[ProduktEntdecker]

Automated weekly dependency-hygiene check.

Fixed

• nanoid 3.3.16 → 3.3.19 (dev dependency, via @vitest/mocker/vite-node transitive chain) — fixes GHSA-2v37-7h3g-55p8 (high severity: custom generators can loop indefinitely when size is zero).

Applied via npm audit fix (no --force, no major bumps). Only package-lock.json changed; package.json is untouched.

Verified

• npm ci — clean install
• npm audit before: 6 vulnerabilities (3 moderate, 2 high, 1 critical) → after: 5 vulnerabilities (3 moderate, 1 high, 1 critical)
• npm run build (tsc) — passes with no errors

Remaining (needs manual review — NOT touched here)

5 vulnerabilities remain, all rooted in the vitest/vite/esbuild/@vitest/mocker/vite-node chain (dev-only test tooling):

• @vitest/mocker — moderate (path traversal / arbitrary file read, GHSA-82fw-gwwq-j7x9)
• esbuild — moderate (dev server request/response exposure, GHSA-67mh-4wv8-2f99)
• vite — high (transitive via vulnerable esbuild)
• vite-node — moderate (transitive via vulnerable vite)
• vitest — critical (transitive via all of the above)

All require npm audit fix --force, which would bump vitest from 2.1.9 to 5.0.3 — a semver-major breaking change. Per policy this automated job never applies --force or major version bumps. This needs a human-reviewed vitest v5 migration (test API/config changes) in a separate PR.

Also outdated (informational, not touched)

Package	Current	Wanted	Latest
@types/node	22.19.3	22.20.5	26.6.4
shell-quote	1.10.0	1.12.0	1.12.0
tsx	4.21.0	4.23.15	4.23.15
typescript	5.8.3	5.8.3	7.0.2
vitest	2.1.9	2.1.9	5.0.3
zod	3.25.76	3.25.76	4.6.5

No package version fields were changed, and no publish/version commands were run.

---

🤖 Generated with Claude Code

https://claude.ai/code/session_01Tg7K49RDQAwUD53nYWRMXS

---

Generated by Claude Code

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[ProduktEntdecker]

Superseded by the new rolling PR #56, which carries the same fix (and will keep rolling forward each week instead of opening a new dated PR). Closing this one.

---

Generated by Claude Code