[ProduktEntdecker]

Automated weekly dependency-hygiene run (2026-11-02). This is the rolling chore/npm-audit-fix PR — it supersedes the previous dated chore/npm-audit-fix-YYYY-MM-DD PRs, which are being closed in favor of this one.

What was fixed

npm audit fix (no --force) resolved 3 of the 10 reported vulnerabilities, all via non-breaking patch bumps in package-lock.json:

Package	Severity	Advisory
shell-quote (direct dep)	critical	GHSA-pqg4-j6r4-53mv — command injection via quote()
nanoid (transitive, dev)	high	GHSA-2v37-7h3g-55p8 — infinite loop on size 0
source-map-js (transitive, dev)	high	GHSA-68fv-2mgg-jv7q — event-loop DoS

Only package-lock.json changed; package.json ranges already covered the new versions.

Not touched (needs manual review — major/breaking bumps)

Left alone since fixing them requires --force (major version bumps), which this automation never applies:

• vitest 2.1.9 → latest 5.0.5 (breaking) — pulls in fixes for @vitest/mocker (moderate), tinypool (critical), vite/vite-node/esbuild (moderate/high)
• zod 3.25.76 → latest 4.6.7 (breaking) — GHSA-mrhx-c7xc-m3w5, high severity (memory exhaustion on oversized constrained collections)

7 vulnerabilities (3 moderate, 2 high, 2 critical) remain, all gated behind these major upgrades.

Also outdated (not security-relevant, collected only): @types/node 22.19.3 → 22.20.5 (wanted) / 26.6.6 (latest, major), tsx 4.21.0 → 4.23.15, typescript 5.8.3 → 7.0.2 (major).

Verification

• npm run build (tsc) passed with no errors.
• npm test passed: 195/195 tests across 8 files.

---

---

Generated by Claude Code

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters: 1

• package-lock.json is excluded by !**/package-lock.json

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: fdc147c7-e8fc-4105-9dd0-a7bf5e1aa110

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can copy the agent prompt from any finding and feed it to your IDE agent

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[qodo-code-review]

PR Summary by Qodo

Patch three vulnerable npm dependencies without major upgrades

🐞 Bug fix ⚙️ Configuration changes 🕐 10-20 Minutes

AI Description

• Refresh lockfile versions of shell-quote, nanoid, and source-map-js to address three advisories.
• Leave package.json ranges unchanged; seven vulnerabilities requiring major upgrades remain for
 manual review.

Diagram

graph TD
  Project["Patchpilot"] --> Runtime["Runtime dependencies"] --> Shell["shell-quote"]
  Project --> Dev["Development dependencies"] --> Nanoid["nanoid"]
  Dev --> SourceMap["source-map-js"]

Loading

High-Level Assessment

The non-forced lockfile update is appropriate for automated dependency hygiene. Major vitest and zod upgrades could address the remaining advisories, but require separate compatibility review rather than an automated forced update.

Files changed (1) +9 / -9

Other (1) +9 / -9

package-lock.jsonRefresh three vulnerable package resolutions +9/-9

Refresh three vulnerable package resolutions

• Updates shell-quote from 1.10.0 to 1.12.0, nanoid from 3.3.16 to 3.3.20, and source-map-js from 1.2.1 to 1.2.2, including their resolved URLs and integrity hashes. No dependency ranges or other lockfile entries change.

package-lock.json