Dependency has a known vulnerability
A lockfile pins a package version that Google OSV reports as vulnerable. Requires `--osv` (sends package name and version to api.osv.dev - never source). Upgrade to a fixed release, or accept the risk with an inline suppression and a reason.
high likely application source OWASP A06:2021 / CWE-1395
How to fix it
Upgrade the package to a version that OSV (or the advisory) marks as fixed, then regenerate the lockfile. Confirm the new version still satisfies your app's API requirements before deploying.
Check your own repository
npx owlwarden scan --preset deep
npx owlwarden explain known-vulnerable-dependency
explain prints the rule and fixes in the terminal. It does not
use the network.