[ProduktEntdecker]

Summary

Automated weekly dependency hygiene check (2026-08-31). Ran npm audit fix (no --force), which cleanly resolved 1 of 6 known vulnerabilities via a transitive lockfile-only bump. package.json is unchanged.

Advisories fixed

• nanoid (high) — custom generator can loop indefinitely when size is zero (GHSA-2v37-7h3g-55p8)

Not auto-applied (needs manual review)

The remaining 5 advisories (esbuild moderate-DoS, vite, vite-node, @vitest/mocker, vitest — critical arbitrary file read) all only resolve via npm audit fix --force, which would bump vitest from 2.1.9 to 4.1.11 — a semver-major breaking change. Per policy, --force/breaking fixes are never auto-applied; this needs a deliberate vitest v4 migration in a follow-up PR.

npm outdated also flagged (informational only, nothing auto-applied):

Package	Current	Wanted	Latest
vitest	2.1.9	2.1.9	4.1.11
zod	3.25.76	3.25.76	4.5.4
typescript	5.8.3	5.8.3	7.0.2
@types/node	22.19.3	22.20.1	26.4.0
tsx	4.21.0	4.23.13	4.23.13

Test plan

• npm run build (tsc) passes cleanly after the fix
• Only package-lock.json changed; package.json untouched

---

Generated by Claude Code

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

_{Comment @coderabbitai help to get the list of available commands.}

[ProduktEntdecker]

Überholt durch den neueren automatischen npm-audit-Lauf #50. Orchestrator-Aufräumen 11.10.2026, bei Bedarf wieder öffnen.