[ProduktEntdecker]

Summary

Automated weekly dependency hygiene: npm audit fix (no --force) applied to package-lock.json.

Fixed (non-breaking bumps):

• shell-quote 1.10.0 → 1.12.0 (critical advisory)
• source-map-js → patched
• nanoid → patched

Result: vulnerabilities reduced from 9 (3 moderate, 3 high, 3 critical) to 6 (3 moderate, 1 high, 2 critical).

Not auto-applied (would require --force / major bump — left for manual review):

• vitest 2.1.9 → 5.0.5 (major) — pulls in fixes for @vitest/mocker, tinypool (critical: prototype pollution RCE gadget), vite, vite-node, esbuild
• zod 3.25.76 → 4.6.7 (major, not vulnerability-related, just outdated)
• typescript 5.8.3 → 7.0.2 (major, not vulnerability-related)

Test plan

• npm run build (tsc) passes on the updated lockfile
• npm audit re-run to confirm vulnerability count dropped from 9 → 6
• Manual review of vitest major-version upgrade (breaking test API changes expected)

---

Generated by Claude Code

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[ProduktEntdecker]

Superseded by the new rolling PR #56, which carries the same fix (and will keep rolling forward each week instead of opening a new dated PR). Closing this one.

---

Generated by Claude Code