Refresh vulnerable development dependencies while retaining Node 20 support #17

October 10, 2026 audit

npm audit --json reports seven affected package names: two critical, four high and one moderate. All are development dependencies; npm audit --omit=dev --json reports zero production vulnerabilities.

Vitest 3.2.7 pulls vulnerable tinypool 1.1.1 and @vitest/mocker 3.2.7. Other affected transitive packages include brace-expansion, js-yaml, nanoid and source-map-js. These advisory ratings do not establish exploitability of the deployed static app.

Acceptance criteria

• Refresh compatible lockfile patches and migrate Vitest to a patched supported release.
• Evaluate Vitest 4.1.11 or newer compatible release: the reviewed version removes tinypool and patches mocker, while supporting Node 20 and Vite 6.
• Avoid blindly applying npm's suggested Vitest 5 major upgrade, which requires Node 22.12+ and conflicts with the declared >=20 engine.
• Run npm ci, npm run check, npm run test:browser and npm audit. Resolve or explicitly assess remaining advisories.

References: GHSA-82fw-gwwq-j7x9 and GHSA-85c8-ppgw-ccpr .

Additional S5 scanner report supplied by the maintainer

S5 reports six high and two medium entries (ratings/grouping differ from npm audit):

S5 read one lockfile and 407 unique package versions. Lack of OpenSSF Scorecard coverage was informational, not a failure. The fix is being prepared separately on review/dependency-refresh so dependency validation is independent of the UI work in #20.