[ProduktEntdecker]

Summary

Automated weekly dependency-hygiene run. npm audit fix (no --force) was applied.

Fixed (non-breaking):

• nanoid 3.3.16 → 3.3.18 — resolves:
  • GHSA-28wg-ghj8-5hjv (non-secure generators can loop indefinitely with negative size)
  • GHSA-2v37-7h3g-55p8 (custom generators can loop indefinitely when size is zero)

Not auto-fixed (would require a semver-major bump, so left untouched per policy — no --force used):

• vitest (dev dependency) and its transitive chain (vite, vite-node, @vitest/mocker, esbuild) — fix requires vitest@4.1.10, a breaking major upgrade from the current ^2.0.0 range. Covers 1 critical, 1 high, 3 moderate advisories, most notably GHSA-5xrq-8626-4rwp (critical: arbitrary file read/execute when Vitest UI server is listening).

These require a manual, deliberate major-version upgrade and are reported separately below for visibility — not part of this PR.

Outdated (not touched — informational only)

Package	Current	Latest	Bump
@types/node	22.19.3	26.2.0	major
tsx	4.21.0	4.23.12	patch
typescript	5.8.3	7.0.2	major
vitest	2.1.9	4.1.10	major
zod	3.25.76	4.4.3	major

Test plan

• npm ci — clean install succeeded
• npm audit fix (no --force) applied — only touched package-lock.json (nanoid bump)
• npm run build (tsc) — passed after the fix
• Reviewer: confirm CI is green, then merge at your discretion (this PR is left as draft and unmerged per automation policy)

🤖 Generated by an automated weekly dependency-hygiene routine.

---

Generated by Claude Code

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: df409bf7-d8fc-41fd-b14a-8cc4f0edd8c4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[ProduktEntdecker]

Überholt durch den neueren automatischen npm-audit-Lauf #50. Orchestrator-Aufräumen 11.10.2026, bei Bedarf wieder öffnen.