[kroqdotdev]

pnpm audit --audit-level=high in checks fails on main, so every pull request is red, Dependabot's #47 and #48 included.

• next 16.4.0 to 16.4.2 (and eslint-config-next): GHSA-2464-fhr4-w9xw (critical, remote code execution through image optimization when sharp is older than 0.35.5 on glibc), GHSA-673q-mjm6-r5xr (critical, use cache returning typed arrays), GHSA-p3m5-59mp-jv5r (high, Server Actions denial of service). Checked against what runs: the published 0.5.0 image and the demo on statoss.com both carry sharp 0.35.5, and the app has no use cache and no Server Actions, so none of the three reaches a running copy. The bump is still due.
• vite 8.2.0 to 8.2.4 through an override in pnpm-workspace.yaml, as the repo does for other transitive fixes: six advisories in its development server, reached only through vitest.
• The rest of chore(deps): bump the all group with 7 updates #47: react and react-dom 19.3.1, nodemailer 10.1.7, @playwright/test 1.64.1, vitest 5.0.5.

pnpm audit reports no known vulnerabilities. Local: lint, format check, typecheck, 509 tests and the build pass. CHANGELOG has a Security entry.

Supersedes #47.

🤖 Generated with Claude Code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 42c385f5-c3c4-4dd2-a448-d92157513293

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}