |
| Zuora SDK | – | Test dependency | Not monitored | – | 0 | Sheet says 'Latest' – add the artifact and pinned version |
| OpenCSV | 5.9 | Test dependency | OSV | OK 2026-11-05 01:42 | 0 | |
| MS SQL JDBC | 13.2.* | Test dependency | OSV (approximate) | OK 2026-11-05 01:42 | 0 | |
| PostgreSQL JDBC | 42.7.* | Test dependency | OSV (approximate) | OK 2026-11-05 01:42 | 2 | |
| jsoup | – | Test dependency | Not monitored | – | 0 | Sheet says 4.2.3 but jsoup is on 1.x – looks copied from the Key Vault row |
| Azure Key Vault Secrets (Java) | 4.2.3 | Test dependency | OSV | OK 2026-11-05 01:42 | 0 | |
| Azure Identity (Java) | 1.2.0 | Test dependency | OSV | OK 2026-11-05 01:42 | 0 | |
| BrowserStack Java SDK | – | Test dependency | Not monitored | – | 0 | Sheet says 'Latest' – add the pinned version |