[0x73746F66]

Sets the affected range of GCVE-110-NPM-2026-034409 (familiar-vtt) to introduced 2.5.16, fixed 2.22.0, as the maintainer asked in #8.

Evidence

The update-macro tool is executed by the Foundry module (familiar.zip, the release asset in Ryanjansen92/familiar-releases); the npm package forwards the call. Comparing the published release assets:

• v2.21.0 (release): the handler only rejects a type change, then calls macro.update(updates), so a new command on an existing script macro is written.
• v2.22.0 (release, published 2026-08-09; npm 2.22.0 the same day): before the write the handler throws AI cannot rewrite the command of script macro "…". Script macro code must be edited manually by the GM in the Foundry UI. when type === "script" and command is set. update-compendium-entry refuses the same for script macros in packs.
• The same check is present in v2.23.0, v2.24.0, v2.25.0, v2.26.0 and v3.0.0 (3.0.0 rewords the message).
• The tool description still says script macros "remain executable" through 2.26.0; the record now notes that the handler refuses the edit regardless.

Change

• Vulnetix: default_status unaffected, 2.5.16 less_than 2.22.0 affected, 2.22.0 unaffected; details sentence on the fix; release references.
• OSV: range introduced 2.5.16 / fixed 2.22.0; references.
• CVE 5: same versions; description; references; dateUpdated.
• index/manifest.json: modified.

The Vulnetix record validates against schemas/vulnetix-advisory-1.2.0.schema.json.

Closes #8