[ProduktEntdecker]

Automated weekly dependency hygiene

Ran npm audit fix (no --force) and updated the lockfile only.

Fixed

• nanoid 3.3.16 → 3.3.19 — resolves GHSA-2v37-7h3g-55p8 (High): custom generators could loop indefinitely when size is zero.

Build status

Passed — npm run build (tsc) completed with no errors after the fix.

Not fixed (needs manual review — left untouched)

The remaining 5 advisories all require vitest@5.0.1, a semver-major bump, and were intentionally not applied (no --force per policy):

• vitest (Critical) — [GHSA relates to vitest <=4.1.10]
• vite (High) — <=6.4.2
• @vitest/mocker (Moderate) — GHSA-82fw-gwwq-j7x9 (Vitest path traversal via mocker redirect mock)
• esbuild (Moderate) — GHSA-67mh-4wv8-2f99 (dev-server request/response exposure)
• vite-node (Moderate) — <=2.2.0-beta.2

All are dev-only dependencies (via vitest/vite devDependency chain), not production runtime risk. Upgrading vitest 2.x → 5.x is a major version bump and needs manual review/testing before applying.

Also outdated (informational, no action taken — majors need manual review):

package	current	wanted	latest
@types/node	22.19.3	22.20.4	26.6.2
tsx	4.21.0	4.23.15	4.23.15
typescript	5.8.3	5.8.3	7.0.2
vitest	2.1.9	2.1.9	5.0.1
zod	3.25.76	3.25.76	4.6.5

---

🤖 Generated with Claude Code

https://claude.ai/code/session_016JTjkk79HD4b7sV9m5qVup

---

Generated by Claude Code

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

_{Comment @coderabbitai help to get the list of available commands.}

[ProduktEntdecker]

Überholt durch den neueren automatischen npm-audit-Lauf #50. Orchestrator-Aufräumen 11.10.2026, bei Bedarf wieder öffnen.