[ProduktEntdecker]

Automated weekly dependency-hygiene run (2026-10-26).

What was fixed

npm audit fix (no --force) resolved 3 of the 10 reported vulnerabilities, all via non-breaking patch bumps in package-lock.json:

Package	From → To	Severity	Advisory
shell-quote (direct dep)	1.10.0 → 1.12.0	critical	GHSA-pqg4-j6r4-53mv — command injection via quote()
nanoid (transitive, dev)	3.3.16 → 3.3.20	high	GHSA-2v37-7h3g-55p8 — infinite loop on size 0
source-map-js (transitive, dev)	1.2.1 → 1.2.2	high	GHSA-68fv-2mgg-jv7q — event-loop DoS

Only package-lock.json changed; package.json ranges already covered the new versions.

Not touched (needs manual review — major/breaking bumps)

These remain and were intentionally left alone since fixing them requires --force (major version bumps), which this automation never applies:

• vitest 2.1.9 → latest 5.0.5 (breaking) — pulls in fixes for @vitest/mocker (moderate), tinypool (critical), vite/vite-node/esbuild (moderate/high)
• zod 3.25.76 → latest 4.6.7 (breaking) — GHSA-mrhx-c7xc-m3w5, high severity (memory exhaustion on oversized constrained collections)

7 vulnerabilities (3 moderate, 2 high, 2 critical) remain, all gated behind these major upgrades.

Verification

• npm run build (tsc) passed with no errors after the fix.
• npm test passed: 195/195 tests across 8 files.

---

Generated by Claude Code

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[ProduktEntdecker]

Superseded by the new rolling PR #56, which carries the same fix (and will keep rolling forward each week instead of opening a new dated PR). Closing this one.

---

Generated by Claude Code