[ProduktEntdecker]

Summary

Automated weekly dependency-hygiene run (npm audit fix, no --force).

Fixed (semver-compatible, no package.json change):

• nanoid: 3.3.16 -> 3.3.18 (fixes GHSA-2v37-7h3g-55p8, high severity — indefinite loop in custom generators when size is zero)

Build: npm run build (tsc) passed cleanly after the fix.

Remaining vulnerabilities (NOT auto-fixed — require a major bump)

npm audit fix --force would upgrade vitest 2.1.9 -> 4.1.11 (semver-major, breaking) to resolve these. Left for manual review per policy (no automatic major bumps):

• vitest <=3.2.5 — critical — GHSA-5xrq-8626-4rwp
• vite <=6.4.2 — high — GHSA-4w7w-66w2-5vf9, GHSA-v6wh-96g9-6wx3, GHSA-fx2h-pf6j-xcff
• esbuild <=0.24.2 (via vite) — moderate — GHSA-67mh-4wv8-2f99
• @vitest/mocker <=3.0.0-beta.4 (via vite) — moderate
• vite-node <=2.2.0-beta.2 (via vite) — moderate

All five are dev-only (test tooling), transitively pulled in by vitest. Upgrading vitest to 4.x is a breaking change and needs a dedicated PR with test-suite verification.

Also outdated (informational only, not touched)

Package	Current	Wanted	Latest
@types/node	22.19.3	22.20.1	26.2.0
tsx	4.21.0	4.23.12	4.23.12
typescript	5.8.3	5.8.3	7.0.2
vitest	2.1.9	2.1.9	4.1.11
zod	3.25.76	3.25.76	4.4.3

Test plan

• npm ci succeeded
• npm audit fix applied (no --force, no major bumps)
• Verified package-lock.json diff — only nanoid version bumped, no package.json changes
• npm run build passed

---

Generated by Claude Code

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

_{Comment @coderabbitai help to get the list of available commands.}

[ProduktEntdecker]

Überholt durch den neueren automatischen npm-audit-Lauf #50. Orchestrator-Aufräumen 11.10.2026, bei Bedarf wieder öffnen.