[leaanthony]

Summary

Adds an experimental interactive setup wizard (wails3 setup) that guides users through:

• Dependency checking - Verifies Go, npm, and platform tooling with one-click install suggestions
• Project defaults - Configure author info, bundle ID prefix, preferred templates
• Cross-platform builds - Optional Docker setup for building from any host OS
• Code signing - Configure signing identities for macOS, Windows, and Linux

The wizard runs in the browser and saves configuration to ~/.config/wails/config.yaml.

Also includes:

• wails3 setup signing and wails3 setup entitlements sub-commands
• --json flag for wails3 doctor (machine-readable output)
• Signing status section in wails3 doctor
• TypeScript binding style selection (interfaces vs classes)
• Documentation updates with setup instructions
• Fun homepage morph effect (Desktop ↔ Server)

Screenshots

The wizard provides a step-by-step browser UI for configuration.

Test plan

• Run wails3 setup on Linux - verify dependency detection and Docker setup
• Run wails3 setup on macOS - verify Xcode tools and signing detection
• Run wails3 setup on Windows - verify WebView2 and signing detection
• Verify wails3 doctor --json outputs valid JSON
• Verify saved config is used by wails3 init

Notes

⚠️ Experimental - Primarily tested on Linux. Users are directed to GitHub Issue #4904 to report issues.

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features

  • Experimental setup wizard with live Docker status/streaming, signing configuration UI (per‑platform), in‑wizard bug reporting, JSON output for diagnostics, option to generate TypeScript interfaces for bindings, animated homepage tagline, and added favicons.

• Documentation

  • Expanded installation/setup docs, new setup guide, and extended cross‑platform build/image instructions.

• Bug Fixes

  • Improved npm detection on Linux.

• Tests

  • Added unit tests for Docker pull parsing and defaults behavior.

[semgrep-code-wailsapp]

Medium severity vulnerability may affect your project—review required:
Line 4457 lists a dependency (webpack-dev-server) with a known Medium severity vulnerability.

ℹ️ Why this matters

Affected versions of webpack-dev-server are vulnerable to Origin Validation Error. webpack-dev-server improperly validates the WebSocket connection Origin header, unconditionally accepting any IP-address-based Origin. A malicious website can perform a cross-site WebSocket hijack against a running dev server and exfiltrate the developer source code carried in Hot Module Reloading (HMR) messages. The insecure origin check is the package default and is reached on every WebSocket connection, so any project running an affected version is vulnerable.

References: GHSA, CVE

To resolve this comment:
Check if you are using webpack dev server CLI setup and access untrusted web site with non-Chromium based browser.

• If you're affected, upgrade this dependency to at least version 5.2.1 at website/pnpm-lock.yaml.
• If you're not affected, comment /fp we don't use this [condition]

💬 Ignore this finding

To ignore this, reply with:

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

_{You can view more details on this finding in the Semgrep AppSec Platform here.}

[semgrep-code-wailsapp]

Medium severity vulnerability may affect your project—review required:
Line 602 lists a dependency (vite) with a known Medium severity vulnerability.

ℹ️ Why this matters

Affected versions of vite are vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). Vite's server.fs.deny blocklist—which protects sensitive files such as .env and certificate files from being served—can be bypassed on Windows by appending a trailing backslash to request URLs, allowing an attacker to read otherwise-denied files.

References: GHSA, CVE

To resolve this comment:
Check if you expose the Vite dev server to the network by configuring to a non-loopback address using the --host CLI flag on windows.

• If you're affected, upgrade this dependency to at least version 5.4.21 at v2/examples/dragdrop-test/frontend/package-lock.json.
• If you're not affected, comment /fp we don't use this [condition]

💬 Ignore this finding

To ignore this, reply with:

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

_{You can view more details on this finding in the Semgrep AppSec Platform here.}

[semgrep-code-wailsapp]

Medium severity vulnerability may affect your project—review required:
Line 602 lists a dependency (vite) with a known Medium severity vulnerability.

ℹ️ Why this matters

Affected versions of vite are vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). An attacker can bypass the server.fs.deny file-access blocklist by requesting paths with a trailing /. segment, gaining read access to protected files such as .env secrets and TLS certificates from the Vite dev server.

References: GHSA, CVE

To resolve this comment:
Check if you expose the Vite dev server to the network by configuring to a non-loopback address using the --host CLI flag.

• If you're affected, upgrade this dependency to at least version 4.5.14 at v2/examples/dragdrop-test/frontend/package-lock.json.
• If you're not affected, comment /fp we don't use this [condition]

💬 Ignore this finding

To ignore this, reply with:

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

_{You can view more details on this finding in the Semgrep AppSec Platform here.}

[semgrep-code-wailsapp]

Medium severity vulnerability may affect your project—review required:
Line 602 lists a dependency (vite) with a known Medium severity vulnerability.

ℹ️ Why this matters

Affected versions of vite are vulnerable to Exposure of Sensitive Information to an Unauthorized Actor. An attacker on the network can craft HTTP requests containing '#' in the request-target to bypass Vite's server.fs.deny restrictions and read arbitrary files from the host machine.

References: GHSA, CVE

To resolve this comment:
Check if you expose the Vite dev server to the network by configuring to a non-loopback address using the --host CLI flag.

• If you're affected, upgrade this dependency to at least version 4.5.13 at v2/examples/dragdrop-test/frontend/package-lock.json.
• If you're not affected, comment /fp we don't use this [condition]

💬 Ignore this finding

To ignore this, reply with:

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

_{You can view more details on this finding in the Semgrep AppSec Platform here.}

[semgrep-code-wailsapp]

Medium severity vulnerability may affect your project—review required:
Line 602 lists a dependency (vite) with a known Medium severity vulnerability.

ℹ️ Why this matters

Affected versions of vite are vulnerable to Exposure of Sensitive Information to an Unauthorized Actor / Improper Access Control. Vite's server.fs.deny file-access restriction can be bypassed by appending ?inline&import or ?raw?import query parameters to any request URL, allowing an attacker to read arbitrary files from the host filesystem — including .env files and TLS private keys — when the dev server is reachable from the network.

References: GHSA, CVE

To resolve this comment:
Check if you expose the Vite dev server to the network by configuring to a non-loopback address using the --host CLI flag.

• If you're affected, upgrade this dependency to at least version 4.5.11 at v2/examples/dragdrop-test/frontend/package-lock.json.
• If you're not affected, comment /fp we don't use this [condition]

💬 Ignore this finding

To ignore this, reply with:

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

_{You can view more details on this finding in the Semgrep AppSec Platform here.}

[semgrep-code-wailsapp]

Medium severity vulnerability may affect your project—review required:
Line 602 lists a dependency (vite) with a known Medium severity vulnerability.

ℹ️ Why this matters

Affected versions of vite are vulnerable to Exposure of Sensitive Information to an Unauthorized Actor / Improper Access Control. An attacker on the same network can exploit the server.fs.deny bypass to read arbitrary files from the server's filesystem, including sensitive files such as .env files, private keys, and source code.

References: GHSA, CVE

To resolve this comment:
Check if you expose the Vite dev server to the network by configuring to a non-loopback address using the --host CLI flag.

• If you're affected, upgrade this dependency to at least version 4.5.12 at v2/examples/dragdrop-test/frontend/package-lock.json.
• If you're not affected, comment /fp we don't use this [condition]

💬 Ignore this finding

To ignore this, reply with:

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

_{You can view more details on this finding in the Semgrep AppSec Platform here.}

[semgrep-code-wailsapp]

Medium severity vulnerability may affect your project—review required:
Line 602 lists a dependency (vite) with a known Medium severity vulnerability.

ℹ️ Why this matters

Affected versions of vite are vulnerable to Exposure of Sensitive Information to an Unauthorized Actor / Improper Access Control. An attacker who can send HTTP requests to the exposed dev server can read arbitrary files outside the project root by appending trailing query separators (e.g. ?raw??) to /@fs/ URLs, bypassing server.fs.deny access controls.

References: GHSA, CVE

To resolve this comment:
Check if you expose the Vite dev server to the network by configuring to a non-loopback address using the --host CLI flag.

• If you're affected, upgrade this dependency to at least version 4.5.10 at v2/examples/dragdrop-test/frontend/package-lock.json.
• If you're not affected, comment /fp we don't use this [condition]

💬 Ignore this finding

To ignore this, reply with:

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

_{You can view more details on this finding in the Semgrep AppSec Platform here.}

[semgrep-code-wailsapp]

Medium severity vulnerability may affect your project—review required:
Line 602 lists a dependency (vite) with a known Medium severity vulnerability.

ℹ️ Why this matters

Affected versions of vite are vulnerable to Missing Origin Validation in WebSockets / Origin Validation Error / Reliance on Reverse DNS Resolution for a Security-Critical Action. Vite's development server allows any website to read responses from the dev server and steal source code via permissive default CORS settings (Access-Control-Allow-Origin: *), missing Origin validation on HMR WebSocket connections enabling Cross-Site WebSocket Hijacking, and absent Host header validation enabling DNS rebinding attacks. This vulnerability applies even when the dev server is only accessible on localhost.

References: GHSA, CVE

To resolve this comment:
Check if you are running the vite development server.

• If you're affected, upgrade this dependency to at least version 4.5.6 at v2/examples/dragdrop-test/frontend/package-lock.json.
• If you're not affected, comment /fp we don't use this [condition]

💬 Ignore this finding

To ignore this, reply with:

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

_{You can view more details on this finding in the Semgrep AppSec Platform here.}

[semgrep-code-wailsapp]

Medium severity vulnerability introduced by a package you're using:
Line 1519 lists a dependency (axios) with a known Medium severity vulnerability. Fixing requires upgrading or replacing the dependency.

ℹ️ Why this matters

Affected versions of axios are vulnerable to Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') / Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') / Server-Side Request Forgery (SSRF). Axios can be used as a gadget for header injection: if another dependency enables prototype pollution, polluted properties can be merged into Axios request headers and written without CRLF sanitization, allowing request smuggling/SSRF that can reach internal services such as AWS IMDSv2 and potentially lead to credential theft or broader compromise.

References: GHSA, CVE

To resolve this comment:
Upgrade this dependency to at least version 1.15.0 at website/pnpm-lock.yaml.

💬 Ignore this finding

To ignore this, reply with:

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

_{You can view more details on this finding in the Semgrep AppSec Platform here.}

[semgrep-code-wailsapp]

Medium severity vulnerability introduced by a package you're using:
Line 1516 lists a dependency (axios) with a known Medium severity vulnerability. Fixing requires upgrading or replacing the dependency.

ℹ️ Why this matters

Affected versions of axios are vulnerable to Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') / Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') / Server-Side Request Forgery (SSRF). Axios can be used as a gadget for header injection: if another dependency enables prototype pollution, polluted properties can be merged into Axios request headers and written without CRLF sanitization, allowing request smuggling/SSRF that can reach internal services such as AWS IMDSv2 and potentially lead to credential theft or broader compromise.

References: GHSA, CVE

To resolve this comment:
Upgrade this dependency to at least version 0.31.0 at website/pnpm-lock.yaml.

💬 Ignore this finding

To ignore this, reply with:

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

_{You can view more details on this finding in the Semgrep AppSec Platform here.}

[semgrep-code-wailsapp]

Medium severity vulnerability introduced by a package you're using:
Line 5934 lists a dependency (axios) with a known Medium severity vulnerability. Fixing requires upgrading or replacing the dependency.

ℹ️ Why this matters

Affected versions of axios are vulnerable to Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') / Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') / Server-Side Request Forgery (SSRF). Axios can be used as a gadget for header injection: if another dependency enables prototype pollution, polluted properties can be merged into Axios request headers and written without CRLF sanitization, allowing request smuggling/SSRF that can reach internal services such as AWS IMDSv2 and potentially lead to credential theft or broader compromise.

References: GHSA, CVE

To resolve this comment:
Upgrade this dependency to at least version 1.15.0 at website/package-lock.json.

💬 Ignore this finding

To ignore this, reply with:

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

_{You can view more details on this finding in the Semgrep AppSec Platform here.}

[semgrep-code-wailsapp]

Medium severity vulnerability may affect your project—review required:
Line 1519 lists a dependency (axios) with a known Medium severity vulnerability.

ℹ️ Why this matters

Affected versions of axios are vulnerable to Server-Side Request Forgery (SSRF) / Unintended Proxy or Intermediary ('Confused Deputy'). Axios does not normalize hostnames before applying NO_PROXY, so requests to loopback or internal hosts such as localhost. or [::1] can be sent through a configured proxy instead of bypassing it. If an attacker can influence request URLs, they may force local/internal Axios traffic through an attacker-controlled proxy, undermining SSRF protections and exposing sensitive responses.

References: GHSA, CVE

To resolve this comment:
Check if you have NO_PROXY configured in your environment.

• If you're affected, upgrade this dependency to at least version 1.15.0 at website/pnpm-lock.yaml.
• If you're not affected, comment /fp we don't use this [condition]

💬 Ignore this finding

To ignore this, reply with:

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

_{You can view more details on this finding in the Semgrep AppSec Platform here.}

[semgrep-code-wailsapp]

Medium severity vulnerability may affect your project—review required:
Line 1516 lists a dependency (axios) with a known Medium severity vulnerability.

ℹ️ Why this matters

Affected versions of axios are vulnerable to Server-Side Request Forgery (SSRF) / Unintended Proxy or Intermediary ('Confused Deputy'). Axios does not normalize hostnames before applying NO_PROXY, so requests to loopback or internal hosts such as localhost. or [::1] can be sent through a configured proxy instead of bypassing it. If an attacker can influence request URLs, they may force local/internal Axios traffic through an attacker-controlled proxy, undermining SSRF protections and exposing sensitive responses.

References: GHSA, CVE

To resolve this comment:
Check if you have NO_PROXY configured in your environment.

• If you're affected, upgrade this dependency to at least version 0.31.0 at website/pnpm-lock.yaml.
• If you're not affected, comment /fp we don't use this [condition]

💬 Ignore this finding

To ignore this, reply with:

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

_{You can view more details on this finding in the Semgrep AppSec Platform here.}

[semgrep-code-wailsapp]

Medium severity vulnerability may affect your project—review required:
Line 5934 lists a dependency (axios) with a known Medium severity vulnerability.

ℹ️ Why this matters

Affected versions of axios are vulnerable to Server-Side Request Forgery (SSRF) / Unintended Proxy or Intermediary ('Confused Deputy'). Axios does not normalize hostnames before applying NO_PROXY, so requests to loopback or internal hosts such as localhost. or [::1] can be sent through a configured proxy instead of bypassing it. If an attacker can influence request URLs, they may force local/internal Axios traffic through an attacker-controlled proxy, undermining SSRF protections and exposing sensitive responses.

References: GHSA, CVE

To resolve this comment:
Check if you have NO_PROXY configured in your environment.

• If you're affected, upgrade this dependency to at least version 1.15.0 at website/package-lock.json.
• If you're not affected, comment /fp we don't use this [condition]

💬 Ignore this finding

To ignore this, reply with:

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

_{You can view more details on this finding in the Semgrep AppSec Platform here.}

[semgrep-code-wailsapp]

High severity vulnerability may affect your project—review required:
Line 1519 lists a dependency (axios) with a known High severity vulnerability.

ℹ️ Why this matters

Affected versions of axios are vulnerable to Inefficient Regular Expression Complexity / Uncontrolled Resource Consumption. axios is vulnerable to a regular expression denial of service (ReDoS). The internal cookies.read() helper in lib/helpers/cookies.js builds a regular expression by concatenating the cookie name directly into the pattern without escaping regex metacharacters. When the cookie name flowing into the XSRF cookie read (e.g. via xsrfCookieName) contains a catastrophic-backtracking payload, evaluating the regex against document.cookie can freeze the JavaScript event loop, causing a denial of service in the browser tab or in Node.js/SSR applications. The affected code path is reached during ordinary axios request processing, so any importer of an affected version is exposed. Upgrade to a patched version (0.32.0 or 1.16.0), or set xsrfCookieName: null to disable XSRF cookie reading.

References: GHSA

To resolve this comment:
Check if you are using axios in browser with untrusted xsrfCookieName value.

• If you're affected, upgrade this dependency to at least version 1.16.0 at website/pnpm-lock.yaml.
• If you're not affected, comment /fp we don't use this [condition]

💬 Ignore this finding

To ignore this, reply with:

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

_{You can view more details on this finding in the Semgrep AppSec Platform here.}

[semgrep-code-wailsapp]

High severity vulnerability may affect your project—review required:
Line 1516 lists a dependency (axios) with a known High severity vulnerability.

ℹ️ Why this matters

Affected versions of axios are vulnerable to Inefficient Regular Expression Complexity / Uncontrolled Resource Consumption. axios is vulnerable to a regular expression denial of service (ReDoS). The internal cookies.read() helper in lib/helpers/cookies.js builds a regular expression by concatenating the cookie name directly into the pattern without escaping regex metacharacters. When the cookie name flowing into the XSRF cookie read (e.g. via xsrfCookieName) contains a catastrophic-backtracking payload, evaluating the regex against document.cookie can freeze the JavaScript event loop, causing a denial of service in the browser tab or in Node.js/SSR applications. The affected code path is reached during ordinary axios request processing, so any importer of an affected version is exposed. Upgrade to a patched version (0.32.0 or 1.16.0), or set xsrfCookieName: null to disable XSRF cookie reading.

References: GHSA

To resolve this comment:
Check if you are using axios in browser with untrusted xsrfCookieName value.

• If you're affected, upgrade this dependency to at least version 0.32.0 at website/pnpm-lock.yaml.
• If you're not affected, comment /fp we don't use this [condition]

💬 Ignore this finding

To ignore this, reply with:

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

_{You can view more details on this finding in the Semgrep AppSec Platform here.}

[semgrep-code-wailsapp]

High severity vulnerability may affect your project—review required:
Line 5934 lists a dependency (axios) with a known High severity vulnerability.

ℹ️ Why this matters

Affected versions of axios are vulnerable to Inefficient Regular Expression Complexity / Uncontrolled Resource Consumption. axios is vulnerable to a regular expression denial of service (ReDoS). The internal cookies.read() helper in lib/helpers/cookies.js builds a regular expression by concatenating the cookie name directly into the pattern without escaping regex metacharacters. When the cookie name flowing into the XSRF cookie read (e.g. via xsrfCookieName) contains a catastrophic-backtracking payload, evaluating the regex against document.cookie can freeze the JavaScript event loop, causing a denial of service in the browser tab or in Node.js/SSR applications. The affected code path is reached during ordinary axios request processing, so any importer of an affected version is exposed. Upgrade to a patched version (0.32.0 or 1.16.0), or set xsrfCookieName: null to disable XSRF cookie reading.

References: GHSA

To resolve this comment:
Check if you are using axios in browser with untrusted xsrfCookieName value.

• If you're affected, upgrade this dependency to at least version 1.16.0 at website/package-lock.json.
• If you're not affected, comment /fp we don't use this [condition]

💬 Ignore this finding

To ignore this, reply with:

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

_{You can view more details on this finding in the Semgrep AppSec Platform here.}

[semgrep-code-wailsapp]

High severity vulnerability may affect your project—review required:
Line 1519 lists a dependency (axios) with a known High severity vulnerability.

ℹ️ Why this matters

Affected versions of axios are vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') / Unintended Proxy or Intermediary ('Confused Deputy'). axios reads config.proxy via prototype-chain property access, so any Object.prototype pollution elsewhere in the dependency tree silently routes all HTTP requests through an attacker-controlled proxy, yielding a full man-in-the-middle. The vulnerability fires on ordinary axios usage with no specific API call or configuration required; upgrade to axios 1.16.0 or later.

References: GHSA, GHSA, CVE

To resolve this comment:
Check if you use axios to make HTTP requests.

• If you're affected, upgrade this dependency to at least version 1.16.0 at website/pnpm-lock.yaml.
• If you're not affected, comment /fp we don't use this [condition]

💬 Ignore this finding

To ignore this, reply with:

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

_{You can view more details on this finding in the Semgrep AppSec Platform here.}

[semgrep-code-wailsapp]

High severity vulnerability may affect your project—review required:
Line 5934 lists a dependency (axios) with a known High severity vulnerability.

ℹ️ Why this matters

Affected versions of axios are vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') / Unintended Proxy or Intermediary ('Confused Deputy'). axios reads config.proxy via prototype-chain property access, so any Object.prototype pollution elsewhere in the dependency tree silently routes all HTTP requests through an attacker-controlled proxy, yielding a full man-in-the-middle. The vulnerability fires on ordinary axios usage with no specific API call or configuration required; upgrade to axios 1.16.0 or later.

References: GHSA, GHSA, CVE

To resolve this comment:
Check if you use axios to make HTTP requests.

• If you're affected, upgrade this dependency to at least version 1.16.0 at website/package-lock.json.
• If you're not affected, comment /fp we don't use this [condition]

💬 Ignore this finding

To ignore this, reply with:

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

_{You can view more details on this finding in the Semgrep AppSec Platform here.}

[semgrep-code-wailsapp]

High severity vulnerability may affect your project—review required:
Line 536 lists a dependency (@babel/plugin-transform-modules-systemjs) with a known High severity vulnerability.

ℹ️ Why this matters

Affected versions of @babel/plugin-transform-modules-systemjs are vulnerable to Access of Resource Using Incompatible Type ('Type Confusion') / Improper Control of Generation of Code ('Code Injection'). @babel/plugin-transform-modules-systemjs mishandles module string specifiers when compiling code into SystemJS module form. An attacker who can supply specially crafted source code to a Babel build that uses this plugin (directly, or transitively via @babel/preset-env configured with modules: "systemjs") can cause Babel to emit output that executes arbitrary JavaScript when the compiled bundle is loaded.

References: GHSA, CVE

To resolve this comment:
Check if you install @babel/plugin-transform-modules-systemjs plugin through cli, or use @babel/preset-env preset with modules set to "systemjs".

• If you're affected, upgrade this dependency to at least version 7.29.4 at website/pnpm-lock.yaml.
• If you're not affected, comment /fp we don't use this [condition]

💬 Ignore this finding

To ignore this, reply with:

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

_{You can view more details on this finding in the Semgrep AppSec Platform here.}

[semgrep-code-wailsapp]

High severity vulnerability may affect your project—review required:
Line 1289 lists a dependency (@babel/plugin-transform-modules-systemjs) with a known High severity vulnerability.

ℹ️ Why this matters

Affected versions of @babel/plugin-transform-modules-systemjs are vulnerable to Access of Resource Using Incompatible Type ('Type Confusion') / Improper Control of Generation of Code ('Code Injection'). @babel/plugin-transform-modules-systemjs mishandles module string specifiers when compiling code into SystemJS module form. An attacker who can supply specially crafted source code to a Babel build that uses this plugin (directly, or transitively via @babel/preset-env configured with modules: "systemjs") can cause Babel to emit output that executes arbitrary JavaScript when the compiled bundle is loaded.

References: GHSA, CVE

To resolve this comment:
Check if you install @babel/plugin-transform-modules-systemjs plugin through cli, or use @babel/preset-env preset with modules set to "systemjs".

• If you're affected, upgrade this dependency to at least version 7.29.4 at website/package-lock.json.
• If you're not affected, comment /fp we don't use this [condition]

💬 Ignore this finding

To ignore this, reply with:

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

_{You can view more details on this finding in the Semgrep AppSec Platform here.}

[leaanthony]

Closing in favour of #5601, which is rebased on current master with all merge conflicts resolved and review comments addressed. The diff here was unreadable due to the branch being 498 commits behind.