[ProduktEntdecker]

Summary

Automated weekly dependency hygiene run (npm audit fix, no --force).

Fixed (3 of 9 advisories)

• nanoid <3.3.18 → 3.3.20 (high) — infinite loop with size 0 in custom generators (GHSA-2v37-7h3g-55p8)
• shell-quote 1.8.4 - 1.10.0 → 1.12.0 (critical, direct dependency) — command injection via line terminator in a comment token (GHSA-pqg4-j6r4-53mv)
• source-map-js 1.0.0 - 1.2.1 → 1.2.2 (high) — event-loop DoS via indexed source-map section offsets (GHSA-68fv-2mgg-jv7q)

Only package-lock.json changed (resolved versions bumped within existing semver ranges in package.json). No manual dependency edits.

NOT fixed (left for manual review — all require a major bump)

• vitest <=4.1.10 (critical) and its dependents @vitest/mocker, esbuild, tinypool, vite, vite-node — all require vitest@5.0.3, a semver-major breaking change. Per policy, --force was not used and this bump was not applied.

Build & tests

• npm run build (tsc) — passed
• npm test (vitest run) — passed, 195/195 tests

---

🤖 Generated with Claude Code

---

Generated by Claude Code

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[ProduktEntdecker]

Superseded by the new rolling PR #56, which carries the same fix (and will keep rolling forward each week instead of opening a new dated PR). Closing this one.

---

Generated by Claude Code