diff --git a/.circleci/config.yml b/.circleci/config.yml
index 1ab7688d76..26d3cd8d40 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -164,7 +164,7 @@ parameters:
     default: "main"
     type: string
   sandbox_git_branch:  # change to feature branch to test deployment
-    default: "kw-overview-widget"
+    default: "kw-test"
     type: string
   prod_new_relic_app_id:
     default: "877570491"
diff --git a/frontend/src/pages/Landing/RegionalSelect.js b/frontend/src/pages/Landing/RegionalSelect.js
index ce253d1d1e..66ccf1c20d 100644
--- a/frontend/src/pages/Landing/RegionalSelect.js
+++ b/frontend/src/pages/Landing/RegionalSelect.js
@@ -115,11 +115,19 @@ function RegionalSelect(props) {
   };
 
   CustomOption.propTypes = {
-    data: PropTypes.object.isRequired,
-    innerRef: PropTypes.string.isRequired,
+    data: PropTypes.shape({
+      value: PropTypes.number,
+      label: PropTypes.string,
+    }),
+    innerRef: PropTypes.func,
     innerProps: PropTypes.object.isRequired,
   };
 
+  CustomOption.defaultProps = {
+    data: {},
+    innerRef: () => 0,
+  };
+
   const options = [...getUserOptions(regions), { custom: true }];
   return (
     <Select
diff --git a/frontend/src/pages/Landing/mocks.js b/frontend/src/pages/Landing/mocks.js
index 17b87efa0b..3f7e24fbe9 100644
--- a/frontend/src/pages/Landing/mocks.js
+++ b/frontend/src/pages/Landing/mocks.js
@@ -302,10 +302,9 @@ export const generateXFakeReports = (count) => {
 export const overviewRegionOne = {
   numReports: '1',
   numGrants: '2',
+  numNonGrantees: '2',
   numTotalGrants: '4',
   numParticipants: '3',
-  sumTrainingDuration: '5.0',
-  sumTaDuration: '1.0',
   sumDuration: '0.5',
 };
 
diff --git a/frontend/src/setupTests.js b/frontend/src/setupTests.js
index 5a5fa835e5..11c52013a7 100644
--- a/frontend/src/setupTests.js
+++ b/frontend/src/setupTests.js
@@ -15,4 +15,4 @@ import MutationObserver from '@sheerun/mutationobserver-shim';
 
 window.MutationObserver = MutationObserver;
 
-jest.setTimeout(10000);
+jest.setTimeout(30000);
diff --git a/frontend/src/widgets/Overview.css b/frontend/src/widgets/Overview.css
index 6cdf62f232..b0db5edfe4 100644
--- a/frontend/src/widgets/Overview.css
+++ b/frontend/src/widgets/Overview.css
@@ -9,8 +9,7 @@
 }
 
 .smart-hub--overview-data {
-  margin-left: -20px;
-  margin-bottom: -20px;
+  margin-left: -36px !important;
 }
 
 .smart-hub--overview-nowrap {
diff --git a/frontend/src/widgets/Overview.js b/frontend/src/widgets/Overview.js
index 8615b4ac3b..ff8a4b91c8 100644
--- a/frontend/src/widgets/Overview.js
+++ b/frontend/src/widgets/Overview.js
@@ -21,13 +21,17 @@ function Field({
 Field.propTypes = {
   label: PropTypes.string.isRequired,
   labelExt: PropTypes.string,
-  data: PropTypes.string.isRequired,
-  col: PropTypes.number,
+  data: PropTypes.string,
+  col: PropTypes.oneOfType([
+    PropTypes.string,
+    PropTypes.number,
+  ]),
 };
 
 Field.defaultProps = {
   labelExt: '',
   col: 2,
+  data: '',
 };
 
 /*
@@ -49,15 +53,14 @@ function Overview({ data, region }) {
           {' '}
           TTA Overview
         </h2>
-        <span className="smart-hub--overview-period"> 3/17/21 to Today</span>
+        <span className="smart-hub--overview-period"> 9/15/2020 to Today</span>
       </Grid>
-      <Grid row className="smart-hub--overview-data">
-        <Field label="Grants served " labelExt={`(of ${data.numTotalGrants})`} data={data.numGrants} />
-        <Field label="Activity reports" data={data.numReports} />
-        <Field label="Participants" data={data.numParticipants} />
-        <Field label="Hours of Training" data={data.sumTrainingDuration} />
-        <Field label="Hours of TA" data={data.sumTaDuration} />
-        <Field label="Hours of TTA" data={data.sumDuration} />
+      <Grid row gap className="smart-hub--overview-data">
+        <Field col="fill" tablet={{ col: true }} label="Grants served " labelExt={`(of ${data.numTotalGrants})`} data={data.numGrants} />
+        <Field col="fill" label="Non-grantees served" data={data.numNonGrantees} />
+        <Field col="fill" label="Activity reports" data={data.numReports} />
+        <Field col="fill" label="Participants" data={data.numParticipants} />
+        <Field col={2} label="Hours of TTA" data={data.sumDuration} />
       </Grid>
     </Container>
   );
@@ -67,10 +70,9 @@ Overview.propTypes = {
   data: PropTypes.shape({
     numReports: PropTypes.string,
     numGrants: PropTypes.string,
+    numNonGrantees: PropTypes.string,
     numTotalGrants: PropTypes.string,
     numParticipants: PropTypes.string,
-    sumTrainingDuration: PropTypes.string,
-    sumTaDuration: PropTypes.string,
     sumDuration: PropTypes.string,
   }).isRequired,
   region: PropTypes.number.isRequired,
diff --git a/frontend/yarn-audit-known-issues b/frontend/yarn-audit-known-issues
index 4576e539ef..be2fe95651 100644
--- a/frontend/yarn-audit-known-issues
+++ b/frontend/yarn-audit-known-issues
@@ -76,6 +76,7 @@
 {"type":"auditAdvisory","data":{"resolution":{"id":1693,"path":"react-scripts>postcss-preset-env>postcss-replace-overflow-wrap>postcss","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"7.0.35","paths":["react-scripts>css-loader>icss-utils>postcss","react-scripts>css-loader>postcss-modules-local-by-default>icss-utils>postcss","react-scripts>css-loader>postcss-modules-values>icss-utils>postcss","react-scripts>css-loader>postcss","react-scripts>css-loader>postcss-modules-extract-imports>postcss","react-scripts>css-loader>postcss-modules-local-by-default>postcss","react-scripts>css-loader>postcss-modules-scope>postcss","react-scripts>css-loader>postcss-modules-values>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>css-declaration-sorter>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>cssnano-util-raw-cache>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-calc>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-colormin>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-convert-values>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-discard-comments>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-discard-duplicates>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-discard-empty>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-discard-overridden>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-merge-longhand>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-merge-longhand>stylehacks>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-merge-rules>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-minify-font-values>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-minify-gradients>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-minify-params>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-minify-selectors>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-normalize-charset>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-normalize-display-values>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-normalize-positions>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-normalize-repeat-style>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-normalize-string>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-normalize-timing-functions>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-normalize-unicode>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-normalize-url>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-normalize-whitespace>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-ordered-values>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-reduce-initial>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-reduce-transforms>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-svgo>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-unique-selectors>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>postcss","react-scripts>postcss-flexbugs-fixes>postcss","react-scripts>postcss-loader>postcss","react-scripts>postcss-normalize>postcss","react-scripts>postcss-normalize>postcss-browser-comments>postcss","react-scripts>postcss-preset-env>autoprefixer>postcss","react-scripts>postcss-preset-env>css-blank-pseudo>postcss","react-scripts>postcss-preset-env>css-has-pseudo>postcss","react-scripts>postcss-preset-env>css-prefers-color-scheme>postcss","react-scripts>postcss-preset-env>postcss","react-scripts>postcss-preset-env>postcss-attribute-case-insensitive>postcss","react-scripts>postcss-preset-env>postcss-color-functional-notation>postcss","react-scripts>postcss-preset-env>postcss-color-gray>postcss","react-scripts>postcss-preset-env>postcss-color-hex-alpha>postcss","react-scripts>postcss-preset-env>postcss-color-mod-function>postcss","react-scripts>postcss-preset-env>postcss-color-rebeccapurple>postcss","react-scripts>postcss-preset-env>postcss-custom-media>postcss","react-scripts>postcss-preset-env>postcss-custom-properties>postcss","react-scripts>postcss-preset-env>postcss-custom-selectors>postcss","react-scripts>postcss-preset-env>postcss-dir-pseudo-class>postcss","react-scripts>postcss-preset-env>postcss-double-position-gradients>postcss","react-scripts>postcss-preset-env>postcss-env-function>postcss","react-scripts>postcss-preset-env>postcss-focus-visible>postcss","react-scripts>postcss-preset-env>postcss-focus-within>postcss","react-scripts>postcss-preset-env>postcss-font-variant>postcss","react-scripts>postcss-preset-env>postcss-gap-properties>postcss","react-scripts>postcss-preset-env>postcss-image-set-function>postcss","react-scripts>postcss-preset-env>postcss-initial>postcss","react-scripts>postcss-preset-env>postcss-lab-function>postcss","react-scripts>postcss-preset-env>postcss-logical>postcss","react-scripts>postcss-preset-env>postcss-media-minmax>postcss","react-scripts>postcss-preset-env>postcss-nesting>postcss","react-scripts>postcss-preset-env>postcss-overflow-shorthand>postcss","react-scripts>postcss-preset-env>postcss-page-break>postcss","react-scripts>postcss-preset-env>postcss-place>postcss","react-scripts>postcss-preset-env>postcss-pseudo-class-any-link>postcss","react-scripts>postcss-preset-env>postcss-replace-overflow-wrap>postcss","react-scripts>postcss-preset-env>postcss-selector-matches>postcss","react-scripts>postcss-preset-env>postcss-selector-not>postcss"]},{"version":"7.0.21","paths":["react-scripts>resolve-url-loader>postcss"]}],"id":1693,"created":"2021-05-10T15:38:31.238Z","updated":"2021-06-15T15:09:38.963Z","deleted":null,"title":"Regular Expression Denial of Service","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"postcss","cves":["CVE-2021-23368"],"vulnerable_versions":">=7.0.0 <7.0.36 || >=8.0.0 <8.2.10","patched_versions":">=7.0.36 <8.0.0 || >=8.2.10","overview":"`postcss` from 7.0.0 and before version 7.0.36 and 8.2.10 is vulnerable to Regular Expression Denial of Service (ReDoS) during source map parsing.","recommendation":"Upgrade to version 8.2.10 or later","references":"- [CVE](https://nvd.nist.gov/vuln/detail/CVE-2021-23368)\n- [GitHub Advisory](https://github.com/advisories/GHSA-hwj9-h5mp-3pm3)\n","access":"public","severity":"moderate","cwe":"CWE-400","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1693"}}}
 {"type":"auditAdvisory","data":{"resolution":{"id":1693,"path":"react-scripts>postcss-preset-env>postcss-selector-matches>postcss","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"7.0.35","paths":["react-scripts>css-loader>icss-utils>postcss","react-scripts>css-loader>postcss-modules-local-by-default>icss-utils>postcss","react-scripts>css-loader>postcss-modules-values>icss-utils>postcss","react-scripts>css-loader>postcss","react-scripts>css-loader>postcss-modules-extract-imports>postcss","react-scripts>css-loader>postcss-modules-local-by-default>postcss","react-scripts>css-loader>postcss-modules-scope>postcss","react-scripts>css-loader>postcss-modules-values>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>css-declaration-sorter>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>cssnano-util-raw-cache>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-calc>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-colormin>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-convert-values>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-discard-comments>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-discard-duplicates>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-discard-empty>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-discard-overridden>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-merge-longhand>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-merge-longhand>stylehacks>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-merge-rules>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-minify-font-values>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-minify-gradients>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-minify-params>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-minify-selectors>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-normalize-charset>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-normalize-display-values>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-normalize-positions>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-normalize-repeat-style>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-normalize-string>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-normalize-timing-functions>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-normalize-unicode>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-normalize-url>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-normalize-whitespace>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-ordered-values>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-reduce-initial>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-reduce-transforms>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-svgo>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-unique-selectors>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>postcss","react-scripts>postcss-flexbugs-fixes>postcss","react-scripts>postcss-loader>postcss","react-scripts>postcss-normalize>postcss","react-scripts>postcss-normalize>postcss-browser-comments>postcss","react-scripts>postcss-preset-env>autoprefixer>postcss","react-scripts>postcss-preset-env>css-blank-pseudo>postcss","react-scripts>postcss-preset-env>css-has-pseudo>postcss","react-scripts>postcss-preset-env>css-prefers-color-scheme>postcss","react-scripts>postcss-preset-env>postcss","react-scripts>postcss-preset-env>postcss-attribute-case-insensitive>postcss","react-scripts>postcss-preset-env>postcss-color-functional-notation>postcss","react-scripts>postcss-preset-env>postcss-color-gray>postcss","react-scripts>postcss-preset-env>postcss-color-hex-alpha>postcss","react-scripts>postcss-preset-env>postcss-color-mod-function>postcss","react-scripts>postcss-preset-env>postcss-color-rebeccapurple>postcss","react-scripts>postcss-preset-env>postcss-custom-media>postcss","react-scripts>postcss-preset-env>postcss-custom-properties>postcss","react-scripts>postcss-preset-env>postcss-custom-selectors>postcss","react-scripts>postcss-preset-env>postcss-dir-pseudo-class>postcss","react-scripts>postcss-preset-env>postcss-double-position-gradients>postcss","react-scripts>postcss-preset-env>postcss-env-function>postcss","react-scripts>postcss-preset-env>postcss-focus-visible>postcss","react-scripts>postcss-preset-env>postcss-focus-within>postcss","react-scripts>postcss-preset-env>postcss-font-variant>postcss","react-scripts>postcss-preset-env>postcss-gap-properties>postcss","react-scripts>postcss-preset-env>postcss-image-set-function>postcss","react-scripts>postcss-preset-env>postcss-initial>postcss","react-scripts>postcss-preset-env>postcss-lab-function>postcss","react-scripts>postcss-preset-env>postcss-logical>postcss","react-scripts>postcss-preset-env>postcss-media-minmax>postcss","react-scripts>postcss-preset-env>postcss-nesting>postcss","react-scripts>postcss-preset-env>postcss-overflow-shorthand>postcss","react-scripts>postcss-preset-env>postcss-page-break>postcss","react-scripts>postcss-preset-env>postcss-place>postcss","react-scripts>postcss-preset-env>postcss-pseudo-class-any-link>postcss","react-scripts>postcss-preset-env>postcss-replace-overflow-wrap>postcss","react-scripts>postcss-preset-env>postcss-selector-matches>postcss","react-scripts>postcss-preset-env>postcss-selector-not>postcss"]},{"version":"7.0.21","paths":["react-scripts>resolve-url-loader>postcss"]}],"id":1693,"created":"2021-05-10T15:38:31.238Z","updated":"2021-06-15T15:09:38.963Z","deleted":null,"title":"Regular Expression Denial of Service","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"postcss","cves":["CVE-2021-23368"],"vulnerable_versions":">=7.0.0 <7.0.36 || >=8.0.0 <8.2.10","patched_versions":">=7.0.36 <8.0.0 || >=8.2.10","overview":"`postcss` from 7.0.0 and before version 7.0.36 and 8.2.10 is vulnerable to Regular Expression Denial of Service (ReDoS) during source map parsing.","recommendation":"Upgrade to version 8.2.10 or later","references":"- [CVE](https://nvd.nist.gov/vuln/detail/CVE-2021-23368)\n- [GitHub Advisory](https://github.com/advisories/GHSA-hwj9-h5mp-3pm3)\n","access":"public","severity":"moderate","cwe":"CWE-400","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1693"}}}
 {"type":"auditAdvisory","data":{"resolution":{"id":1693,"path":"react-scripts>postcss-preset-env>postcss-selector-not>postcss","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"7.0.35","paths":["react-scripts>css-loader>icss-utils>postcss","react-scripts>css-loader>postcss-modules-local-by-default>icss-utils>postcss","react-scripts>css-loader>postcss-modules-values>icss-utils>postcss","react-scripts>css-loader>postcss","react-scripts>css-loader>postcss-modules-extract-imports>postcss","react-scripts>css-loader>postcss-modules-local-by-default>postcss","react-scripts>css-loader>postcss-modules-scope>postcss","react-scripts>css-loader>postcss-modules-values>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>css-declaration-sorter>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>cssnano-util-raw-cache>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-calc>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-colormin>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-convert-values>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-discard-comments>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-discard-duplicates>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-discard-empty>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-discard-overridden>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-merge-longhand>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-merge-longhand>stylehacks>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-merge-rules>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-minify-font-values>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-minify-gradients>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-minify-params>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-minify-selectors>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-normalize-charset>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-normalize-display-values>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-normalize-positions>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-normalize-repeat-style>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-normalize-string>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-normalize-timing-functions>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-normalize-unicode>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-normalize-url>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-normalize-whitespace>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-ordered-values>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-reduce-initial>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-reduce-transforms>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-svgo>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-unique-selectors>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>postcss","react-scripts>postcss-flexbugs-fixes>postcss","react-scripts>postcss-loader>postcss","react-scripts>postcss-normalize>postcss","react-scripts>postcss-normalize>postcss-browser-comments>postcss","react-scripts>postcss-preset-env>autoprefixer>postcss","react-scripts>postcss-preset-env>css-blank-pseudo>postcss","react-scripts>postcss-preset-env>css-has-pseudo>postcss","react-scripts>postcss-preset-env>css-prefers-color-scheme>postcss","react-scripts>postcss-preset-env>postcss","react-scripts>postcss-preset-env>postcss-attribute-case-insensitive>postcss","react-scripts>postcss-preset-env>postcss-color-functional-notation>postcss","react-scripts>postcss-preset-env>postcss-color-gray>postcss","react-scripts>postcss-preset-env>postcss-color-hex-alpha>postcss","react-scripts>postcss-preset-env>postcss-color-mod-function>postcss","react-scripts>postcss-preset-env>postcss-color-rebeccapurple>postcss","react-scripts>postcss-preset-env>postcss-custom-media>postcss","react-scripts>postcss-preset-env>postcss-custom-properties>postcss","react-scripts>postcss-preset-env>postcss-custom-selectors>postcss","react-scripts>postcss-preset-env>postcss-dir-pseudo-class>postcss","react-scripts>postcss-preset-env>postcss-double-position-gradients>postcss","react-scripts>postcss-preset-env>postcss-env-function>postcss","react-scripts>postcss-preset-env>postcss-focus-visible>postcss","react-scripts>postcss-preset-env>postcss-focus-within>postcss","react-scripts>postcss-preset-env>postcss-font-variant>postcss","react-scripts>postcss-preset-env>postcss-gap-properties>postcss","react-scripts>postcss-preset-env>postcss-image-set-function>postcss","react-scripts>postcss-preset-env>postcss-initial>postcss","react-scripts>postcss-preset-env>postcss-lab-function>postcss","react-scripts>postcss-preset-env>postcss-logical>postcss","react-scripts>postcss-preset-env>postcss-media-minmax>postcss","react-scripts>postcss-preset-env>postcss-nesting>postcss","react-scripts>postcss-preset-env>postcss-overflow-shorthand>postcss","react-scripts>postcss-preset-env>postcss-page-break>postcss","react-scripts>postcss-preset-env>postcss-place>postcss","react-scripts>postcss-preset-env>postcss-pseudo-class-any-link>postcss","react-scripts>postcss-preset-env>postcss-replace-overflow-wrap>postcss","react-scripts>postcss-preset-env>postcss-selector-matches>postcss","react-scripts>postcss-preset-env>postcss-selector-not>postcss"]},{"version":"7.0.21","paths":["react-scripts>resolve-url-loader>postcss"]}],"id":1693,"created":"2021-05-10T15:38:31.238Z","updated":"2021-06-15T15:09:38.963Z","deleted":null,"title":"Regular Expression Denial of Service","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"postcss","cves":["CVE-2021-23368"],"vulnerable_versions":">=7.0.0 <7.0.36 || >=8.0.0 <8.2.10","patched_versions":">=7.0.36 <8.0.0 || >=8.2.10","overview":"`postcss` from 7.0.0 and before version 7.0.36 and 8.2.10 is vulnerable to Regular Expression Denial of Service (ReDoS) during source map parsing.","recommendation":"Upgrade to version 8.2.10 or later","references":"- [CVE](https://nvd.nist.gov/vuln/detail/CVE-2021-23368)\n- [GitHub Advisory](https://github.com/advisories/GHSA-hwj9-h5mp-3pm3)\n","access":"public","severity":"moderate","cwe":"CWE-400","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1693"}}}
+{"type":"auditAdvisory","data":{"resolution":{"id":1693,"path":"react-scripts>resolve-url-loader>postcss","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"7.0.35","paths":["react-scripts>css-loader>icss-utils>postcss","react-scripts>css-loader>postcss-modules-local-by-default>icss-utils>postcss","react-scripts>css-loader>postcss-modules-values>icss-utils>postcss","react-scripts>css-loader>postcss","react-scripts>css-loader>postcss-modules-extract-imports>postcss","react-scripts>css-loader>postcss-modules-local-by-default>postcss","react-scripts>css-loader>postcss-modules-scope>postcss","react-scripts>css-loader>postcss-modules-values>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>css-declaration-sorter>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>cssnano-util-raw-cache>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-calc>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-colormin>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-convert-values>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-discard-comments>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-discard-duplicates>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-discard-empty>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-discard-overridden>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-merge-longhand>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-merge-longhand>stylehacks>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-merge-rules>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-minify-font-values>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-minify-gradients>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-minify-params>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-minify-selectors>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-normalize-charset>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-normalize-display-values>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-normalize-positions>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-normalize-repeat-style>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-normalize-string>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-normalize-timing-functions>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-normalize-unicode>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-normalize-url>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-normalize-whitespace>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-ordered-values>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-reduce-initial>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-reduce-transforms>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-svgo>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-unique-selectors>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>postcss","react-scripts>postcss-flexbugs-fixes>postcss","react-scripts>postcss-loader>postcss","react-scripts>postcss-normalize>postcss","react-scripts>postcss-normalize>postcss-browser-comments>postcss","react-scripts>postcss-preset-env>autoprefixer>postcss","react-scripts>postcss-preset-env>css-blank-pseudo>postcss","react-scripts>postcss-preset-env>css-has-pseudo>postcss","react-scripts>postcss-preset-env>css-prefers-color-scheme>postcss","react-scripts>postcss-preset-env>postcss","react-scripts>postcss-preset-env>postcss-attribute-case-insensitive>postcss","react-scripts>postcss-preset-env>postcss-color-functional-notation>postcss","react-scripts>postcss-preset-env>postcss-color-gray>postcss","react-scripts>postcss-preset-env>postcss-color-hex-alpha>postcss","react-scripts>postcss-preset-env>postcss-color-mod-function>postcss","react-scripts>postcss-preset-env>postcss-color-rebeccapurple>postcss","react-scripts>postcss-preset-env>postcss-custom-media>postcss","react-scripts>postcss-preset-env>postcss-custom-properties>postcss","react-scripts>postcss-preset-env>postcss-custom-selectors>postcss","react-scripts>postcss-preset-env>postcss-dir-pseudo-class>postcss","react-scripts>postcss-preset-env>postcss-double-position-gradients>postcss","react-scripts>postcss-preset-env>postcss-env-function>postcss","react-scripts>postcss-preset-env>postcss-focus-visible>postcss","react-scripts>postcss-preset-env>postcss-focus-within>postcss","react-scripts>postcss-preset-env>postcss-font-variant>postcss","react-scripts>postcss-preset-env>postcss-gap-properties>postcss","react-scripts>postcss-preset-env>postcss-image-set-function>postcss","react-scripts>postcss-preset-env>postcss-initial>postcss","react-scripts>postcss-preset-env>postcss-lab-function>postcss","react-scripts>postcss-preset-env>postcss-logical>postcss","react-scripts>postcss-preset-env>postcss-media-minmax>postcss","react-scripts>postcss-preset-env>postcss-nesting>postcss","react-scripts>postcss-preset-env>postcss-overflow-shorthand>postcss","react-scripts>postcss-preset-env>postcss-page-break>postcss","react-scripts>postcss-preset-env>postcss-place>postcss","react-scripts>postcss-preset-env>postcss-pseudo-class-any-link>postcss","react-scripts>postcss-preset-env>postcss-replace-overflow-wrap>postcss","react-scripts>postcss-preset-env>postcss-selector-matches>postcss","react-scripts>postcss-preset-env>postcss-selector-not>postcss"]},{"version":"7.0.21","paths":["react-scripts>resolve-url-loader>postcss"]}],"id":1693,"created":"2021-05-10T15:38:31.238Z","updated":"2021-06-15T15:09:38.963Z","deleted":null,"title":"Regular Expression Denial of Service","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"postcss","cves":["CVE-2021-23368"],"vulnerable_versions":">=7.0.0 <7.0.36 || >=8.0.0 <8.2.10","patched_versions":">=7.0.36 <8.0.0 || >=8.2.10","overview":"`postcss` from 7.0.0 and before version 7.0.36 and 8.2.10 is vulnerable to Regular Expression Denial of Service (ReDoS) during source map parsing.","recommendation":"Upgrade to version 8.2.10 or later","references":"- [CVE](https://nvd.nist.gov/vuln/detail/CVE-2021-23368)\n- [GitHub Advisory](https://github.com/advisories/GHSA-hwj9-h5mp-3pm3)\n","access":"public","severity":"moderate","cwe":"CWE-400","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1693"}}}
 {"type":"auditAdvisory","data":{"resolution":{"id":1748,"path":"react-scripts>jest>@jest/core>jest-config>jest-environment-jsdom>jsdom>ws","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"7.4.5","paths":["react-scripts>jest>@jest/core>jest-config>jest-environment-jsdom>jsdom>ws","react-scripts>jest>jest-cli>@jest/core>jest-config>jest-environment-jsdom>jsdom>ws","react-scripts>jest>@jest/core>jest-runner>jest-config>jest-environment-jsdom>jsdom>ws","react-scripts>jest>jest-cli>@jest/core>jest-runner>jest-config>jest-environment-jsdom>jsdom>ws","react-scripts>jest-circus>jest-runner>jest-config>jest-environment-jsdom>jsdom>ws","react-scripts>jest>@jest/core>jest-runner>jest-runtime>jest-config>jest-environment-jsdom>jsdom>ws","react-scripts>jest>jest-cli>@jest/core>jest-runner>jest-runtime>jest-config>jest-environment-jsdom>jsdom>ws","react-scripts>jest-circus>jest-runner>jest-runtime>jest-config>jest-environment-jsdom>jsdom>ws","react-scripts>jest>@jest/core>jest-runtime>jest-config>jest-environment-jsdom>jsdom>ws","react-scripts>jest>jest-cli>@jest/core>jest-runtime>jest-config>jest-environment-jsdom>jsdom>ws","react-scripts>jest-circus>jest-runtime>jest-config>jest-environment-jsdom>jsdom>ws","react-scripts>jest>jest-cli>jest-config>jest-environment-jsdom>jsdom>ws"]},{"version":"6.2.1","paths":["react-scripts>webpack-dev-server>ws"]}],"id":1748,"created":"2021-05-28T19:31:06.490Z","updated":"2021-06-10T23:01:46.443Z","deleted":null,"title":"Regular Expression Denial of Service","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"ws","cves":["CVE-2021-32640"],"vulnerable_versions":">=5.0.0 <5.2.3 || >=6.0.0 <6.2.2 || >=7.0.0 <7.4.6","patched_versions":">=5.2.3 <6.0.0 || >=6.2.2 <7.0.0 || >=7.4.6","overview":"In `ws` before versions 5.2.3, 6.2.2 and 7.4.6 there is a ReDOS vulnerability.\n\n### Impact\n\nA specially crafted value of the `Sec-Websocket-Protocol` header can be used to significantly slow down a ws server.\n\n### Proof of concept\n\n```js\nfor (const length of [1000, 2000, 4000, 8000, 16000, 32000]) {\n  const value = 'b' + ' '.repeat(length) + 'x';\n  const start = process.hrtime.bigint();\n\n  value.trim().split(/ *, */);\n\n  const end = process.hrtime.bigint();\n\n  console.log('length = %d, time = %f ns', length, end - start);\n}\n```\n\n### Patches\n\nThe vulnerability was fixed in ws@7.4.6 (https://github.com/websockets/ws/commit/00c425ec77993773d823f018f64a5c44e17023ff).\n\n### Workarounds\n\nIn vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the [`--max-http-header-size=size`](https://nodejs.org/api/cli.html#cli_max_http_header_size_size) and/or the [`maxHeaderSize`](https://nodejs.org/api/http.html#http_http_createserver_options_requestlistener) options.\n\n### Credits\n\nThe vulnerability was responsibly disclosed along with a fix in private by [Robert McLaughlin](https://github.com/robmcl4) from University of California, Santa Barbara.\n","recommendation":"Upgrade to version 5.2.3 or 6.2.2 or 7.4.6 or later","references":"- [CVE](https://nvd.nist.gov/vuln/detail/CVE-2021-32640)\n- [GitHub Advisory](https://github.com/advisories/GHSA-6fc8-4gx4-v693)","access":"public","severity":"moderate","cwe":"CWE-400","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1748"}}}
 {"type":"auditAdvisory","data":{"resolution":{"id":1748,"path":"react-scripts>jest>jest-cli>@jest/core>jest-config>jest-environment-jsdom>jsdom>ws","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"7.4.5","paths":["react-scripts>jest>@jest/core>jest-config>jest-environment-jsdom>jsdom>ws","react-scripts>jest>jest-cli>@jest/core>jest-config>jest-environment-jsdom>jsdom>ws","react-scripts>jest>@jest/core>jest-runner>jest-config>jest-environment-jsdom>jsdom>ws","react-scripts>jest>jest-cli>@jest/core>jest-runner>jest-config>jest-environment-jsdom>jsdom>ws","react-scripts>jest-circus>jest-runner>jest-config>jest-environment-jsdom>jsdom>ws","react-scripts>jest>@jest/core>jest-runner>jest-runtime>jest-config>jest-environment-jsdom>jsdom>ws","react-scripts>jest>jest-cli>@jest/core>jest-runner>jest-runtime>jest-config>jest-environment-jsdom>jsdom>ws","react-scripts>jest-circus>jest-runner>jest-runtime>jest-config>jest-environment-jsdom>jsdom>ws","react-scripts>jest>@jest/core>jest-runtime>jest-config>jest-environment-jsdom>jsdom>ws","react-scripts>jest>jest-cli>@jest/core>jest-runtime>jest-config>jest-environment-jsdom>jsdom>ws","react-scripts>jest-circus>jest-runtime>jest-config>jest-environment-jsdom>jsdom>ws","react-scripts>jest>jest-cli>jest-config>jest-environment-jsdom>jsdom>ws"]},{"version":"6.2.1","paths":["react-scripts>webpack-dev-server>ws"]}],"id":1748,"created":"2021-05-28T19:31:06.490Z","updated":"2021-06-10T23:01:46.443Z","deleted":null,"title":"Regular Expression Denial of Service","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"ws","cves":["CVE-2021-32640"],"vulnerable_versions":">=5.0.0 <5.2.3 || >=6.0.0 <6.2.2 || >=7.0.0 <7.4.6","patched_versions":">=5.2.3 <6.0.0 || >=6.2.2 <7.0.0 || >=7.4.6","overview":"In `ws` before versions 5.2.3, 6.2.2 and 7.4.6 there is a ReDOS vulnerability.\n\n### Impact\n\nA specially crafted value of the `Sec-Websocket-Protocol` header can be used to significantly slow down a ws server.\n\n### Proof of concept\n\n```js\nfor (const length of [1000, 2000, 4000, 8000, 16000, 32000]) {\n  const value = 'b' + ' '.repeat(length) + 'x';\n  const start = process.hrtime.bigint();\n\n  value.trim().split(/ *, */);\n\n  const end = process.hrtime.bigint();\n\n  console.log('length = %d, time = %f ns', length, end - start);\n}\n```\n\n### Patches\n\nThe vulnerability was fixed in ws@7.4.6 (https://github.com/websockets/ws/commit/00c425ec77993773d823f018f64a5c44e17023ff).\n\n### Workarounds\n\nIn vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the [`--max-http-header-size=size`](https://nodejs.org/api/cli.html#cli_max_http_header_size_size) and/or the [`maxHeaderSize`](https://nodejs.org/api/http.html#http_http_createserver_options_requestlistener) options.\n\n### Credits\n\nThe vulnerability was responsibly disclosed along with a fix in private by [Robert McLaughlin](https://github.com/robmcl4) from University of California, Santa Barbara.\n","recommendation":"Upgrade to version 5.2.3 or 6.2.2 or 7.4.6 or later","references":"- [CVE](https://nvd.nist.gov/vuln/detail/CVE-2021-32640)\n- [GitHub Advisory](https://github.com/advisories/GHSA-6fc8-4gx4-v693)","access":"public","severity":"moderate","cwe":"CWE-400","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1748"}}}
 {"type":"auditAdvisory","data":{"resolution":{"id":1748,"path":"react-scripts>jest>@jest/core>jest-runner>jest-config>jest-environment-jsdom>jsdom>ws","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"7.4.5","paths":["react-scripts>jest>@jest/core>jest-config>jest-environment-jsdom>jsdom>ws","react-scripts>jest>jest-cli>@jest/core>jest-config>jest-environment-jsdom>jsdom>ws","react-scripts>jest>@jest/core>jest-runner>jest-config>jest-environment-jsdom>jsdom>ws","react-scripts>jest>jest-cli>@jest/core>jest-runner>jest-config>jest-environment-jsdom>jsdom>ws","react-scripts>jest-circus>jest-runner>jest-config>jest-environment-jsdom>jsdom>ws","react-scripts>jest>@jest/core>jest-runner>jest-runtime>jest-config>jest-environment-jsdom>jsdom>ws","react-scripts>jest>jest-cli>@jest/core>jest-runner>jest-runtime>jest-config>jest-environment-jsdom>jsdom>ws","react-scripts>jest-circus>jest-runner>jest-runtime>jest-config>jest-environment-jsdom>jsdom>ws","react-scripts>jest>@jest/core>jest-runtime>jest-config>jest-environment-jsdom>jsdom>ws","react-scripts>jest>jest-cli>@jest/core>jest-runtime>jest-config>jest-environment-jsdom>jsdom>ws","react-scripts>jest-circus>jest-runtime>jest-config>jest-environment-jsdom>jsdom>ws","react-scripts>jest>jest-cli>jest-config>jest-environment-jsdom>jsdom>ws"]},{"version":"6.2.1","paths":["react-scripts>webpack-dev-server>ws"]}],"id":1748,"created":"2021-05-28T19:31:06.490Z","updated":"2021-06-10T23:01:46.443Z","deleted":null,"title":"Regular Expression Denial of Service","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"ws","cves":["CVE-2021-32640"],"vulnerable_versions":">=5.0.0 <5.2.3 || >=6.0.0 <6.2.2 || >=7.0.0 <7.4.6","patched_versions":">=5.2.3 <6.0.0 || >=6.2.2 <7.0.0 || >=7.4.6","overview":"In `ws` before versions 5.2.3, 6.2.2 and 7.4.6 there is a ReDOS vulnerability.\n\n### Impact\n\nA specially crafted value of the `Sec-Websocket-Protocol` header can be used to significantly slow down a ws server.\n\n### Proof of concept\n\n```js\nfor (const length of [1000, 2000, 4000, 8000, 16000, 32000]) {\n  const value = 'b' + ' '.repeat(length) + 'x';\n  const start = process.hrtime.bigint();\n\n  value.trim().split(/ *, */);\n\n  const end = process.hrtime.bigint();\n\n  console.log('length = %d, time = %f ns', length, end - start);\n}\n```\n\n### Patches\n\nThe vulnerability was fixed in ws@7.4.6 (https://github.com/websockets/ws/commit/00c425ec77993773d823f018f64a5c44e17023ff).\n\n### Workarounds\n\nIn vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the [`--max-http-header-size=size`](https://nodejs.org/api/cli.html#cli_max_http_header_size_size) and/or the [`maxHeaderSize`](https://nodejs.org/api/http.html#http_http_createserver_options_requestlistener) options.\n\n### Credits\n\nThe vulnerability was responsibly disclosed along with a fix in private by [Robert McLaughlin](https://github.com/robmcl4) from University of California, Santa Barbara.\n","recommendation":"Upgrade to version 5.2.3 or 6.2.2 or 7.4.6 or later","references":"- [CVE](https://nvd.nist.gov/vuln/detail/CVE-2021-32640)\n- [GitHub Advisory](https://github.com/advisories/GHSA-6fc8-4gx4-v693)","access":"public","severity":"moderate","cwe":"CWE-400","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1748"}}}
@@ -89,7 +90,6 @@
 {"type":"auditAdvisory","data":{"resolution":{"id":1748,"path":"react-scripts>jest-circus>jest-runtime>jest-config>jest-environment-jsdom>jsdom>ws","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"7.4.5","paths":["react-scripts>jest>@jest/core>jest-config>jest-environment-jsdom>jsdom>ws","react-scripts>jest>jest-cli>@jest/core>jest-config>jest-environment-jsdom>jsdom>ws","react-scripts>jest>@jest/core>jest-runner>jest-config>jest-environment-jsdom>jsdom>ws","react-scripts>jest>jest-cli>@jest/core>jest-runner>jest-config>jest-environment-jsdom>jsdom>ws","react-scripts>jest-circus>jest-runner>jest-config>jest-environment-jsdom>jsdom>ws","react-scripts>jest>@jest/core>jest-runner>jest-runtime>jest-config>jest-environment-jsdom>jsdom>ws","react-scripts>jest>jest-cli>@jest/core>jest-runner>jest-runtime>jest-config>jest-environment-jsdom>jsdom>ws","react-scripts>jest-circus>jest-runner>jest-runtime>jest-config>jest-environment-jsdom>jsdom>ws","react-scripts>jest>@jest/core>jest-runtime>jest-config>jest-environment-jsdom>jsdom>ws","react-scripts>jest>jest-cli>@jest/core>jest-runtime>jest-config>jest-environment-jsdom>jsdom>ws","react-scripts>jest-circus>jest-runtime>jest-config>jest-environment-jsdom>jsdom>ws","react-scripts>jest>jest-cli>jest-config>jest-environment-jsdom>jsdom>ws"]},{"version":"6.2.1","paths":["react-scripts>webpack-dev-server>ws"]}],"id":1748,"created":"2021-05-28T19:31:06.490Z","updated":"2021-06-10T23:01:46.443Z","deleted":null,"title":"Regular Expression Denial of Service","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"ws","cves":["CVE-2021-32640"],"vulnerable_versions":">=5.0.0 <5.2.3 || >=6.0.0 <6.2.2 || >=7.0.0 <7.4.6","patched_versions":">=5.2.3 <6.0.0 || >=6.2.2 <7.0.0 || >=7.4.6","overview":"In `ws` before versions 5.2.3, 6.2.2 and 7.4.6 there is a ReDOS vulnerability.\n\n### Impact\n\nA specially crafted value of the `Sec-Websocket-Protocol` header can be used to significantly slow down a ws server.\n\n### Proof of concept\n\n```js\nfor (const length of [1000, 2000, 4000, 8000, 16000, 32000]) {\n  const value = 'b' + ' '.repeat(length) + 'x';\n  const start = process.hrtime.bigint();\n\n  value.trim().split(/ *, */);\n\n  const end = process.hrtime.bigint();\n\n  console.log('length = %d, time = %f ns', length, end - start);\n}\n```\n\n### Patches\n\nThe vulnerability was fixed in ws@7.4.6 (https://github.com/websockets/ws/commit/00c425ec77993773d823f018f64a5c44e17023ff).\n\n### Workarounds\n\nIn vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the [`--max-http-header-size=size`](https://nodejs.org/api/cli.html#cli_max_http_header_size_size) and/or the [`maxHeaderSize`](https://nodejs.org/api/http.html#http_http_createserver_options_requestlistener) options.\n\n### Credits\n\nThe vulnerability was responsibly disclosed along with a fix in private by [Robert McLaughlin](https://github.com/robmcl4) from University of California, Santa Barbara.\n","recommendation":"Upgrade to version 5.2.3 or 6.2.2 or 7.4.6 or later","references":"- [CVE](https://nvd.nist.gov/vuln/detail/CVE-2021-32640)\n- [GitHub Advisory](https://github.com/advisories/GHSA-6fc8-4gx4-v693)","access":"public","severity":"moderate","cwe":"CWE-400","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1748"}}}
 {"type":"auditAdvisory","data":{"resolution":{"id":1748,"path":"react-scripts>jest>jest-cli>jest-config>jest-environment-jsdom>jsdom>ws","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"7.4.5","paths":["react-scripts>jest>@jest/core>jest-config>jest-environment-jsdom>jsdom>ws","react-scripts>jest>jest-cli>@jest/core>jest-config>jest-environment-jsdom>jsdom>ws","react-scripts>jest>@jest/core>jest-runner>jest-config>jest-environment-jsdom>jsdom>ws","react-scripts>jest>jest-cli>@jest/core>jest-runner>jest-config>jest-environment-jsdom>jsdom>ws","react-scripts>jest-circus>jest-runner>jest-config>jest-environment-jsdom>jsdom>ws","react-scripts>jest>@jest/core>jest-runner>jest-runtime>jest-config>jest-environment-jsdom>jsdom>ws","react-scripts>jest>jest-cli>@jest/core>jest-runner>jest-runtime>jest-config>jest-environment-jsdom>jsdom>ws","react-scripts>jest-circus>jest-runner>jest-runtime>jest-config>jest-environment-jsdom>jsdom>ws","react-scripts>jest>@jest/core>jest-runtime>jest-config>jest-environment-jsdom>jsdom>ws","react-scripts>jest>jest-cli>@jest/core>jest-runtime>jest-config>jest-environment-jsdom>jsdom>ws","react-scripts>jest-circus>jest-runtime>jest-config>jest-environment-jsdom>jsdom>ws","react-scripts>jest>jest-cli>jest-config>jest-environment-jsdom>jsdom>ws"]},{"version":"6.2.1","paths":["react-scripts>webpack-dev-server>ws"]}],"id":1748,"created":"2021-05-28T19:31:06.490Z","updated":"2021-06-10T23:01:46.443Z","deleted":null,"title":"Regular Expression Denial of Service","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"ws","cves":["CVE-2021-32640"],"vulnerable_versions":">=5.0.0 <5.2.3 || >=6.0.0 <6.2.2 || >=7.0.0 <7.4.6","patched_versions":">=5.2.3 <6.0.0 || >=6.2.2 <7.0.0 || >=7.4.6","overview":"In `ws` before versions 5.2.3, 6.2.2 and 7.4.6 there is a ReDOS vulnerability.\n\n### Impact\n\nA specially crafted value of the `Sec-Websocket-Protocol` header can be used to significantly slow down a ws server.\n\n### Proof of concept\n\n```js\nfor (const length of [1000, 2000, 4000, 8000, 16000, 32000]) {\n  const value = 'b' + ' '.repeat(length) + 'x';\n  const start = process.hrtime.bigint();\n\n  value.trim().split(/ *, */);\n\n  const end = process.hrtime.bigint();\n\n  console.log('length = %d, time = %f ns', length, end - start);\n}\n```\n\n### Patches\n\nThe vulnerability was fixed in ws@7.4.6 (https://github.com/websockets/ws/commit/00c425ec77993773d823f018f64a5c44e17023ff).\n\n### Workarounds\n\nIn vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the [`--max-http-header-size=size`](https://nodejs.org/api/cli.html#cli_max_http_header_size_size) and/or the [`maxHeaderSize`](https://nodejs.org/api/http.html#http_http_createserver_options_requestlistener) options.\n\n### Credits\n\nThe vulnerability was responsibly disclosed along with a fix in private by [Robert McLaughlin](https://github.com/robmcl4) from University of California, Santa Barbara.\n","recommendation":"Upgrade to version 5.2.3 or 6.2.2 or 7.4.6 or later","references":"- [CVE](https://nvd.nist.gov/vuln/detail/CVE-2021-32640)\n- [GitHub Advisory](https://github.com/advisories/GHSA-6fc8-4gx4-v693)","access":"public","severity":"moderate","cwe":"CWE-400","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1748"}}}
 {"type":"auditAdvisory","data":{"resolution":{"id":1754,"path":"react-scripts>html-webpack-plugin>pretty-error>renderkid>css-select>css-what","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"3.4.2","paths":["react-scripts>@svgr/webpack>@svgr/plugin-svgo>svgo>css-select>css-what","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-svgo>svgo>css-select>css-what","react-scripts>html-webpack-plugin>pretty-error>renderkid>css-select>css-what"]}],"id":1754,"created":"2021-06-07T22:13:06.506Z","updated":"2021-06-07T22:21:16.027Z","deleted":null,"title":"Denial of Service","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"css-what","cves":["CVE-2021-33587"],"vulnerable_versions":"<5.0.1","patched_versions":">=5.0.1","overview":"`css-what` before 5.0.1 does not ensure that attribute parsing has Linear Time Complexity relative to the size of the input.","recommendation":"Upgrade to version 5.0.1 or later","references":"- [CVE](https://nvd.nist.gov/vuln/detail/CVE-2021-33587)\n- [GitHub Advisory](https://github.com/advisories/GHSA-q8pj-2vqx-8ggc)\n","access":"public","severity":"high","cwe":"CWE-400","metadata":{"module_type":"","exploitability":7,"affected_components":""},"url":"https://npmjs.com/advisories/1754"}}}
-{"type":"auditAdvisory","data":{"resolution":{"id":1693,"path":"react-scripts>resolve-url-loader>postcss","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"7.0.35","paths":["react-scripts>css-loader>icss-utils>postcss","react-scripts>css-loader>postcss-modules-local-by-default>icss-utils>postcss","react-scripts>css-loader>postcss-modules-values>icss-utils>postcss","react-scripts>css-loader>postcss","react-scripts>css-loader>postcss-modules-extract-imports>postcss","react-scripts>css-loader>postcss-modules-local-by-default>postcss","react-scripts>css-loader>postcss-modules-scope>postcss","react-scripts>css-loader>postcss-modules-values>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>css-declaration-sorter>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>cssnano-util-raw-cache>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-calc>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-colormin>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-convert-values>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-discard-comments>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-discard-duplicates>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-discard-empty>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-discard-overridden>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-merge-longhand>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-merge-longhand>stylehacks>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-merge-rules>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-minify-font-values>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-minify-gradients>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-minify-params>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-minify-selectors>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-normalize-charset>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-normalize-display-values>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-normalize-positions>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-normalize-repeat-style>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-normalize-string>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-normalize-timing-functions>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-normalize-unicode>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-normalize-url>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-normalize-whitespace>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-ordered-values>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-reduce-initial>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-reduce-transforms>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-svgo>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>cssnano-preset-default>postcss-unique-selectors>postcss","react-scripts>optimize-css-assets-webpack-plugin>cssnano>postcss","react-scripts>postcss-flexbugs-fixes>postcss","react-scripts>postcss-loader>postcss","react-scripts>postcss-normalize>postcss","react-scripts>postcss-normalize>postcss-browser-comments>postcss","react-scripts>postcss-preset-env>autoprefixer>postcss","react-scripts>postcss-preset-env>css-blank-pseudo>postcss","react-scripts>postcss-preset-env>css-has-pseudo>postcss","react-scripts>postcss-preset-env>css-prefers-color-scheme>postcss","react-scripts>postcss-preset-env>postcss","react-scripts>postcss-preset-env>postcss-attribute-case-insensitive>postcss","react-scripts>postcss-preset-env>postcss-color-functional-notation>postcss","react-scripts>postcss-preset-env>postcss-color-gray>postcss","react-scripts>postcss-preset-env>postcss-color-hex-alpha>postcss","react-scripts>postcss-preset-env>postcss-color-mod-function>postcss","react-scripts>postcss-preset-env>postcss-color-rebeccapurple>postcss","react-scripts>postcss-preset-env>postcss-custom-media>postcss","react-scripts>postcss-preset-env>postcss-custom-properties>postcss","react-scripts>postcss-preset-env>postcss-custom-selectors>postcss","react-scripts>postcss-preset-env>postcss-dir-pseudo-class>postcss","react-scripts>postcss-preset-env>postcss-double-position-gradients>postcss","react-scripts>postcss-preset-env>postcss-env-function>postcss","react-scripts>postcss-preset-env>postcss-focus-visible>postcss","react-scripts>postcss-preset-env>postcss-focus-within>postcss","react-scripts>postcss-preset-env>postcss-font-variant>postcss","react-scripts>postcss-preset-env>postcss-gap-properties>postcss","react-scripts>postcss-preset-env>postcss-image-set-function>postcss","react-scripts>postcss-preset-env>postcss-initial>postcss","react-scripts>postcss-preset-env>postcss-lab-function>postcss","react-scripts>postcss-preset-env>postcss-logical>postcss","react-scripts>postcss-preset-env>postcss-media-minmax>postcss","react-scripts>postcss-preset-env>postcss-nesting>postcss","react-scripts>postcss-preset-env>postcss-overflow-shorthand>postcss","react-scripts>postcss-preset-env>postcss-page-break>postcss","react-scripts>postcss-preset-env>postcss-place>postcss","react-scripts>postcss-preset-env>postcss-pseudo-class-any-link>postcss","react-scripts>postcss-preset-env>postcss-replace-overflow-wrap>postcss","react-scripts>postcss-preset-env>postcss-selector-matches>postcss","react-scripts>postcss-preset-env>postcss-selector-not>postcss"]},{"version":"7.0.21","paths":["react-scripts>resolve-url-loader>postcss"]}],"id":1693,"created":"2021-05-10T15:38:31.238Z","updated":"2021-06-15T15:09:38.963Z","deleted":null,"title":"Regular Expression Denial of Service","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"postcss","cves":["CVE-2021-23368"],"vulnerable_versions":">=7.0.0 <7.0.36 || >=8.0.0 <8.2.10","patched_versions":">=7.0.36 <8.0.0 || >=8.2.10","overview":"`postcss` from 7.0.0 and before version 7.0.36 and 8.2.10 is vulnerable to Regular Expression Denial of Service (ReDoS) during source map parsing.","recommendation":"Upgrade to version 8.2.10 or later","references":"- [CVE](https://nvd.nist.gov/vuln/detail/CVE-2021-23368)\n- [GitHub Advisory](https://github.com/advisories/GHSA-hwj9-h5mp-3pm3)\n","access":"public","severity":"moderate","cwe":"CWE-400","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1693"}}}
 {"type":"auditAdvisory","data":{"resolution":{"id":1747,"path":"react-scripts>react-dev-utils>browserslist","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"4.14.2","paths":["react-scripts>react-dev-utils>browserslist"]}],"id":1747,"created":"2021-05-24T19:56:39.062Z","updated":"2021-05-24T19:59:05.419Z","deleted":null,"title":"Regular Expression Denial of Service","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"browserslist","cves":["CVE-2021-23364"],"vulnerable_versions":">=4.0.0 <4.16.5","patched_versions":">=4.16.5","overview":"The package `browserslist` from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of queries.","recommendation":"Upgrade to version 4.16.5 or later","references":"- [CVE](https://nvd.nist.gov/vuln/detail/CVE-2021-23364)\n- [GitHub Advisory](https://github.com/advisories/GHSA-w8qv-6jwh-64r5)\n","access":"public","severity":"moderate","cwe":"CWE-400","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1747"}}}
 {"type":"auditAdvisory","data":{"resolution":{"id":1748,"path":"react-scripts>webpack-dev-server>ws","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"7.4.5","paths":["react-scripts>jest>@jest/core>jest-config>jest-environment-jsdom>jsdom>ws","react-scripts>jest>jest-cli>@jest/core>jest-config>jest-environment-jsdom>jsdom>ws","react-scripts>jest>@jest/core>jest-runner>jest-config>jest-environment-jsdom>jsdom>ws","react-scripts>jest>jest-cli>@jest/core>jest-runner>jest-config>jest-environment-jsdom>jsdom>ws","react-scripts>jest-circus>jest-runner>jest-config>jest-environment-jsdom>jsdom>ws","react-scripts>jest>@jest/core>jest-runner>jest-runtime>jest-config>jest-environment-jsdom>jsdom>ws","react-scripts>jest>jest-cli>@jest/core>jest-runner>jest-runtime>jest-config>jest-environment-jsdom>jsdom>ws","react-scripts>jest-circus>jest-runner>jest-runtime>jest-config>jest-environment-jsdom>jsdom>ws","react-scripts>jest>@jest/core>jest-runtime>jest-config>jest-environment-jsdom>jsdom>ws","react-scripts>jest>jest-cli>@jest/core>jest-runtime>jest-config>jest-environment-jsdom>jsdom>ws","react-scripts>jest-circus>jest-runtime>jest-config>jest-environment-jsdom>jsdom>ws","react-scripts>jest>jest-cli>jest-config>jest-environment-jsdom>jsdom>ws"]},{"version":"6.2.1","paths":["react-scripts>webpack-dev-server>ws"]}],"id":1748,"created":"2021-05-28T19:31:06.490Z","updated":"2021-06-10T23:01:46.443Z","deleted":null,"title":"Regular Expression Denial of Service","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"ws","cves":["CVE-2021-32640"],"vulnerable_versions":">=5.0.0 <5.2.3 || >=6.0.0 <6.2.2 || >=7.0.0 <7.4.6","patched_versions":">=5.2.3 <6.0.0 || >=6.2.2 <7.0.0 || >=7.4.6","overview":"In `ws` before versions 5.2.3, 6.2.2 and 7.4.6 there is a ReDOS vulnerability.\n\n### Impact\n\nA specially crafted value of the `Sec-Websocket-Protocol` header can be used to significantly slow down a ws server.\n\n### Proof of concept\n\n```js\nfor (const length of [1000, 2000, 4000, 8000, 16000, 32000]) {\n  const value = 'b' + ' '.repeat(length) + 'x';\n  const start = process.hrtime.bigint();\n\n  value.trim().split(/ *, */);\n\n  const end = process.hrtime.bigint();\n\n  console.log('length = %d, time = %f ns', length, end - start);\n}\n```\n\n### Patches\n\nThe vulnerability was fixed in ws@7.4.6 (https://github.com/websockets/ws/commit/00c425ec77993773d823f018f64a5c44e17023ff).\n\n### Workarounds\n\nIn vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the [`--max-http-header-size=size`](https://nodejs.org/api/cli.html#cli_max_http_header_size_size) and/or the [`maxHeaderSize`](https://nodejs.org/api/http.html#http_http_createserver_options_requestlistener) options.\n\n### Credits\n\nThe vulnerability was responsibly disclosed along with a fix in private by [Robert McLaughlin](https://github.com/robmcl4) from University of California, Santa Barbara.\n","recommendation":"Upgrade to version 5.2.3 or 6.2.2 or 7.4.6 or later","references":"- [CVE](https://nvd.nist.gov/vuln/detail/CVE-2021-32640)\n- [GitHub Advisory](https://github.com/advisories/GHSA-6fc8-4gx4-v693)","access":"public","severity":"moderate","cwe":"CWE-400","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1748"}}}
 {"type":"auditAdvisory","data":{"resolution":{"id":1751,"path":"react-scripts>webpack>watchpack>watchpack-chokidar2>chokidar>glob-parent","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"3.1.0","paths":["react-scripts>webpack>watchpack>watchpack-chokidar2>chokidar>glob-parent","react-scripts>webpack-dev-server>chokidar>glob-parent"]}],"id":1751,"created":"2021-06-07T21:57:10.135Z","updated":"2021-06-07T21:58:07.745Z","deleted":null,"title":"Regular expression denial of service","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"glob-parent","cves":["CVE-2020-28469"],"vulnerable_versions":"<5.1.2","patched_versions":">=5.1.2","overview":"`glob-parent` before 5.1.2 has a regular expression denial of service vulnerability. The enclosure regex used to check for strings ending in enclosure containing path separator.","recommendation":"Upgrade to version 5.1.2 or later","references":"- [CVE](https://nvd.nist.gov/vuln/detail/CVE-2020-28469)\n- [GitHub Advisory](https://github.com/advisories/GHSA-ww39-953v-wcq6)\n","access":"public","severity":"moderate","cwe":"CWE-400","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1751"}}}
diff --git a/package.json b/package.json
index 1e7a7c709b..7e3ba75648 100644
--- a/package.json
+++ b/package.json
@@ -67,7 +67,9 @@
     "import:hses:local": "./node_modules/.bin/babel-node ./src/tools/importGrantGranteesCLI.js --skipdownload",
     "import:hses": "node ./build/server/tools/importGrantGranteesCLI.js",
     "reconcile:legacy": "node ./build/server/tools/reconcileLegacyReports.js",
-    "reconcile:legacy:local": "./node_modules/.bin/babel-node ./src/tools/reconcileLegacyReports.js"
+    "reconcile:legacy:local": "./node_modules/.bin/babel-node ./src/tools/reconcileLegacyReports.js",
+    "populateLegacyNonGrantees": "node ./build/server/tools/populateLegacyNonGranteesCLI.js",
+    "populateLegacyNonGrantees:local": "./node_modules/.bin/babel-node ./src/tools/populateLegacyNonGranteesCLI.js"
   },
   "repository": {
     "type": "git",
diff --git a/src/routes/widgets/handlers.test.js b/src/routes/widgets/handlers.test.js
index e2ac1bd379..32c046c350 100644
--- a/src/routes/widgets/handlers.test.js
+++ b/src/routes/widgets/handlers.test.js
@@ -31,7 +31,7 @@ describe('Widget handlers', () => {
       query: { 'region.in': ['1'] },
     };
     const response = {
-      numGrants: '0', numParticipants: '0', numReports: '0', numTotalGrants: '2', sumDuration: '0', sumTaDuration: '0', sumTrainingDuration: '0',
+      numGrants: '0', numNonGrantees: '0', numParticipants: '0', numReports: '0', numTotalGrants: '2', sumDuration: '0',
     };
 
     beforeEach(() => {
diff --git a/src/services/users.js b/src/services/users.js
index fa97a34968..a2b698b1a4 100644
--- a/src/services/users.js
+++ b/src/services/users.js
@@ -29,6 +29,9 @@ export async function userById(userId) {
     include: [
       { model: Permission, as: 'permissions', attributes: ['userId', 'scopeId', 'regionId'] },
     ],
+    order: [
+      [{ model: Permission, as: 'permissions' }, 'regionId', 'ASC'],
+    ],
   });
 }
 
diff --git a/src/tools/populateLegacyNonGrantees.js b/src/tools/populateLegacyNonGrantees.js
new file mode 100644
index 0000000000..812fee1b04
--- /dev/null
+++ b/src/tools/populateLegacyNonGrantees.js
@@ -0,0 +1,57 @@
+/* eslint-disable no-restricted-syntax */
+/* eslint-disable no-loop-func */
+import { Op } from 'sequelize';
+import { auditLogger } from '../logger';
+import { ActivityReport, ActivityRecipient, NonGrantee } from '../models';
+
+const hubNonGrantees = {
+  HSCO: 'Head Start Collaboration Office',
+  'Local/State Education System': 'State Education System',
+  'State Early Learning System / Guidelines': 'State Early Learning Standards',
+  'State Advisory Council': 'QRIS System',
+  'Regional TTA Team / Specialists': 'Regional TTA/Other Specialists',
+  'State Early Learning Standards / Guidelines':
+    'State Early Learning Standards',
+};
+
+const populateLegacyNonGrantees = async () => {
+  const nonGranteeReports = await ActivityReport.findAll({
+    where: {
+      [Op.and]: [
+        { legacyId: { [Op.ne]: null } },
+        {
+          imported: {
+            nonGranteeActivity: {
+              [Op.ne]: '',
+            },
+          },
+        },
+      ],
+    },
+  });
+
+  for await (const nonGranteeReport of nonGranteeReports) {
+    const nonGranteeArray = nonGranteeReport.imported.nonGranteeActivity.split(
+      '\n',
+    );
+    for await (const nonGranteeName of nonGranteeArray) {
+      const translatedNonGranteeName = hubNonGrantees[nonGranteeName] || nonGranteeName;
+      const nonGrantee = await NonGrantee.findOne({
+        where: { name: translatedNonGranteeName },
+      });
+      if (nonGrantee) {
+        auditLogger.info(
+          `Processing non-grantee ${nonGrantee.id} for activity report ${nonGranteeReport.id}`,
+        );
+        await ActivityRecipient.findOrCreate({
+          where: {
+            activityReportId: nonGranteeReport.id,
+            nonGranteeId: nonGrantee.id,
+          },
+        });
+      }
+    }
+  }
+};
+
+export default populateLegacyNonGrantees;
diff --git a/src/tools/populateLegacyNonGranteesCLI.js b/src/tools/populateLegacyNonGranteesCLI.js
new file mode 100644
index 0000000000..1a520465d3
--- /dev/null
+++ b/src/tools/populateLegacyNonGranteesCLI.js
@@ -0,0 +1,7 @@
+import populateLegacyNonGrantees from './populateLegacyNonGrantees';
+import { auditLogger } from '../logger';
+
+populateLegacyNonGrantees().catch((e) => {
+  auditLogger.error(e);
+  process.exit(1);
+});
diff --git a/src/widgets/overview.js b/src/widgets/overview.js
index 4ffda7a2e5..9f4aa237cf 100644
--- a/src/widgets/overview.js
+++ b/src/widgets/overview.js
@@ -2,6 +2,7 @@ import { Op } from 'sequelize';
 import {
   ActivityReport, ActivityRecipient, Grant, NonGrantee, sequelize,
 } from '../models';
+import { REPORT_STATUSES } from '../constants';
 /*
   Widgets on the backend should only have to worry about fetching data in the format required
   by the widget. In this case we return a single object but other widgets my require an array
@@ -12,25 +13,63 @@ import {
   If adding a new widget be sure to add the widget to ./index.js
 */
 export default async function overview(scopes, region) {
-  const grantsWhere = `WHERE "status" = 'Active' AND "regionId" in (${region})`;
-  const trainingWhere = '"ttaType" = \'{"training"}\'';
-  const taWhere = '"ttaType" = \'{"technical-assistance"}\'';
-  const ttaWhere = '"ttaType" = \'{"training", "technical-assistance"}\'';
-  const baseWhere = `WHERE "regionId" IN (${region}) AND "legacyId" IS NULL AND "status" != 'deleted'`;
+  const grantsWhere = `WHERE "regionId" in (${region})`;
+  const baseWhere = `${grantsWhere} AND "status" = '${REPORT_STATUSES.APPROVED}'`;
   // There could be a better way, but using sequelize.literal was the only way I could get correct
   // numbers for SUM
   // FIXME: see if there is a better way to get totals using SUM
   const res = await ActivityReport.findAll({
     attributes: [
-      [sequelize.fn('COUNT', sequelize.fn('DISTINCT', sequelize.col('"ActivityReport".id'))), 'numReports'],
-      [sequelize.fn('COUNT', sequelize.fn('DISTINCT', sequelize.col('"activityRecipients->grant"."id"'))), 'numGrants'],
-      [sequelize.literal(`(SELECT COUNT(*) from "Grants" ${grantsWhere})`), 'numTotalGrants'],
-      [sequelize.literal(`(SELECT COALESCE(SUM("numberOfParticipants"), 0) FROM "ActivityReports" ${baseWhere})`), 'numParticipants'],
-      [sequelize.literal(`(SELECT COALESCE(SUM(duration), 0) FROM "ActivityReports" ${baseWhere} AND ${trainingWhere})`), 'sumTrainingDuration'],
-      [sequelize.literal(`(SELECT COALESCE(SUM(duration), 0) FROM "ActivityReports" ${baseWhere} AND ${taWhere})`), 'sumTaDuration'],
-      [sequelize.literal(`(SELECT COALESCE(SUM(duration), 0) FROM "ActivityReports" ${baseWhere} AND ${ttaWhere})`), 'sumDuration'],
+      [
+        sequelize.fn(
+          'COUNT',
+          sequelize.fn('DISTINCT', sequelize.col('"ActivityReport".id')),
+        ),
+        'numReports',
+      ],
+      [
+        sequelize.fn(
+          'COUNT',
+          sequelize.fn(
+            'DISTINCT',
+            sequelize.col('"activityRecipients->grant"."id"'),
+          ),
+        ),
+        'numGrants',
+      ],
+      [
+        sequelize.literal(`(SELECT COUNT(*) from "Grants" ${grantsWhere})`),
+        'numTotalGrants',
+      ],
+      [
+        sequelize.fn(
+          'COUNT',
+          sequelize.fn(
+            'DISTINCT',
+            sequelize.col('"activityRecipients"."nonGranteeId"'),
+          ),
+        ),
+        'numNonGrantees',
+      ],
+      [
+        sequelize.literal(
+          `(SELECT COALESCE(SUM("numberOfParticipants"), 0) FROM "ActivityReports" ${baseWhere})`,
+        ),
+        'numParticipants',
+      ],
+      [
+        sequelize.literal(
+          `(SELECT COALESCE(SUM(duration), 0) FROM "ActivityReports" ${baseWhere})`,
+        ),
+        'sumDuration',
+      ],
     ],
-    where: { [Op.and]: [scopes, { legacyId: null }] },
+    where: {
+      [Op.and]: [
+        scopes,
+        { status: REPORT_STATUSES.APPROVED },
+      ],
+    },
     raw: true,
     // without 'includeIgnoreAttributes' the attributes from the join table
     // "activityReportObjectives" are included which causes postgres to error when
diff --git a/src/widgets/overview.test.js b/src/widgets/overview.test.js
index d39ff7f8d8..cb46ad6640 100644
--- a/src/widgets/overview.test.js
+++ b/src/widgets/overview.test.js
@@ -120,21 +120,20 @@ describe('Overview widget', () => {
     await createOrUpdate({ ...regionTwoReport, duration: 1.5 }, reportOneR2);
 
     const scopes = filtersToScopes({ 'region.in': ['17'] });
+    const data = await overview(scopes, 17);
     const {
       numReports,
       numGrants,
       numTotalGrants,
+      numNonGrantees,
       numParticipants,
-      sumTrainingDuration,
-      sumTaDuration,
       sumDuration,
-    } = await overview(scopes, 17);
+    } = data;
     expect(numReports).toBe('4');
     expect(numGrants).toBe('2');
     expect(numTotalGrants).toBe('2');
+    expect(numNonGrantees).toBe('0');
     expect(numParticipants).toBe('44');
-    expect(sumTrainingDuration).toBe('4.0');
-    expect(sumTaDuration).toBe('3.0');
-    expect(sumDuration).toBe('5.0');
+    expect(sumDuration).toBe('12.0');
   });
 });