[ProduktEntdecker]

Summary

Automated weekly dependency hygiene sweep. npm audit fix (no --force) applied.

Fixed:

• nanoid: 3.3.16 → 3.3.18 — fixes GHSA-2v37-7h3g-55p8 (high, custom generators can loop indefinitely when size is zero)

Not auto-applied (would require breaking change, needs manual review):

• vitest 2.1.9 → 4.1.10 (major bump) would resolve the remaining chain:

  • esbuild <=0.24.2 (moderate) — GHSA-67mh-4wv8-2f99
  • vite <=6.4.2 (high) — GHSA-fx2h-pf6j-xcff and related moderate advisories
  • vite-node <=2.2.0-beta.2 (moderate)
  • @vitest/mocker <=3.0.0-beta.4 (moderate)
  • vitest <=3.2.5 (critical) — GHSA-5xrq-8626-4rwp

  All of these are dev-only dependencies (test tooling), not shipped in the published package. Bumping requires npm audit fix --force and was intentionally left out of this automated PR per policy — needs a human to review the vitest 2→4 migration separately.

Also outdated (informational, not vulnerabilities):

• @types/node: 22.19.3 → 22.20.1 (wanted) / 26.2.0 (latest, major)
• tsx: 4.21.0 → 4.23.12
• typescript: 5.8.3 → 7.0.2 (latest, major)
• zod: 3.25.76 → 4.4.3 (latest, major)

Build & test status

• npm run build (tsc): PASSED
• npm test (vitest, 195 tests across 8 files): PASSED

Test plan

• CI green
• Confirm npm audit no longer flags nanoid
• Consider a follow-up issue for the vitest 2→4 major upgrade to clear the remaining 5 advisories

---

Generated by Claude Code

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 2d0cf4cc-90de-4376-825a-2373f479d9a5

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[ProduktEntdecker]

Überholt durch den neueren automatischen npm-audit-Lauf #50. Orchestrator-Aufräumen 11.10.2026, bei Bedarf wieder öffnen.