side-channel-list

Reproduced: Deleting the first node in a multi-node list incorrectly resets to , discarding all remaining nodes. The condition checks whether the deleted node was the head of the list, but doesn't verify the list is actually empty. After deletion of the head node, still points to remaining nodes, but is set to , silently losing all other stored key-value pairs. (confidence: 9/10) Data structure: is a sentinel/root node (no key/value), and actual data nodes are linked via . So the "first data node" is . Scenario: List has two entries: set('a', 1) then set('b', 2). After these operations: , , Now delete('b'): 1. → 2. → calls 3. In : , . → true. → (correctly removes nodeB from the list) Since is true, we skip the move-to-head logic. Returns . 4. Back in : , , so → true 5. → $o is reset to undefined!* But was pointing to (which still has key 'a'). By setting , we've lost nodeA entirely. The bug is real: the intent of the check seems to be "if the list is now empty, clean up $o", but only checks if the deleted node was the first* data node, not whether the list is empty after deletion. The correct check should be something like (i.e., the sentinel has no more children).

Hi Team, We are getting issue in blackduck due to OutdatedFOSSLibraries older than 12 months for dependency side-channel-list as shown below. Kindly look into it and let us know if there is any plan for new version update regarding this. Best, Dyland.