[ProduktEntdecker]

Automated weekly dependency hygiene run (npm audit fix, no --force).

Before: 6 vulnerabilities (3 moderate, 2 high, 1 critical)
After: 5 vulnerabilities (3 moderate, 1 high, 1 critical)

Fixed (patched in package-lock.json, no package.json changes):

• nanoid — high, infinite loop when custom generator size is zero (GHSA-2v37-7h3g-55p8)

Not auto-applied (would require npm audit fix --force, out of scope for this automated run — see "Needs manual review" in the weekly report):

• vitest (critical) / vite (high) / @vitest/mocker (moderate) / vite-node (moderate) / esbuild (moderate) — all resolve only via a vitest@5.0.0 major bump (current: 2.1.9), which npm audit fix itself flags as a breaking change

Build: npm run build (tsc) passed cleanly after the fix — no type errors.

Also collected via npm outdated (not applied, for awareness only): @types/node 22.19.3→22.20.2 (wanted) / 26.5.1 (latest, major), tsx →4.23.13, typescript →7.0.2 (latest, major), vitest →5.0.0 (latest, major — see above), zod →4.6.5 (latest, major).

---

🤖 Generated with Claude Code

https://claude.ai/code/session_01Xe6ot1thRY6LSt11oE9P5U

---

Generated by Claude Code

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

_{Comment @coderabbitai help to get the list of available commands.}

[ProduktEntdecker]

Überholt durch den neueren automatischen npm-audit-Lauf #50. Orchestrator-Aufräumen 11.10.2026, bei Bedarf wieder öffnen.