[ProduktEntdecker]

Summary

Automated weekly dependency hygiene run (npm audit fix, no --force).

Fixed:

• nanoid (high) — custom generators can loop indefinitely when size is zero (GHSA-2v37-7h3g-55p8)

Not auto-applied (5 vulnerabilities, all rooted in a vitest major bump 2.1.9 → 5.0.0, which npm audit itself flags as a breaking change resolvable only via --force; per policy this run never uses --force or manual major bumps):

• esbuild (moderate) — dev server allows arbitrary request/response read from any website
• vite (high) — path traversal in optimized deps .map handling; NTLMv2 hash disclosure; server.fs.deny bypass on Windows
• vite-node (moderate) — transitively vulnerable via vite
• @vitest/mocker (moderate) — transitively vulnerable via vite
• vitest (critical) — arbitrary file read/execute via Vitest UI server, transitively via the above

These need a deliberate, reviewed major-version upgrade of vitest (and its toolchain) in a follow-up PR.

Test plan

• npm ci succeeded
• npm run build (tsc) succeeded after the fix, no type errors
• Only package-lock.json changed; no package.json or source changes

🤖 Generated with Claude Code

https://claude.ai/code/session_01YAjzKMoeM4j1YLNJQQHrun

---

Generated by Claude Code

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

_{Comment @coderabbitai help to get the list of available commands.}

[ProduktEntdecker]

Überholt durch den neueren automatischen npm-audit-Lauf #50. Orchestrator-Aufräumen 11.10.2026, bei Bedarf wieder öffnen.