[ProduktEntdecker]

Summary

Weekly automated dependency-hygiene sweep (npm audit fix, no --force).

Advisory fixed:

• nanoid — custom generators can loop indefinitely when size is zero (GHSA-2v37-7h3g-55p8)

Only package-lock.json changed; package.json untouched.

Not touched (would require --force, a major bump — out of scope for this automated sweep):

• vitest/@vitest/mocker/vite/vite-node/esbuild chain (moderate/high/critical: path traversal, arbitrary file read, esbuild dev-server request exposure). Fixing requires vitest@5.0.2, a semver-major bump — left for manual review.

Other outdated packages (reporting only, not acted on): vitest 2.1.9→5.0.2 (major), typescript 5.8.3→7.0.2 (major), @types/node 22.19→26.6 (major), zod 3.25→4.6 (major); tsx 4.21→4.23 (minor/patch).

Test plan

• npm ci succeeded
• npm run build (tsc) passed after the fix

---

🤖 Generated with Claude Code

---

Generated by Claude Code

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

_{Comment @coderabbitai help to get the list of available commands.}

[ProduktEntdecker]

Überholt durch den neueren automatischen npm-audit-Lauf #50. Orchestrator-Aufräumen 11.10.2026, bei Bedarf wieder öffnen.