Fix affected range for GHSA-3cj3-hqcr-g934

[yanjost]

Context

GHSA-3cj3-hqcr-g934 currently marks every npm cline version before 3.0.30 as affected. This includes cline@0.8.2, an unrelated command-line application library published from kucoe/cline.

The current Cline coding-agent project introduced the vulnerable cline dashboard command in 386ded5, after cli-v3.0.15. The commit is included in cli-v3.0.16.

What changed

Set the affected range to >= 3.0.16, < 3.0.30. This excludes versions belonging to the previous npm package while retaining every release containing the vulnerable dashboard implementation.

Security review (self)

• No secrets, credentials, internal URLs, or hostnames are included.
• The change only narrows the public advisory's affected version range using public repository history.
• No user-input or authentication behavior changes.

Test plan

• Validate the advisory JSON against the repository's OSV schema checks.
• Confirm cline@0.8.2 is excluded by the revised range.
• Confirm cline@3.0.16 through 3.0.29 remain affected and 3.0.30 remains fixed.

[Copilot]

🔵 Needs a closer look

Upstream history supports the change, but the published npm release boundary still needs curator confirmation before reducing security-alert coverage.

0 open findings

What changed in this PR

Corrects GHSA-3cj3-hqcr-g934 to exclude unrelated legacy npm cline versions.

Changes:

• Sets the affected range to >= 3.0.16, < 3.0.30, preserving the fixed version.

File	Description
advisories/​github-reviewed/​2026/​09/​GHSA-3cj3-hqcr-g934/​GHSA-3cj3-hqcr-g934.json	Updates the introduction version to 3.0.16.

🧠 Review effort: Max

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.