{
  "version": "4.4.0",
  "previous": "4.3.2",
  "previousBrowserPin": "4.3.2",
  "package": "typeset.us@4.4.0",
  "download": "/releases/4.4.0/typeset.us-4.4.0.tgz",
  "archive": "/releases/4.3.2/README.md",
  "manifest": "/releases/4.4.0/manifest.json",
  "loader": {
    "url": "/go@4.4.0.js",
    "integrity": "sha384-OPixflfJwk7LTcwv7u1n3T6ratxF6EeTJXn3D/TnLw9bCV2qkIVogco3QFZj6l5D",
    "bytes": 153657,
    "gzipBytes": 59978,
    "npm": "typeset.us@4.4.0/dist/auto.js"
  },
  "aliases": {
    "/go@4.js": "latest 4.x; no integrity hash",
    "/go.js": "latest 4.x only; for trying Typeset out"
  },
  "advisories": [
    {
      "id": null,
      "url": null,
      "title": "DOM XSS in the 3.x Typeset.auto() heading branch",
      "severity": "moderate",
      "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "cwe": "CWE-79",
      "npm": {
        "package": "typeset.us",
        "affected": ">=3.0.0 <3.4.1",
        "patched": "3.4.1"
      },
      "pins": [
        "go@3.3.2.js",
        "go@3.4.0.js"
      ],
      "condition": "the page calls Typeset.auto() and an element with data-typeset-heading contains attacker-influenced text",
      "fixedIn4x": "no 4.x release contains this code",
      "details": "https://github.com/speedwarnsf/web-typography/blob/master/docs/security/advisory-3x-heading-xss.md"
    }
  ],
  "validation": "See SUPPORT.md for verified coverage and outstanding device acceptance."
}