pingdotgg/t3code tech-debt free score −36/100

Partial scan: this repository is larger than the free scanner reads in one go.

86 manifest files beyond the 300-file limit were not read.

Tech-debt free score

−36/100

In the red

22 critical or high advisories, 52 moderate advisories, 27 packages a whole major behind and 105 more behind the safe target.

36 below zero: the dependency debt outweighs the whole scale.

How we got −36

Critical/high CVEs and outdated majors cost 80 of 136 lost points. Fix the 22 critical/high CVEs first.

22 critical/high CVEs22 × 25 = 550capped at 50costs −50 points, 37% of points lost
27 majors behind27 × 6 = 162capped at 30costs −30 points, 22% of points lost
52 moderate/low CVEs52 × 8 = 416capped at 24costs −24 points, 18% of points lost
4 deprecated packages4 × 5costs −20 points, 15% of points lost
50 minors behind50 × 2 = 100capped at 12costs −12 points, 9% of points lost

Nothing found in: Node runtime EOL

Debt-free score100 − 136 =−36

100 means no dependency debt; below zero means the debt outweighs the whole scale. Every advisory and every version behind costs points.

pingdotgg/t3code scores −36 out of 100 on the tech-debt free score, which is below zero: its dependency debt outweighs the whole scale (in the red; 100 means no dependency debt). 17 of its 207 packages carry known advisories, 22 of them critical or high. 27 packages are a whole major version behind and 105 more trail the safe target. The scan covers npm and github-actions. Last scanned 29 Oct 2026.

Last scanned 29 Oct 2026 · 1 public scan so far · re-scanned about once a week

Packages & tools

207

132 behind the safe target (64%)

Needs action

advisory, deprecated or a major behind

Behind target

110

minor or patch behind

Current

at or above the safe target

Advisories

across 17 packages, from OSV.dev

How the 207 packages splitred needs a ticket, amber a bump, green nothing

45 need action110 behind target52 current

01 · Worst first

The 5 packages costing pingdotgg/t3code the most

Each one links to its row in the table below, with the safe target and the advisories.

actions/checkout v6 → 7.0.1
github-actions · a whole major behind
actions/create-github-app-token v2 → 3.3.0
github-actions · a whole major behind
actions/github-script v8 → 9.0.0
github-actions · a whole major behind
actions/setup-java v5 → 6.1.0
github-actions · a whole major behind
actions/stale v9 → 11.0.0
github-actions · a whole major behind

02 · Packages

207 packages, worst first

The safe target is the newest stable release that has been public for at least 14 days. Fresh releases are where supply-chain attacks land.

Packages with installed, latest and safe target versions
Status	Package	Installed	Latest	≥ 14d	Safe target	Drift	CVEs
Needs action	github-actionstooling · v6Sign up to research for actions/checkout	v6declared	7.0.120 Jul 2026	Latest release is 100 days old, past the 14-day window	7.0.120 Jul 2026	major	0
Upgrade path major Installedv6 declared, no lockfile Safe target · latest7.0.120 Jul 2026public for 14+ days A whole major behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for v6. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `v6 → 7.0.1` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem github-actions Section tooling Declared v6 Deprecated No
Needs action	github-actionstooling · v2Sign up to research for actions/create-github-app-token	v2declared	3.3.012 Oct 2026	Latest release is 16 days old, past the 14-day window	3.3.012 Oct 2026	major	0
Upgrade path major Installedv2 declared, no lockfile Safe target · latest3.3.012 Oct 2026public for 14+ days A whole major behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for v2. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `v2 → 3.3.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem github-actions Section tooling Declared v2 Deprecated No
Needs action	github-actionstooling · v8Sign up to research for actions/github-script	v8declared	9.0.09 Apr 2026	Latest release is 202 days old, past the 14-day window	9.0.09 Apr 2026	major	0
Upgrade path major Installedv8 declared, no lockfile Safe target · latest9.0.09 Apr 2026public for 14+ days A whole major behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for v8. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `v8 → 9.0.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem github-actions Section tooling Declared v8 Deprecated No
Needs action	github-actionstooling · v5Sign up to research for actions/setup-java	v5declared	6.1.014 Oct 2026	Latest release is 14 days old, past the 14-day window	6.1.014 Oct 2026	major	0
Upgrade path major Installedv5 declared, no lockfile Safe target · latest6.1.014 Oct 2026public for 14+ days A whole major behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for v5. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `v5 → 6.1.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem github-actions Section tooling Declared v5 Deprecated No
Needs action	github-actionstooling · v9Sign up to research for actions/stale	v9declared	11.0.028 Jul 2026	Latest release is 93 days old, past the 14-day window	11.0.028 Jul 2026	major	0
Upgrade path major Installedv9 declared, no lockfile Safe target · latest11.0.028 Jul 2026public for 14+ days A whole major behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for v9. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `v9 → 11.0.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem github-actions Section tooling Declared v9 Deprecated No
Needs action	npmdependencies · catalog:Sign up to research for @astrojs/react	6.0.5lockfile	7.1.228 Oct 2026	Latest release is only 0 days old, inside the 14-day window	7.0.16 Oct 2026	major	0
Upgrade path major Installed6.0.5 from the lockfile Safe target7.0.16 Oct 2026public for 14+ days Latest7.1.228 Oct 2026only 0d old, inside the 14-day window A whole major behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 6.0.5. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `6.0.5 → 7.0.1` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared catalog: Deprecated No
Needs action	npmdevDependencies · catalog:Sign up to research for @better-auth/drizzle-adapter	1.7.5lockfile	1.7.1426 Oct 2026	Latest release is only 2 days old, inside the 14-day window	1.7.1015 Oct 2026	patch	1
Upgrade path patch Installed1.7.5 from the lockfile Safe target1.7.1015 Oct 2026public for 14+ days Latest1.7.1426 Oct 2026only 2d old, inside the 14-day window A patch behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 1 1 low lowCVSS 3.7GHSA-44jh-23m7-hpcf @better-auth/drizzle-adapter: Concurrent requests can exceed rate limits on PostgreSQL CVE-2026-110861fixed in `1.7.7` Research not included on this scan Breaking changes, the work involved and the new features between `1.7.5 → 1.7.10` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Needs action	npmdependencies · 0.10.0Sign up to research for @neon/ai-sdk-provider	0.10.0lockfile	1.3.026 Oct 2026	Latest release is only 3 days old, inside the 14-day window	1.0.15 Oct 2026	major	0
Upgrade path major Installed0.10.0 from the lockfile Safe target1.0.15 Oct 2026public for 14+ days Latest1.3.026 Oct 2026only 3d old, inside the 14-day window A whole major behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 0.10.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `0.10.0 → 1.0.1` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared 0.10.0 Deprecated No
Needs action	npmdevDependencies · catalog:Sign up to research for @opennextjs/cloudflare	1.20.1lockfile	1.20.1428 Oct 2026	Latest release is only 0 days old, inside the 14-day window	1.20.1215 Oct 2026	patch	1
Upgrade path patch Installed1.20.1 from the lockfile Safe target1.20.1215 Oct 2026public for 14+ days Latest1.20.1428 Oct 2026only 0d old, inside the 14-day window A patch behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 1 1 high highCVSS 7.5GHSA-2vc4-c4r6-p6v6 OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded paths CVE-2026-100409fixed in `1.20.2` Research not included on this scan Breaking changes, the work involved and the new features between `1.20.1 → 1.20.12` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Needs action	npmdevDependencies · catalog:deprecatedSign up to research for @prisma-next/cli	0.8.0lockfile	0.16.021 Jul 2026	Latest release is 100 days old, past the 14-day window	-	unknown	0
Upgrade path unknown Installed0.8.0 from the lockfile Safe target- no release has cleared the window yet Latest0.16.021 Jul 2026100d public, past the window Could not tell how far behind this is. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 0.8.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `0.8.0 → target` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared catalog: Deprecated Yes, by its maintainers
Needs action	npmdependencies · catalog:deprecatedSign up to research for @prisma-next/postgres	0.8.0lockfile	0.16.021 Jul 2026	Latest release is 100 days old, past the 14-day window	-	unknown	0
Upgrade path unknown Installed0.8.0 from the lockfile Safe target- no release has cleared the window yet Latest0.16.021 Jul 2026100d public, past the window Could not tell how far behind this is. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 0.8.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `0.8.0 → target` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared catalog: Deprecated Yes, by its maintainers
Needs action	npmdevDependencies · catalog:deprecatedSign up to research for @prisma-next/target-postgres	0.8.0lockfile	0.16.021 Jul 2026	Latest release is 100 days old, past the 14-day window	-	unknown	0
Upgrade path unknown Installed0.8.0 from the lockfile Safe target- no release has cleared the window yet Latest0.16.021 Jul 2026100d public, past the window Could not tell how far behind this is. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 0.8.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `0.8.0 → target` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared catalog: Deprecated Yes, by its maintainers
Needs action	npmdevDependencies · catalog:deprecatedSign up to research for @prisma-next/vite-plugin-contract-emit	0.8.0lockfile	0.16.021 Jul 2026	Latest release is 100 days old, past the 14-day window	-	unknown	0
Upgrade path unknown Installed0.8.0 from the lockfile Safe target- no release has cleared the window yet Latest0.16.021 Jul 2026100d public, past the window Could not tell how far behind this is. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 0.8.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `0.8.0 → target` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared catalog: Deprecated Yes, by its maintainers
Needs action	npmdevDependencies · catalog:Sign up to research for @react-router/dev	7.16.0lockfile	8.5.127 Oct 2026	Latest release is only 1 days old, inside the 14-day window	8.4.015 Sep 2026	major	0
Upgrade path major Installed7.16.0 from the lockfile Safe target8.4.015 Sep 2026public for 14+ days Latest8.5.127 Oct 2026only 1d old, inside the 14-day window A whole major behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 7.16.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `7.16.0 → 8.4.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Needs action	npmdependencies · catalog:Sign up to research for @react-router/node	7.16.0lockfile	8.5.127 Oct 2026	Latest release is only 1 days old, inside the 14-day window	8.4.015 Sep 2026	major	0
Upgrade path major Installed7.16.0 from the lockfile Safe target8.4.015 Sep 2026public for 14+ days Latest8.5.127 Oct 2026only 1d old, inside the 14-day window A whole major behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 7.16.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `7.16.0 → 8.4.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared catalog: Deprecated No
Needs action	npmdependencies · catalog:Sign up to research for @solidjs/router	0.16.3lockfile	1.0.028 Jul 2026	Latest release is 92 days old, past the 14-day window	1.0.028 Jul 2026	major	0
Upgrade path major Installed0.16.3 from the lockfile Safe target · latest1.0.028 Jul 2026public for 14+ days A whole major behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 0.16.3. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `0.16.3 → 1.0.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared catalog: Deprecated No
Needs action	npmdevDependencies · catalog:Sign up to research for @sveltejs/kit	3.0.0-next.27lockfile	3.1.014 Oct 2026	Latest release is 14 days old, past the 14-day window	3.1.014 Oct 2026	minor	2
Upgrade path minor Installed3.0.0-next.27 from the lockfile Safe target · latest3.1.014 Oct 2026public for 14+ days A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 2 2 low lowCVSS 0.0GHSA-27mw-82g8-phjj SvelteKit : XSS via untrusted cache-control header in prerendered page CVE-2026-114061fixed in `3.0.0` lowCVSS 4.7GHSA-pfhg-q3qv-9q6r SvelteKit: URL redirection to untrusted site via enhanced form submission CVE-2026-114060fixed in `3.0.0` Research not included on this scan Breaking changes, the work involved and the new features between `3.0.0-next.27 → 3.1.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Needs action	npmdependencies · catalog:Sign up to research for @tanstack/react-start	1.168.49lockfile	1.169.422 Oct 2026	Latest release is only 6 days old, inside the 14-day window	1.169.214 Oct 2026	minor	1
Upgrade path minor Installed1.168.49 from the lockfile Safe target1.169.214 Oct 2026public for 14+ days Latest1.169.422 Oct 2026only 6d old, inside the 14-day window A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 1 1 critical criticalCVSS 9.3GHSA-qx66-fv34-fjm8 TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses CVE-2026-102989fixed in `1.168.60` Research not included on this scan Breaking changes, the work involved and the new features between `1.168.49 → 1.169.2` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared catalog: Deprecated No
Needs action	npmdependencies · catalog:Sign up to research for @tanstack/solid-start	1.168.42lockfile	1.169.422 Oct 2026	Latest release is only 6 days old, inside the 14-day window	1.169.214 Oct 2026	minor	1
Upgrade path minor Installed1.168.42 from the lockfile Safe target1.169.214 Oct 2026public for 14+ days Latest1.169.422 Oct 2026only 6d old, inside the 14-day window A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 1 1 critical criticalCVSS 9.3GHSA-qx66-fv34-fjm8 TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses CVE-2026-102989fixed in `1.168.57` Research not included on this scan Breaking changes, the work involved and the new features between `1.168.42 → 1.169.2` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared catalog: Deprecated No
Needs action	npmdevDependencies · catalog:node24Sign up to research for @types/node	24.13.3lockfile	26.6.628 Oct 2026	Latest release is only 0 days old, inside the 14-day window	26.6.59 Oct 2026	major	0
Upgrade path major Installed24.13.3 from the lockfile Safe target26.6.59 Oct 2026public for 14+ days Latest26.6.628 Oct 2026only 0d old, inside the 14-day window A whole major behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 24.13.3. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `24.13.3 → 26.6.5` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared catalog:node24 Deprecated No
Needs action	npmdevDependencies · catalog:tanstack-start-legacySign up to research for @vitejs/plugin-react	5.2.0lockfile	6.1.25 Oct 2026	Latest release is 24 days old, past the 14-day window	6.1.25 Oct 2026	major	0
Upgrade path major Installed5.2.0 from the lockfile Safe target · latest6.1.25 Oct 2026public for 14+ days A whole major behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 5.2.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `5.2.0 → 6.1.2` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared catalog:tanstack-start-legacy Deprecated No
Needs action	npmdependencies · catalog:Sign up to research for astro	7.3.1lockfile	7.4.428 Oct 2026	Latest release is only 0 days old, inside the 14-day window	7.3.88 Oct 2026	patch	4
Upgrade path patch Installed7.3.1 from the lockfile Safe target7.3.88 Oct 2026public for 14+ days Latest7.4.428 Oct 2026only 0d old, inside the 14-day window A patch behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 4 1 moderate, 1 low, 2 unknown moderateCVSS 6.5GHSA-98hj-9722-w3j8 Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering CVE-2026-114128fixed in `7.3.2` lowGHSA-mpr7-6m5w-76rw Astro: Arbitrary CSS injection in Astro View Transitions CVE-2026-114127fixed in `7.3.3` unknownGHSA-26w7-cxv4-gfx2 details not fetched (limit reached) unknownGHSA-376h-93r7-7g6f details not fetched (limit reached) Research not included on this scan Breaking changes, the work involved and the new features between `7.3.1 → 7.3.8` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared catalog: Deprecated No
Needs action	npmdependencies · catalog:Sign up to research for better-auth	1.7.5lockfile	1.7.1426 Oct 2026	Latest release is only 2 days old, inside the 14-day window	1.7.1015 Oct 2026	patch	3
Upgrade path patch Installed1.7.5 from the lockfile Safe target1.7.1015 Oct 2026public for 14+ days Latest1.7.1426 Oct 2026only 2d old, inside the 14-day window A patch behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 3 1 critical, 1 high, 1 low criticalCVSS 9.1GHSA-965c-763c-88jm better-auth: OAuth state can be used as a Magic Link to sign in as another user CVE-2026-110862, CVE-2026-114607fixed in `1.7.7` highCVSS 7.4GHSA-r4xp-prcw-77qf better-auth: OAuth Proxy lets an attacker sign in as another user CVE-2026-110864fixed in `1.7.7` lowCVSS 3.7GHSA-44jh-23m7-hpcf @better-auth/drizzle-adapter: Concurrent requests can exceed rate limits on PostgreSQL CVE-2026-110861fixed in `1.7.7` Research not included on this scan Breaking changes, the work involved and the new features between `1.7.5 → 1.7.10` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared catalog: Deprecated No
Needs action	npmdevDependencies · catalog:Sign up to research for changelogithub	13.16.1lockfile	15.0.527 Aug 2026	Latest release is 63 days old, past the 14-day window	15.0.527 Aug 2026	major	0
Upgrade path major Installed13.16.1 from the lockfile Safe target · latest15.0.527 Aug 2026public for 14+ days A whole major behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 13.16.1. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `13.16.1 → 15.0.5` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Needs action	npmdependencies · catalog:Sign up to research for devalue	5.8.1lockfile	6.0.313 Oct 2026	Latest release is 15 days old, past the 14-day window	6.0.313 Oct 2026	major	8
Upgrade path major Installed5.8.1 from the lockfile Safe target · latest6.0.313 Oct 2026public for 14+ days A whole major behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 8 8 unknown unknownGHSA-4q55-j62x-fr9h details not fetched (limit reached) unknownGHSA-9rgm-9g3h-6x36 details not fetched (limit reached) unknownGHSA-hx4r-w6wj-j8fg details not fetched (limit reached) unknownGHSA-j22f-vq7h-c4qm details not fetched (limit reached) unknownGHSA-mcm9-63f2-9j32 details not fetched (limit reached) unknownGHSA-r9w8-h9r3-54w4 details not fetched (limit reached) unknownGHSA-wf3x-273g-mvxv details not fetched (limit reached) unknownGHSA-x5rw-q4pp-hg5g details not fetched (limit reached) Research not included on this scan Breaking changes, the work involved and the new features between `5.8.1 → 6.0.3` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared catalog: Deprecated No
Needs action	npmdevDependencies · catalog:Sign up to research for dotenv	17.4.2lockfile	18.0.922 Oct 2026	Latest release is only 6 days old, inside the 14-day window	18.0.814 Oct 2026	major	0
Upgrade path major Installed17.4.2 from the lockfile Safe target18.0.814 Oct 2026public for 14+ days Latest18.0.922 Oct 2026only 6d old, inside the 14-day window A whole major behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 17.4.2. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `17.4.2 → 18.0.8` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Needs action	npmdependencies · catalog:Sign up to research for hono	4.12.33lockfile	4.13.1425 Oct 2026	Latest release is only 4 days old, inside the 14-day window	4.13.134 Oct 2026	minor	9
Upgrade path minor Installed4.12.33 from the lockfile Safe target4.13.134 Oct 2026public for 14+ days Latest4.13.1425 Oct 2026only 4d old, inside the 14-day window A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 9 8 moderate, 1 low moderateCVSS 5.3GHSA-54fx-42gc-7vw4 Hono: Algorithmic Complexity DoS in Language Middleware CVE-2026-71848fixed in `4.12.34` moderateCVSS 5.3GHSA-5r4p-p66f-jhc7 Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths CVE-2026-109955, CVE-2026-111757fixed in `4.13.11` moderateCVSS 5.3GHSA-8j4g-w8fx-2239 Hono: ReDoS in CORS middleware via Access-Control-Request-Headers CVE-2026-69207fixed in `4.12.34` moderateCVSS 5.9GHSA-crvj-82cr-hjcx Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials CVE-2026-84363fixed in `4.13.5` moderateCVSS 4.8GHSA-f23p-vx2j-j53r Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure CVE-2026-71850fixed in `4.12.34` moderateCVSS 5.3GHSA-g6gw-c38x-mqfc Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion CVE-2026-84364fixed in `4.13.5` moderateCVSS 6.5GHSA-gqvv-2mrq-wpjv Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory CVE-2026-84365fixed in `4.13.5` moderateCVSS 4.7GHSA-hxh3-vqpv-xpqv hono/jsx renders plain strings unescaped in boundary components, leading to XSS CVE-2026-93981fixed in `4.13.7` lowCVSS 3.7GHSA-79qm-7rj5-m7r9 Hono: Proxy Helper does not remove response headers listed in the `Connection` header CVE-2026-71849fixed in `4.12.34` Research not included on this scan Breaking changes, the work involved and the new features between `4.12.33 → 4.13.13` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared catalog: Deprecated No
Needs action	npmdependencies · catalog:Sign up to research for magic-string	0.30.21lockfile	1.4.527 Oct 2026	Latest release is only 2 days old, inside the 14-day window	1.4.35 Oct 2026	major	0
Upgrade path major Installed0.30.21 from the lockfile Safe target1.4.35 Oct 2026public for 14+ days Latest1.4.527 Oct 2026only 2d old, inside the 14-day window A whole major behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 0.30.21. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `0.30.21 → 1.4.3` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared catalog: Deprecated No
Needs action	npmdependencies · ^3.0.0Sign up to research for make-dir	3.0.0declared	5.1.010 Sep 2025	Latest release is 413 days old, past the 14-day window	5.1.010 Sep 2025	major	0
Upgrade path major Installed3.0.0 declared, no lockfile Safe target · latest5.1.010 Sep 2025public for 14+ days A whole major behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 3.0.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `3.0.0 → 5.1.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared ^3.0.0 Deprecated No
Needs action	npmdependencies · ^16.4.1Sign up to research for marked	16.4.2lockfile	18.1.226 Oct 2026	Latest release is only 2 days old, inside the 14-day window	18.1.112 Oct 2026	major	0
Upgrade path major Installed16.4.2 from the lockfile Safe target18.1.112 Oct 2026public for 14+ days Latest18.1.226 Oct 2026only 2d old, inside the 14-day window A whole major behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 16.4.2. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `16.4.2 → 18.1.1` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared ^16.4.1 Deprecated No
Needs action	npmdevDependencies · catalog:Sign up to research for mongodb	6.21.0lockfile	7.7.028 Sep 2026	Latest release is 30 days old, past the 14-day window	7.7.028 Sep 2026	major	0
Upgrade path major Installed6.21.0 from the lockfile Safe target · latest7.7.028 Sep 2026public for 14+ days A whole major behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 6.21.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `6.21.0 → 7.7.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Needs action	npmdevDependencies · 4.21.1Sign up to research for neonctl	4.21.1lockfile	8.13.228 Oct 2026	Latest release is only 0 days old, inside the 14-day window	8.4.515 Oct 2026	major	0
Upgrade path major Installed4.21.1 from the lockfile Safe target8.4.515 Oct 2026public for 14+ days Latest8.13.228 Oct 2026only 0d old, inside the 14-day window A whole major behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 4.21.1. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `4.21.1 → 8.4.5` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared 4.21.1 Deprecated No
Needs action	npmdependencies · catalog:Sign up to research for next	16.2.10lockfile	16.4.323 Oct 2026	Latest release is only 6 days old, inside the 14-day window	16.4.114 Oct 2026	minor	20
Upgrade path minor Installed16.2.10 from the lockfile Safe target16.4.114 Oct 2026public for 14+ days Latest16.4.323 Oct 2026only 6d old, inside the 14-day window A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 20 5 critical, 6 high, 8 moderate, 1 low criticalGHSA-2464-fhr4-w9xw Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used fixed in `16.4.1` criticalGHSA-2xp9-vwfh-vxw4 Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used fixed in `16.3.3` criticalGHSA-673q-mjm6-r5xr Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays fixed in `16.4.1` criticalCVSS 9.0GHSA-p293-qw3h-jr36 Next.js: Unauthenticated Remote Code Execution on windows-hosted servers CVE-2026-75604fixed in `16.3.3` criticalGHSA-vcvr-r3jv-pc5j Next.js: Remote Code Execution in next/og ImageResponse fixed in `16.3.6` highGHSA-6gpp-xcg3-4w24 Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale CVE-2026-64642fixed in `16.2.11` highGHSA-89xv-2m56-2m9x Next.js: Server-Side Request Forgery in Server Actions on custom servers CVE-2026-64649fixed in `16.2.11` highCVSS 6.5GHSA-cjq9-62q9-8jv4 Next.js has Server-Side Request Forgery in Image Optimization CVE-2026-94483fixed in `16.3.8` highGHSA-m99w-x7hq-7vfj Next.js: Denial of Service in App Router using Server Actions CVE-2026-64641fixed in `16.2.11` highGHSA-p3m5-59mp-jv5r Next.js: Denial of Service in App Router using Server Actions CVE-2026-94482fixed in `16.4.1` highGHSA-p9j2-gv94-2wf4 Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname CVE-2026-64645fixed in `16.2.11` moderateGHSA-4633-3j49-mh5q Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences CVE-2026-64647fixed in `16.2.11` moderateGHSA-4c39-4ccg-62r3 Next.js: Unbounded Server Action payload in Edge runtime CVE-2026-64646fixed in `16.2.11` moderateCVSS 5.3GHSA-4jqv-mc3x-m676 Next.js has cache poisoning of SSG and ISR pages in self-hosted applications CVE-2026-94543fixed in `16.3.8` moderateGHSA-68g3-v927-f742 Next.js: Cache confusion of response bodies for requests with bodies CVE-2026-64648fixed in `16.2.11` moderateGHSA-955p-x3mx-jcvp Next.js: Unauthenticated disclosure of internal Server Function endpoints CVE-2026-64643fixed in `16.2.11` moderateCVSS 5.3GHSA-f87g-xv8r-7p7x Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass CVE-2026-94485fixed in `16.3.8` moderateCVSS 4.8GHSA-mcj8-r9mp-w47p Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service CVE-2026-94484fixed in `15.5.27` moderateGHSA-q8wf-6r8g-63ch Next.js: Denial of Service in the Image Optimization API using SVGs CVE-2026-64644fixed in `16.2.11` lowCVSS 5.4GHSA-39w2-rjm5-chcv Next.js has information disclosure in development server's Model Context Protocol endpoint CVE-2026-94486fixed in `16.3.8` Research not included on this scan Breaking changes, the work involved and the new features between `16.2.10 → 16.4.1` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared catalog: Deprecated No
Needs action	npmdependencies · catalog:Sign up to research for nitro	3.0.260415-betalockfile	3.0.260903-beta3 Sep 2026	Latest release is 55 days old, past the 14-day window	0.0.012 Feb 2024	current	2
Upgrade path current Installed3.0.260415-beta from the lockfile Safe target0.0.012 Feb 2024public for 14+ days Latest3.0.260903-beta3 Sep 202655d public, past the window Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 2 2 moderate moderateCVSS 5.3GHSA-5w89-w975-hf9q Nitro has a proxy scope bypass via percent-encoded path traversal in `routeRules` CVE-2026-44373fixed in `3.0.260429-beta` moderateCVSS 6.1GHSA-9phm-9p8f-hw5m Nitro has an Open Redirect via Protocol-Relative URL Bypass in Wildcard Route Rules CVE-2026-44372fixed in `3.0.260429-beta` Research not included on this scan Breaking changes, the work involved and the new features between `3.0.260415-beta → 0.0.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared catalog: Deprecated No
Needs action	npmdevDependencies · catalog:Sign up to research for npm-run-all2	8.0.4lockfile	9.0.421 Oct 2026	Latest release is only 7 days old, inside the 14-day window	9.0.328 Jul 2026	major	0
Upgrade path major Installed8.0.4 from the lockfile Safe target9.0.328 Jul 2026public for 14+ days Latest9.0.421 Oct 2026only 7d old, inside the 14-day window A whole major behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 8.0.4. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `8.0.4 → 9.0.3` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Needs action	npmdevDependencies · catalog:Sign up to research for nuxt	4.5.1lockfile	4.6.327 Oct 2026	Latest release is only 2 days old, inside the 14-day window	4.6.19 Oct 2026	minor	3
Upgrade path minor Installed4.5.1 from the lockfile Safe target4.6.19 Oct 2026public for 14+ days Latest4.6.327 Oct 2026only 2d old, inside the 14-day window A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 3 2 moderate, 1 low moderateGHSA-vjh5-4x84-xrqp Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive CVE-2026-114132fixed in `4.6.2` moderateCVSS 5.4GHSA-xfq5-w38q-pc2x Nuxt server islands render `useHeadSafe` input without sanitisation CVE-2026-114133fixed in `4.6.2` lowGHSA-jjm6-p2m9-9w4x Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabled CVE-2026-114130fixed in `4.6.0` Research not included on this scan Breaking changes, the work involved and the new features between `4.5.1 → 4.6.1` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Needs action	npmtooling · 11.25.0Sign up to research for pnpm	11.25.0declared	12.16.127 Oct 2026	Latest release is only 1 days old, inside the 14-day window	12.14.015 Oct 2026	major	0
Upgrade path major Installed11.25.0 declared, no lockfile Safe target12.14.015 Oct 2026public for 14+ days Latest12.16.127 Oct 2026only 1d old, inside the 14-day window A whole major behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 11.25.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `11.25.0 → 12.14.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section tooling Declared 11.25.0 Deprecated No
Needs action	npmdevDependencies · catalog:Sign up to research for postal-mime	2.7.5lockfile	4.1.422 Oct 2026	Latest release is only 7 days old, inside the 14-day window	4.0.715 Oct 2026	major	0
Upgrade path major Installed2.7.5 from the lockfile Safe target4.0.715 Oct 2026public for 14+ days Latest4.1.422 Oct 2026only 7d old, inside the 14-day window A whole major behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 2.7.5. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `2.7.5 → 4.0.7` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Needs action	npmdevDependencies · catalog:Sign up to research for react-devtools-core	7.0.1lockfile	8.0.09 Sep 2026	Latest release is 49 days old, past the 14-day window	8.0.09 Sep 2026	major	0
Upgrade path major Installed7.0.1 from the lockfile Safe target · latest8.0.09 Sep 2026public for 14+ days A whole major behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 7.0.1. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `7.0.1 → 8.0.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Needs action	npmdependencies · catalog:Sign up to research for react-router	7.16.0lockfile	8.5.127 Oct 2026	Latest release is only 1 days old, inside the 14-day window	8.4.015 Sep 2026	major	5
Upgrade path major Installed7.16.0 from the lockfile Safe target8.4.015 Sep 2026public for 14+ days Latest8.5.127 Oct 2026only 1d old, inside the 14-day window A whole major behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 5 2 high, 3 moderate highGHSA-chx6-hx7r-mcp5 React Router: Unauthenticated Denial of Service via Inefficient Route Matching CVE-2026-55685fixed in `7.18.0` highGHSA-qwww-vcr4-c8h2 React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response fixed in `8.3.0` moderateCVSS 6.1GHSA-337j-9hxr-rhxg React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration CVE-2026-53666fixed in `7.18.0` moderateCVSS 6.9GHSA-h8fp-f39c-q6mh React Router: RSCErrorHandler Missing Protocol Validation (XSS) CVE-2026-53667fixed in `7.18.0` moderateGHSA-wrjc-x8rr-h8h6 React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass) CVE-2026-53669fixed in `7.18.0` Research not included on this scan Breaking changes, the work involved and the new features between `7.16.0 → 8.4.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared catalog: Deprecated No
Needs action	npmdependencies · catalog:Sign up to research for sharp	0.35.4lockfile	0.35.527 Sep 2026	Latest release is 32 days old, past the 14-day window	0.35.527 Sep 2026	patch	1
Upgrade path patch Installed0.35.4 from the lockfile Safe target · latest0.35.527 Sep 2026public for 14+ days A patch behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 1 1 unknown unknownGHSA-wq5f-xc86-pv6w details not fetched (limit reached) Research not included on this scan Breaking changes, the work involved and the new features between `0.35.4 → 0.35.5` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared catalog: Deprecated No
Needs action	npmdevDependencies · catalog:nextjsSign up to research for typescript	5.9.3lockfile	7.0.28 Jul 2026	Latest release is 112 days old, past the 14-day window	7.0.28 Jul 2026	major	0
Upgrade path major Installed5.9.3 from the lockfile Safe target · latest7.0.28 Jul 2026public for 14+ days A whole major behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 5.9.3. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `5.9.3 → 7.0.2` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared catalog:nextjs Deprecated No
Needs action	npmdevDependencies · catalog:Sign up to research for vite	8.2.1lockfile	8.3.521 Oct 2026	Latest release is only 8 days old, inside the 14-day window	8.3.48 Oct 2026	minor	11
Upgrade path minor Installed8.2.1 from the lockfile Safe target8.3.48 Oct 2026public for 14+ days Latest8.3.521 Oct 2026only 8d old, inside the 14-day window A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 11 3 high, 7 moderate, 1 low highGHSA-587h-7wmj-h5pm launch-editor: `fs.existsSync()` existence check can be bypassed on Windows CVE-2026-112942fixed in `6.4.4` highGHSA-p9ff-h696-f583 Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket CVE-2026-39363fixed in `6.4.2` highGHSA-v2wj-q39q-566r Vite: `server.fs.deny` bypassed with queries CVE-2026-39364fixed in `7.3.2` moderateGHSA-4w7w-66w2-5vf9 Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling CVE-2026-39365fixed in `6.4.2` moderateGHSA-698v-4r3x-3vcv launch-editor: escapeCmdArgs() omits % escaping on Windows CVE-2026-112943fixed in `6.4.4` moderateGHSA-fx2h-pf6j-xcff vite: `server.fs.deny` bypass on Windows alternate paths CVE-2026-53571fixed in `6.4.3` moderateGHSA-r825-w8mm-5pxw launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors CVE-2026-112944fixed in `6.4.4` moderateGHSA-rq7h-c2jc-7f22 Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine CVE-2026-112946fixed in `6.4.4` moderateGHSA-v6wh-96g9-6wx3 launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows CVE-2026-53632fixed in `6.4.3` moderateGHSA-vfpm-58rq-9qcg Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance` CVE-2026-112947fixed in `8.2.4` lowGHSA-9jrq-w75r-8gcw Vite: Cross origin script execution through Vite custom middleware CVE-2026-112945fixed in `6.4.4` Research not included on this scan Breaking changes, the work involved and the new features between `8.2.1 → 8.3.4` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Needs action	npmdevDependencies · catalog:cloudflare-test-compatSign up to research for vitest	4.1.10lockfile	5.0.515 Oct 2026	Latest release is only 13 days old, inside the 14-day window	5.0.412 Oct 2026	major	1
Upgrade path major Installed4.1.10 from the lockfile Safe target5.0.412 Oct 2026public for 14+ days Latest5.0.515 Oct 2026only 13d old, inside the 14-day window A whole major behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 1 1 unknown unknownGHSA-82fw-gwwq-j7x9 details not fetched (limit reached) Research not included on this scan Breaking changes, the work involved and the new features between `4.1.10 → 5.0.4` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared catalog:cloudflare-test-compat Deprecated No
Needs action	npmdependencies · catalog:Sign up to research for zod	4.5.4lockfile	4.6.712 Oct 2026	Latest release is 16 days old, past the 14-day window	4.6.712 Oct 2026	minor	1
Upgrade path minor Installed4.5.4 from the lockfile Safe target · latest4.6.712 Oct 2026public for 14+ days A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 1 1 high highCVSS 7.5GHSA-mrhx-c7xc-m3w5 Zod can exhaust memory while validating oversized constrained collections CVE-2023-54404fixed in `4.6.6` Research not included on this scan Breaking changes, the work involved and the new features between `4.5.4 → 4.6.7` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared catalog: Deprecated No
Behind	github-actionstooling · v6	v6declared	6.1.026 Jun 2026	Latest release is 124 days old, past the 14-day window	6.1.026 Jun 2026	current	0
Upgrade path current Installedv6 declared, no lockfile Safe target · latest6.1.026 Jun 2026public for 14+ days Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for v6. Checked against OSV. Nothing to research: actions/cache is at its safe target with no known advisories. Ecosystem github-actions Section tooling Declared v6 Deprecated No
Behind	github-actionstooling · v8	v8declared	8.0.27 Oct 2026	Latest release is 22 days old, past the 14-day window	8.0.27 Oct 2026	current	0
Upgrade path current Installedv8 declared, no lockfile Safe target · latest8.0.27 Oct 2026public for 14+ days Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for v8. Checked against OSV. Nothing to research: actions/download-artifact is at its safe target with no known advisories. Ecosystem github-actions Section tooling Declared v8 Deprecated No
Behind	github-actionstooling · v7	v7declared	7.0.27 Oct 2026	Latest release is 22 days old, past the 14-day window	7.0.27 Oct 2026	current	0
Upgrade path current Installedv7 declared, no lockfile Safe target · latest7.0.27 Oct 2026public for 14+ days Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for v7. Checked against OSV. Nothing to research: actions/upload-artifact is at its safe target with no known advisories. Ecosystem github-actions Section tooling Declared v7 Deprecated No
Behind	github-actionstooling · stableSign up to research for dtolnay/rust-toolchain	stabledeclared	115 Jul 2022	Latest release is 1566 days old, past the 14-day window	115 Jul 2022	unknown	0
Upgrade path unknown Installedstable declared, no lockfile Safe target · latest115 Jul 2022public for 14+ days Could not tell how far behind this is. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for stable. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `stable → 1` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem github-actions Section tooling Declared stable Deprecated No
Behind	github-actionstooling · v8Sign up to research for expo/expo-github-action	v8declared	9.0.120 Oct 2026	Latest release is only 8 days old, inside the 14-day window	-	unknown	0
Upgrade path unknown Installedv8 declared, no lockfile Safe target- no release has cleared the window yet Latest9.0.120 Oct 2026only 8d old, inside the 14-day window Could not tell how far behind this is. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for v8. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `v8 → target` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem github-actions Section tooling Declared v8 Deprecated No
Behind	github-actionstooling · v5Sign up to research for gradle/actions	v5declared	6.4.128 Oct 2026	Latest release is only 1 days old, inside the 14-day window	-	unknown	0
Upgrade path unknown Installedv5 declared, no lockfile Safe target- no release has cleared the window yet Latest6.4.128 Oct 2026only 1d old, inside the 14-day window Could not tell how far behind this is. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for v5. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `v5 → target` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem github-actions Section tooling Declared v5 Deprecated No
Behind	github-actionstooling · d66fa29a64600490892131ad87597c30c91fcac4Sign up to research for mitchellh/vouch	d66fa29a64600490892131ad87597c30c91fcac4declared	1.5.012 Jul 2026	Latest release is 108 days old, past the 14-day window	1.5.012 Jul 2026	unknown	0
Upgrade path unknown Installedd66fa29a64600490892131ad87597c30c91fcac4 declared, no lockfile Safe target · latest1.5.012 Jul 2026public for 14+ days Could not tell how far behind this is. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for d66fa29a64600490892131ad87597c30c91fcac4. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `d66fa29a64600490892131ad87597c30c91fcac4 → 1.5.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem github-actions Section tooling Declared d66fa29a64600490892131ad87597c30c91fcac4 Deprecated No
Behind	github-actionstooling · v2	v2declared	2.38.05 Jul 2026	Latest release is 116 days old, past the 14-day window	2.38.05 Jul 2026	current	0
Upgrade path current Installedv2 declared, no lockfile Safe target · latest2.38.05 Jul 2026public for 14+ days Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for v2. Checked against OSV. Nothing to research: reactivecircus/android-emulator-runner is at its safe target with no known advisories. Ecosystem github-actions Section tooling Declared v2 Deprecated No
Behind	github-actionstooling · v3	v3declared	3.0.330 Aug 2026	Latest release is 60 days old, past the 14-day window	3.0.330 Aug 2026	current	0
Upgrade path current Installedv3 declared, no lockfile Safe target · latest3.0.330 Aug 2026public for 14+ days Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for v3. Checked against OSV. Nothing to research: softprops/action-gh-release is at its safe target with no known advisories. Ecosystem github-actions Section tooling Declared v3 Deprecated No
Behind	github-actionstooling · 8cca0918f8471c33515202b73f56ab27f2bed283Sign up to research for taiki-e/install-action	8cca0918f8471c33515202b73f56ab27f2bed283declared	2.88.028 Oct 2026	Latest release is only 1 days old, inside the 14-day window	-	unknown	0
Upgrade path unknown Installed8cca0918f8471c33515202b73f56ab27f2bed283 declared, no lockfile Safe target- no release has cleared the window yet Latest2.88.028 Oct 2026only 1d old, inside the 14-day window Could not tell how far behind this is. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 8cca0918f8471c33515202b73f56ab27f2bed283. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `8cca0918f8471c33515202b73f56ab27f2bed283 → target` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem github-actions Section tooling Declared 8cca0918f8471c33515202b73f56ab27f2bed283 Deprecated No
Behind	github-actionstooling · v1Sign up to research for voidzero-dev/setup-vp	v1declared	1.22.023 Oct 2026	Latest release is only 6 days old, inside the 14-day window	-	unknown	0
Upgrade path unknown Installedv1 declared, no lockfile Safe target- no release has cleared the window yet Latest1.22.023 Oct 2026only 6d old, inside the 14-day window Could not tell how far behind this is. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for v1. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `v1 → target` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem github-actions Section tooling Declared v1 Deprecated No
Behind	npmdependencies · catalog:Sign up to research for @alchemy.run/sigil	0.1.0-alpha.1lockfile	0.0.0-alpha.1114 Sep 2026	Latest release is 45 days old, past the 14-day window	-	unknown	0
Upgrade path unknown Installed0.1.0-alpha.1 from the lockfile Safe target- no release has cleared the window yet Latest0.0.0-alpha.1114 Sep 202645d public, past the window Could not tell how far behind this is. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 0.1.0-alpha.1. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `0.1.0-alpha.1 → target` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared catalog: Deprecated No
Behind	npmdevDependencies · catalog:Sign up to research for @astrojs/internal-helpers	0.10.1lockfile	0.13.015 Oct 2026	Latest release is only 13 days old, inside the 14-day window	0.12.06 Oct 2026	minor	0
Upgrade path minor Installed0.10.1 from the lockfile Safe target0.12.06 Oct 2026public for 14+ days Latest0.13.015 Oct 2026only 13d old, inside the 14-day window A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 0.10.1. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `0.10.1 → 0.12.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Behind	npmdependencies · catalog:Sign up to research for @astrojs/mdx	8.0.0lockfile	8.1.228 Oct 2026	Latest release is only 0 days old, inside the 14-day window	8.0.36 Oct 2026	patch	0
Upgrade path patch Installed8.0.0 from the lockfile Safe target8.0.36 Oct 2026public for 14+ days Latest8.1.228 Oct 2026only 0d old, inside the 14-day window A patch behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 8.0.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `8.0.0 → 8.0.3` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared catalog: Deprecated No
Behind	npmdependencies · catalog:Sign up to research for @astrojs/starlight	0.42.0lockfile	0.42.723 Oct 2026	Latest release is only 5 days old, inside the 14-day window	0.42.68 Oct 2026	patch	0
Upgrade path patch Installed0.42.0 from the lockfile Safe target0.42.68 Oct 2026public for 14+ days Latest0.42.723 Oct 2026only 5d old, inside the 14-day window A patch behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 0.42.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `0.42.0 → 0.42.6` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared catalog: Deprecated No
Behind	npmdevDependencies · catalog:Sign up to research for @astrojs/underscore-redirects	1.0.3lockfile	1.0.411 Aug 2026	Latest release is 78 days old, past the 14-day window	1.0.411 Aug 2026	patch	0
Upgrade path patch Installed1.0.3 from the lockfile Safe target · latest1.0.411 Aug 2026public for 14+ days A patch behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 1.0.3. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `1.0.3 → 1.0.4` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Behind	npmdependencies · 3.984.0Sign up to research for @aws-sdk/client-s3	3.984.0lockfile	3.1159.028 Oct 2026	Latest release is only 0 days old, inside the 14-day window	3.1152.014 Oct 2026	minor	0
Upgrade path minor Installed3.984.0 from the lockfile Safe target3.1152.014 Oct 2026public for 14+ days Latest3.1159.028 Oct 2026only 0d old, inside the 14-day window A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 3.984.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `3.984.0 → 3.1152.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared 3.984.0 Deprecated No
Behind	npmdependencies · 3.984.0Sign up to research for @aws-sdk/s3-request-presigner	3.984.0lockfile	3.1159.028 Oct 2026	Latest release is only 0 days old, inside the 14-day window	3.1152.014 Oct 2026	minor	0
Upgrade path minor Installed3.984.0 from the lockfile Safe target3.1152.014 Oct 2026public for 14+ days Latest3.1159.028 Oct 2026only 0d old, inside the 14-day window A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 3.984.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `3.984.0 → 3.1152.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared 3.984.0 Deprecated No
Behind	npmdevDependencies · catalog:Sign up to research for @aws/durable-execution-sdk-js	2.2.0lockfile	3.0.026 Oct 2026	Latest release is only 3 days old, inside the 14-day window	2.6.02 Oct 2026	minor	0
Upgrade path minor Installed2.2.0 from the lockfile Safe target2.6.02 Oct 2026public for 14+ days Latest3.0.026 Oct 2026only 3d old, inside the 14-day window A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 2.2.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `2.2.0 → 2.6.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Behind	npmdependencies · catalog:Sign up to research for @better-auth/api-key	1.7.5lockfile	1.7.1426 Oct 2026	Latest release is only 2 days old, inside the 14-day window	1.7.1015 Oct 2026	patch	0
Upgrade path patch Installed1.7.5 from the lockfile Safe target1.7.1015 Oct 2026public for 14+ days Latest1.7.1426 Oct 2026only 2d old, inside the 14-day window A patch behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 1.7.5. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `1.7.5 → 1.7.10` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared catalog: Deprecated No
Behind	npmdevDependencies · catalog:Sign up to research for @cloudflare/containers	-	0.3.74 Jun 2026	Latest release is 146 days old, past the 14-day window	0.3.74 Jun 2026	unknown	0
Upgrade path unknown Installed- Safe target · latest0.3.74 Jun 2026public for 14+ days Could not tell how far behind this is. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for the installed version. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `? → 0.3.7` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Behind	npmdependencies · catalog:Sign up to research for @cloudflare/puppeteer	1.3.0lockfile	1.4.020 Aug 2026	Latest release is 70 days old, past the 14-day window	1.4.020 Aug 2026	minor	0
Upgrade path minor Installed1.3.0 from the lockfile Safe target · latest1.4.020 Aug 2026public for 14+ days A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 1.3.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `1.3.0 → 1.4.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared catalog: Deprecated No
Behind	npmdevDependencies · catalog:Sign up to research for @cloudflare/unenv-preset	2.16.1lockfile	2.16.221 Sep 2026	Latest release is 37 days old, past the 14-day window	2.16.221 Sep 2026	patch	0
Upgrade path patch Installed2.16.1 from the lockfile Safe target · latest2.16.221 Sep 2026public for 14+ days A patch behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 2.16.1. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `2.16.1 → 2.16.2` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Behind	npmdevDependencies · catalog:Sign up to research for @cloudflare/vitest-plugin	1.3.4lockfile	1.4.1028 Oct 2026	Latest release is only 0 days old, inside the 14-day window	1.4.315 Oct 2026	minor	0
Upgrade path minor Installed1.3.4 from the lockfile Safe target1.4.315 Oct 2026public for 14+ days Latest1.4.1028 Oct 2026only 0d old, inside the 14-day window A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 1.3.4. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `1.3.4 → 1.4.3` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Behind	npmdevDependencies · catalog:Sign up to research for @cloudflare/workers-types	5.20260918.1lockfile	5.20261029.129 Oct 2026	Latest release is only 0 days old, inside the 14-day window	5.20261015.115 Oct 2026	minor	0
Upgrade path minor Installed5.20260918.1 from the lockfile Safe target5.20261015.115 Oct 2026public for 14+ days Latest5.20261029.129 Oct 2026only 0d old, inside the 14-day window A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 5.20260918.1. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `5.20260918.1 → 5.20261015.1` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Behind	npmdependencies · catalog:Sign up to research for @effect/atom-react	4.0.0lockfile	4.1.029 Oct 2026	Latest release is only 0 days old, inside the 14-day window	4.0.515 Oct 2026	patch	0
Upgrade path patch Installed4.0.0 from the lockfile Safe target4.0.515 Oct 2026public for 14+ days Latest4.1.029 Oct 2026only 0d old, inside the 14-day window A patch behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 4.0.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `4.0.0 → 4.0.5` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared catalog: Deprecated No
Behind	npmdevDependencies · catalog:Sign up to research for @effect/language-service	0.87.2lockfile	0.87.516 Oct 2026	Latest release is only 12 days old, inside the 14-day window	0.87.46 Oct 2026	patch	0
Upgrade path patch Installed0.87.2 from the lockfile Safe target0.87.46 Oct 2026public for 14+ days Latest0.87.516 Oct 2026only 12d old, inside the 14-day window A patch behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 0.87.2. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `0.87.2 → 0.87.4` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Behind	npmdependencies · catalog:Sign up to research for @effect/platform-bun	4.0.0lockfile	4.1.029 Oct 2026	Latest release is only 0 days old, inside the 14-day window	4.0.515 Oct 2026	patch	0
Upgrade path patch Installed4.0.0 from the lockfile Safe target4.0.515 Oct 2026public for 14+ days Latest4.1.029 Oct 2026only 0d old, inside the 14-day window A patch behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 4.0.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `4.0.0 → 4.0.5` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared catalog: Deprecated No
Behind	npmdependencies · catalog:Sign up to research for @effect/platform-node	4.0.0lockfile	4.1.029 Oct 2026	Latest release is only 0 days old, inside the 14-day window	4.0.515 Oct 2026	patch	0
Upgrade path patch Installed4.0.0 from the lockfile Safe target4.0.515 Oct 2026public for 14+ days Latest4.1.029 Oct 2026only 0d old, inside the 14-day window A patch behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 4.0.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `4.0.0 → 4.0.5` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared catalog: Deprecated No
Behind	npmdependencies · catalog:Sign up to research for @effect/sql-d1	4.0.0lockfile	4.1.029 Oct 2026	Latest release is only 0 days old, inside the 14-day window	4.0.515 Oct 2026	patch	0
Upgrade path patch Installed4.0.0 from the lockfile Safe target4.0.515 Oct 2026public for 14+ days Latest4.1.029 Oct 2026only 0d old, inside the 14-day window A patch behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 4.0.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `4.0.0 → 4.0.5` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared catalog: Deprecated No
Behind	npmdependencies · catalog:Sign up to research for @effect/sql-mysql2	4.0.0lockfile	4.1.029 Oct 2026	Latest release is only 0 days old, inside the 14-day window	4.0.515 Oct 2026	patch	0
Upgrade path patch Installed4.0.0 from the lockfile Safe target4.0.515 Oct 2026public for 14+ days Latest4.1.029 Oct 2026only 0d old, inside the 14-day window A patch behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 4.0.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `4.0.0 → 4.0.5` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared catalog: Deprecated No
Behind	npmdependencies · catalog:Sign up to research for @effect/sql-pg	4.0.0lockfile	4.1.029 Oct 2026	Latest release is only 0 days old, inside the 14-day window	4.0.515 Oct 2026	patch	0
Upgrade path patch Installed4.0.0 from the lockfile Safe target4.0.515 Oct 2026public for 14+ days Latest4.1.029 Oct 2026only 0d old, inside the 14-day window A patch behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 4.0.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `4.0.0 → 4.0.5` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared catalog: Deprecated No
Behind	npmdependencies · catalog:Sign up to research for @effect/sql-sqlite-do	4.0.0lockfile	4.1.029 Oct 2026	Latest release is only 0 days old, inside the 14-day window	4.0.515 Oct 2026	patch	0
Upgrade path patch Installed4.0.0 from the lockfile Safe target4.0.515 Oct 2026public for 14+ days Latest4.1.029 Oct 2026only 0d old, inside the 14-day window A patch behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 4.0.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `4.0.0 → 4.0.5` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared catalog: Deprecated No
Behind	npmdevDependencies · catalog:Sign up to research for @effect/tsgo	0.36.4lockfile	0.63.028 Oct 2026	Latest release is only 1 days old, inside the 14-day window	0.53.115 Oct 2026	minor	0
Upgrade path minor Installed0.36.4 from the lockfile Safe target0.53.115 Oct 2026public for 14+ days Latest0.63.028 Oct 2026only 1d old, inside the 14-day window A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 0.36.4. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `0.36.4 → 0.53.1` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Behind	npmdevDependencies · catalog:Sign up to research for @effect/vitest	4.0.0lockfile	4.1.029 Oct 2026	Latest release is only 0 days old, inside the 14-day window	4.0.515 Oct 2026	patch	0
Upgrade path patch Installed4.0.0 from the lockfile Safe target4.0.515 Oct 2026public for 14+ days Latest4.1.029 Oct 2026only 0d old, inside the 14-day window A patch behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 4.0.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `4.0.0 → 4.0.5` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Behind	npmdevDependencies · catalog:Sign up to research for @foldkit/vite-plugin	0.26.0lockfile	0.28.021 Oct 2026	Latest release is only 8 days old, inside the 14-day window	0.27.111 Oct 2026	minor	0
Upgrade path minor Installed0.26.0 from the lockfile Safe target0.27.111 Oct 2026public for 14+ days Latest0.28.021 Oct 2026only 8d old, inside the 14-day window A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 0.26.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `0.26.0 → 0.27.1` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Behind	npmdependencies · catalog:Sign up to research for @fontsource-variable/source-serif-4	5.3.0lockfile	5.3.111 Oct 2026	Latest release is 18 days old, past the 14-day window	5.3.111 Oct 2026	patch	0
Upgrade path patch Installed5.3.0 from the lockfile Safe target · latest5.3.111 Oct 2026public for 14+ days A patch behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 5.3.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `5.3.0 → 5.3.1` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared catalog: Deprecated No
Behind	npmdependencies · catalog:Sign up to research for @iconify-json/lucide	1.2.129lockfile	1.2.14929 Oct 2026	Latest release is only 0 days old, inside the 14-day window	1.2.14414 Oct 2026	patch	0
Upgrade path patch Installed1.2.129 from the lockfile Safe target1.2.14414 Oct 2026public for 14+ days Latest1.2.14929 Oct 2026only 0d old, inside the 14-day window A patch behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 1.2.129. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `1.2.129 → 1.2.144` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared catalog: Deprecated No
Behind	npmdevDependencies · catalog:Sign up to research for @iconify-json/simple-icons	1.2.94lockfile	1.2.10126 Oct 2026	Latest release is only 3 days old, inside the 14-day window	1.2.10012 Oct 2026	patch	0
Upgrade path patch Installed1.2.94 from the lockfile Safe target1.2.10012 Oct 2026public for 14+ days Latest1.2.10126 Oct 2026only 3d old, inside the 14-day window A patch behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 1.2.94. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `1.2.94 → 1.2.100` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Behind	npmdependencies · catalog:Sign up to research for @libsql/client	0.17.4lockfile	0.18.02 Sep 2026	Latest release is 57 days old, past the 14-day window	0.18.02 Sep 2026	minor	0
Upgrade path minor Installed0.17.4 from the lockfile Safe target · latest0.18.02 Sep 2026public for 14+ days A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 0.17.4. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `0.17.4 → 0.18.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared catalog: Deprecated No
Behind	npmdependencies · 0.7.0-betaSign up to research for @neondatabase/neon-js	0.7.0-betalockfile	0.9.0-beta21 Oct 2026	Latest release is only 7 days old, inside the 14-day window	-	unknown	0
Upgrade path unknown Installed0.7.0-beta from the lockfile Safe target- no release has cleared the window yet Latest0.9.0-beta21 Oct 2026only 7d old, inside the 14-day window Could not tell how far behind this is. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 0.7.0-beta. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `0.7.0-beta → target` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared 0.7.0-beta Deprecated No
Behind	npmdependencies · 1.1.0Sign up to research for @neondatabase/serverless	1.1.0lockfile	1.2.01 Oct 2026	Latest release is 27 days old, past the 14-day window	1.2.01 Oct 2026	minor	0
Upgrade path minor Installed1.1.0 from the lockfile Safe target · latest1.2.01 Oct 2026public for 14+ days A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 1.1.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `1.1.0 → 1.2.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared 1.1.0 Deprecated No
Behind	npmdependencies · catalog:Sign up to research for @octanejs/adapter-cloudflare	0.0.12lockfile	0.0.6325 Oct 2026	Latest release is only 3 days old, inside the 14-day window	0.0.6013 Oct 2026	patch	0
Upgrade path patch Installed0.0.12 from the lockfile Safe target0.0.6013 Oct 2026public for 14+ days Latest0.0.6325 Oct 2026only 3d old, inside the 14-day window A patch behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 0.0.12. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `0.0.12 → 0.0.60` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared catalog: Deprecated No
Behind	npmdependencies · catalog:Sign up to research for @octanejs/vite-plugin	0.1.22lockfile	0.5.025 Oct 2026	Latest release is only 3 days old, inside the 14-day window	0.4.113 Oct 2026	minor	0
Upgrade path minor Installed0.1.22 from the lockfile Safe target0.4.113 Oct 2026public for 14+ days Latest0.5.025 Oct 2026only 3d old, inside the 14-day window A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 0.1.22. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `0.1.22 → 0.4.1` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared catalog: Deprecated No
Behind	npmdevDependencies · catalog:Sign up to research for @opennextjs/aws	4.1.0lockfile	4.1.1328 Oct 2026	Latest release is only 0 days old, inside the 14-day window	4.1.1115 Oct 2026	patch	0
Upgrade path patch Installed4.1.0 from the lockfile Safe target4.1.1115 Oct 2026public for 14+ days Latest4.1.1328 Oct 2026only 0d old, inside the 14-day window A patch behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 4.1.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `4.1.0 → 4.1.11` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Behind	npmdependencies · catalog:Sign up to research for @opentui/core	0.5.14lockfile	0.7.025 Oct 2026	Latest release is only 3 days old, inside the 14-day window	0.6.614 Oct 2026	minor	0
Upgrade path minor Installed0.5.14 from the lockfile Safe target0.6.614 Oct 2026public for 14+ days Latest0.7.025 Oct 2026only 3d old, inside the 14-day window A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 0.5.14. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `0.5.14 → 0.6.6` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared catalog: Deprecated No
Behind	npmdevDependencies · catalog:Sign up to research for @oxc-project/types	0.146.0lockfile	0.156.027 Oct 2026	Latest release is only 2 days old, inside the 14-day window	0.154.013 Oct 2026	minor	0
Upgrade path minor Installed0.146.0 from the lockfile Safe target0.154.013 Oct 2026public for 14+ days Latest0.156.027 Oct 2026only 2d old, inside the 14-day window A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 0.146.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `0.146.0 → 0.154.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Behind	npmdependencies · ^1.3.5Sign up to research for @pierre/diffs	1.4.2lockfile	1.6.226 Oct 2026	Latest release is only 2 days old, inside the 14-day window	1.5.25 Oct 2026	minor	0
Upgrade path minor Installed1.4.2 from the lockfile Safe target1.5.25 Oct 2026public for 14+ days Latest1.6.226 Oct 2026only 2d old, inside the 14-day window A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 1.4.2. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `1.4.2 → 1.5.2` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared ^1.3.5 Deprecated No
Behind	npmdevDependencies · catalog:Sign up to research for @playwright/test	1.62.0lockfile	1.64.114 Oct 2026	Latest release is 15 days old, past the 14-day window	1.64.114 Oct 2026	minor	0
Upgrade path minor Installed1.62.0 from the lockfile Safe target · latest1.64.114 Oct 2026public for 14+ days A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 1.62.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `1.62.0 → 1.64.1` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Behind	npmdependencies · catalog:Sign up to research for @prisma/dev	0.20.0lockfile	0.25.225 Aug 2026	Latest release is 65 days old, past the 14-day window	0.25.225 Aug 2026	minor	0
Upgrade path minor Installed0.20.0 from the lockfile Safe target · latest0.25.225 Aug 2026public for 14+ days A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 0.20.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `0.20.0 → 0.25.2` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared catalog: Deprecated No
Behind	npmdependencies · catalog:Sign up to research for @puppeteer/browsers	3.2.1lockfile	3.2.622 Oct 2026	Latest release is only 7 days old, inside the 14-day window	3.2.514 Oct 2026	patch	0
Upgrade path patch Installed3.2.1 from the lockfile Safe target3.2.514 Oct 2026public for 14+ days Latest3.2.622 Oct 2026only 7d old, inside the 14-day window A patch behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 3.2.1. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `3.2.1 → 3.2.5` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared catalog: Deprecated No
Behind	npmdependencies · catalog:Sign up to research for @solidjs/start	2.0.4lockfile	2.1.022 Oct 2026	Latest release is only 7 days old, inside the 14-day window	2.0.67 Oct 2026	patch	0
Upgrade path patch Installed2.0.4 from the lockfile Safe target2.0.67 Oct 2026public for 14+ days Latest2.1.022 Oct 2026only 7d old, inside the 14-day window A patch behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 2.0.4. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `2.0.4 → 2.0.6` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared catalog: Deprecated No
Behind	npmdevDependencies · catalog:Sign up to research for @sveltejs/vite-plugin-svelte	7.2.0lockfile	7.3.123 Sep 2026	Latest release is 36 days old, past the 14-day window	7.3.123 Sep 2026	minor	0
Upgrade path minor Installed7.2.0 from the lockfile Safe target · latest7.3.123 Sep 2026public for 14+ days A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 7.2.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `7.2.0 → 7.3.1` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Behind	npmdependencies · catalog:Sign up to research for @tanstack/react-router	1.170.32lockfile	1.170.4622 Oct 2026	Latest release is only 6 days old, inside the 14-day window	1.170.4412 Oct 2026	patch	0
Upgrade path patch Installed1.170.32 from the lockfile Safe target1.170.4412 Oct 2026public for 14+ days Latest1.170.4622 Oct 2026only 6d old, inside the 14-day window A patch behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 1.170.32. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `1.170.32 → 1.170.44` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared catalog: Deprecated No
Behind	npmdependencies · catalog:Sign up to research for @tanstack/solid-router	1.170.25lockfile	1.170.4322 Oct 2026	Latest release is only 6 days old, inside the 14-day window	1.170.4113 Oct 2026	patch	0
Upgrade path patch Installed1.170.25 from the lockfile Safe target1.170.4113 Oct 2026public for 14+ days Latest1.170.4322 Oct 2026only 6d old, inside the 14-day window A patch behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 1.170.25. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `1.170.25 → 1.170.41` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared catalog: Deprecated No
Behind	npmdevDependencies · catalog:Sign up to research for @tsconfig/node24	24.0.4lockfile	24.0.515 Aug 2026	Latest release is 75 days old, past the 14-day window	24.0.515 Aug 2026	patch	0
Upgrade path patch Installed24.0.4 from the lockfile Safe target · latest24.0.515 Aug 2026public for 14+ days A patch behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 24.0.4. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `24.0.4 → 24.0.5` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Behind	npmdependencies · catalog:Sign up to research for @types/aws-lambda	8.10.162lockfile	8.10.16429 Sep 2026	Latest release is 30 days old, past the 14-day window	8.10.16429 Sep 2026	patch	0
Upgrade path patch Installed8.10.162 from the lockfile Safe target · latest8.10.16429 Sep 2026public for 14+ days A patch behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 8.10.162. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `8.10.162 → 8.10.164` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared catalog: Deprecated No
Behind	npmdevDependencies · catalog:Sign up to research for @types/bun	1.3.14lockfile	1.4.423 Oct 2026	Latest release is only 6 days old, inside the 14-day window	1.4.312 Oct 2026	minor	0
Upgrade path minor Installed1.3.14 from the lockfile Safe target1.4.312 Oct 2026public for 14+ days Latest1.4.423 Oct 2026only 6d old, inside the 14-day window A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 1.3.14. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `1.3.14 → 1.4.3` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Behind	npmdependencies · catalog:Sign up to research for @types/pg	8.20.4lockfile	8.23.117 Aug 2026	Latest release is 72 days old, past the 14-day window	8.23.117 Aug 2026	minor	0
Upgrade path minor Installed8.20.4 from the lockfile Safe target · latest8.23.117 Aug 2026public for 14+ days A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 8.20.4. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `8.20.4 → 8.23.1` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared catalog: Deprecated No
Behind	npmdevDependencies · catalog:Sign up to research for @types/react	-	19.3.09 Sep 2026	Latest release is 49 days old, past the 14-day window	19.3.09 Sep 2026	unknown	0
Upgrade path unknown Installed- Safe target · latest19.3.09 Sep 2026public for 14+ days Could not tell how far behind this is. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for the installed version. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `? → 19.3.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Behind	npmdevDependencies · ^19.2.3Sign up to research for @types/react-dom	19.2.3declared	19.3.09 Sep 2026	Latest release is 49 days old, past the 14-day window	19.3.09 Sep 2026	minor	0
Upgrade path minor Installed19.2.3 declared, no lockfile Safe target · latest19.3.09 Sep 2026public for 14+ days A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 19.2.3. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `19.2.3 → 19.3.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared ^19.2.3 Deprecated No
Behind	npmdevDependencies · catalog:Sign up to research for @types/ws	8.18.1lockfile	8.18.229 Sep 2026	Latest release is 30 days old, past the 14-day window	8.18.229 Sep 2026	patch	0
Upgrade path patch Installed8.18.1 from the lockfile Safe target · latest8.18.229 Sep 2026public for 14+ days A patch behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 8.18.1. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `8.18.1 → 8.18.2` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Behind	npmdevDependencies · catalog:Sign up to research for @vercel/nft	1.10.2lockfile	1.11.018 Aug 2026	Latest release is 71 days old, past the 14-day window	1.11.018 Aug 2026	minor	0
Upgrade path minor Installed1.10.2 from the lockfile Safe target · latest1.11.018 Aug 2026public for 14+ days A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 1.10.2. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `1.10.2 → 1.11.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Behind	npmdevDependencies · ^0.5.34Sign up to research for @vitejs/plugin-rsc	0.5.34lockfile	0.5.3815 Oct 2026	Latest release is 14 days old, past the 14-day window	0.5.3815 Oct 2026	patch	0
Upgrade path patch Installed0.5.34 from the lockfile Safe target · latest0.5.3815 Oct 2026public for 14+ days A patch behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 0.5.34. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `0.5.34 → 0.5.38` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared ^0.5.34 Deprecated No
Behind	npmdevDependencies · catalog:Sign up to research for @vitejs/plugin-vue	6.0.8lockfile	6.0.1010 Oct 2026	Latest release is 19 days old, past the 14-day window	6.0.1010 Oct 2026	patch	0
Upgrade path patch Installed6.0.8 from the lockfile Safe target · latest6.0.1010 Oct 2026public for 14+ days A patch behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 6.0.8. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `6.0.8 → 6.0.10` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Behind	npmdependencies · 7.0.105Sign up to research for ai	7.0.105lockfile	7.0.15628 Oct 2026	Latest release is only 0 days old, inside the 14-day window	7.0.14115 Oct 2026	patch	0
Upgrade path patch Installed7.0.105 from the lockfile Safe target7.0.14115 Oct 2026public for 14+ days Latest7.0.15628 Oct 2026only 0d old, inside the 14-day window A patch behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 7.0.105. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `7.0.105 → 7.0.141` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared 7.0.105 Deprecated No
Behind	npmdependencies · catalog:Sign up to research for arktype	2.2.3lockfile	2.2.920 Oct 2026	Latest release is only 8 days old, inside the 14-day window	2.2.87 Oct 2026	patch	0
Upgrade path patch Installed2.2.3 from the lockfile Safe target2.2.87 Oct 2026public for 14+ days Latest2.2.920 Oct 2026only 8d old, inside the 14-day window A patch behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 2.2.3. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `2.2.3 → 2.2.8` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared catalog: Deprecated No
Behind	npmdevDependencies · npm:better-auth@1.6.25Sign up to research for better-auth-1.6	better-auth@1.6.25lockfile	-	Release age unknown	-	unknown	0
Upgrade path unknown Installedbetter-auth@1.6.25 from the lockfile Safe target- no release has cleared the window yet Could not tell how far behind this is. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for better-auth@1.6.25. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `better-auth@1.6.25 → target` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared npm:better-auth@1.6.25 Deprecated No Registry lookup registry 404
Behind	npmdependencies · catalog:Sign up to research for cuelume	0.2.2lockfile	0.2.813 Oct 2026	Latest release is 15 days old, past the 14-day window	0.2.813 Oct 2026	patch	0
Upgrade path patch Installed0.2.2 from the lockfile Safe target · latest0.2.813 Oct 2026public for 14+ days A patch behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 0.2.2. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `0.2.2 → 0.2.8` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared catalog: Deprecated No
Behind	npmdependencies · catalog:Sign up to research for effect	4.0.0lockfile	4.1.029 Oct 2026	Latest release is only 0 days old, inside the 14-day window	4.0.515 Oct 2026	patch	0
Upgrade path patch Installed4.0.0 from the lockfile Safe target4.0.515 Oct 2026public for 14+ days Latest4.1.029 Oct 2026only 0d old, inside the 14-day window A patch behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 4.0.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `4.0.0 → 4.0.5` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared catalog: Deprecated No
Behind	npmdevDependencies · catalog:Sign up to research for fast-xml-parser	5.10.1lockfile	5.11.229 Sep 2026	Latest release is 30 days old, past the 14-day window	5.11.229 Sep 2026	minor	0
Upgrade path minor Installed5.10.1 from the lockfile Safe target · latest5.11.229 Sep 2026public for 14+ days A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 5.10.1. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `5.10.1 → 5.11.2` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Behind	npmdependencies · catalog:Sign up to research for foldkit	0.165.0lockfile	0.169.021 Oct 2026	Latest release is only 8 days old, inside the 14-day window	0.168.011 Oct 2026	minor	0
Upgrade path minor Installed0.165.0 from the lockfile Safe target0.168.011 Oct 2026public for 14+ days Latest0.169.021 Oct 2026only 8d old, inside the 14-day window A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 0.165.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `0.165.0 → 0.168.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared catalog: Deprecated No
Behind	npmdevDependencies · catalog:Sign up to research for http-cache-semantics	4.2.0lockfile	4.3.04 Oct 2026	Latest release is 25 days old, past the 14-day window	4.3.04 Oct 2026	minor	0
Upgrade path minor Installed4.2.0 from the lockfile Safe target · latest4.3.04 Oct 2026public for 14+ days A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 4.2.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `4.2.0 → 4.3.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Behind	npmdevDependencies · catalog:Sign up to research for iovalkey	0.3.3lockfile	0.4.027 Jul 2026	Latest release is 93 days old, past the 14-day window	0.4.027 Jul 2026	minor	0
Upgrade path minor Installed0.3.3 from the lockfile Safe target · latest0.4.027 Jul 2026public for 14+ days A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 0.3.3. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `0.3.3 → 0.4.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Behind	npmdependencies · catalog:Sign up to research for isbot	5.2.1lockfile	5.2.227 Aug 2026	Latest release is 62 days old, past the 14-day window	5.2.227 Aug 2026	patch	0
Upgrade path patch Installed5.2.1 from the lockfile Safe target · latest5.2.227 Aug 2026public for 14+ days A patch behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 5.2.1. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `5.2.1 → 5.2.2` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared catalog: Deprecated No
Behind	npmdependencies · 6.2.8Sign up to research for jose	6.2.8lockfile	6.2.1320 Oct 2026	Latest release is only 9 days old, inside the 14-day window	6.2.125 Sep 2026	patch	0
Upgrade path patch Installed6.2.8 from the lockfile Safe target6.2.125 Sep 2026public for 14+ days Latest6.2.1320 Oct 2026only 9d old, inside the 14-day window A patch behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 6.2.8. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `6.2.8 → 6.2.12` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared 6.2.8 Deprecated No
Behind	npmdependencies · catalog:Sign up to research for kysely	0.29.5lockfile	0.29.717 Oct 2026	Latest release is only 11 days old, inside the 14-day window	0.29.616 Sep 2026	patch	0
Upgrade path patch Installed0.29.5 from the lockfile Safe target0.29.616 Sep 2026public for 14+ days Latest0.29.717 Oct 2026only 11d old, inside the 14-day window A patch behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 0.29.5. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `0.29.5 → 0.29.6` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared catalog: Deprecated No
Behind	npmdependencies · catalog:Sign up to research for mime	4.1.0lockfile	4.1.227 Oct 2026	Latest release is only 2 days old, inside the 14-day window	4.1.112 Oct 2026	patch	0
Upgrade path patch Installed4.1.0 from the lockfile Safe target4.1.112 Oct 2026public for 14+ days Latest4.1.227 Oct 2026only 2d old, inside the 14-day window A patch behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 4.1.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `4.1.0 → 4.1.1` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared catalog: Deprecated No
Behind	npmdependencies · catalog:Sign up to research for miniflare	4.20260722.0lockfile	4.20260730.030 Jul 2026	Latest release is 90 days old, past the 14-day window	4.20260730.030 Jul 2026	minor	0
Upgrade path minor Installed4.20260722.0 from the lockfile Safe target · latest4.20260730.030 Jul 2026public for 14+ days A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 4.20260722.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `4.20260722.0 → 4.20260730.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared catalog: Deprecated No
Behind	npmdependencies · ^0.8.4Sign up to research for modern-tar	0.8.4lockfile	0.8.614 Oct 2026	Latest release is 14 days old, past the 14-day window	0.8.614 Oct 2026	patch	0
Upgrade path patch Installed0.8.4 from the lockfile Safe target · latest0.8.614 Oct 2026public for 14+ days A patch behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 0.8.4. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `0.8.4 → 0.8.6` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared ^0.8.4 Deprecated No
Behind	npmdependencies · catalog:Sign up to research for mysql2	3.24.2lockfile	3.24.613 Oct 2026	Latest release is 15 days old, past the 14-day window	3.24.613 Oct 2026	patch	0
Upgrade path patch Installed3.24.2 from the lockfile Safe target · latest3.24.613 Oct 2026public for 14+ days A patch behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 3.24.2. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `3.24.2 → 3.24.6` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared catalog: Deprecated No
Behind	npmdependencies · catalog:Sign up to research for octane	0.1.22lockfile	0.16.328 Oct 2026	Latest release is only 1 days old, inside the 14-day window	0.13.815 Oct 2026	minor	0
Upgrade path minor Installed0.1.22 from the lockfile Safe target0.13.815 Oct 2026public for 14+ days Latest0.16.328 Oct 2026only 1d old, inside the 14-day window A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 0.1.22. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `0.1.22 → 0.13.8` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared catalog: Deprecated No
Behind	npmdevDependencies · catalog:Sign up to research for oxfmt	0.66.0lockfile	0.75.027 Oct 2026	Latest release is only 2 days old, inside the 14-day window	0.73.013 Oct 2026	minor	0
Upgrade path minor Installed0.66.0 from the lockfile Safe target0.73.013 Oct 2026public for 14+ days Latest0.75.027 Oct 2026only 2d old, inside the 14-day window A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 0.66.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `0.66.0 → 0.73.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Behind	npmdevDependencies · catalog:Sign up to research for oxlint	1.82.0lockfile	1.90.027 Oct 2026	Latest release is only 2 days old, inside the 14-day window	1.88.013 Oct 2026	minor	0
Upgrade path minor Installed1.82.0 from the lockfile Safe target1.88.013 Oct 2026public for 14+ days Latest1.90.027 Oct 2026only 2d old, inside the 14-day window A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 1.82.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `1.82.0 → 1.88.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Behind	npmdependencies · catalog:Sign up to research for pg	8.23.0lockfile	8.23.130 Sep 2026	Latest release is 28 days old, past the 14-day window	8.23.130 Sep 2026	patch	0
Upgrade path patch Installed8.23.0 from the lockfile Safe target · latest8.23.130 Sep 2026public for 14+ days A patch behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 8.23.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `8.23.0 → 8.23.1` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared catalog: Deprecated No
Behind	npmdependencies · catalog:Sign up to research for picomatch	4.0.5lockfile	4.0.724 Aug 2026	Latest release is 65 days old, past the 14-day window	4.0.724 Aug 2026	patch	0
Upgrade path patch Installed4.0.5 from the lockfile Safe target · latest4.0.724 Aug 2026public for 14+ days A patch behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 4.0.5. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `4.0.5 → 4.0.7` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared catalog: Deprecated No
Behind	npmdevDependencies · catalog:Sign up to research for postcss	8.5.26lockfile	8.5.3226 Oct 2026	Latest release is only 2 days old, inside the 14-day window	8.5.3012 Oct 2026	patch	0
Upgrade path patch Installed8.5.26 from the lockfile Safe target8.5.3012 Oct 2026public for 14+ days Latest8.5.3226 Oct 2026only 2d old, inside the 14-day window A patch behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 8.5.26. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `8.5.26 → 8.5.30` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Behind	npmdependencies · catalog:Sign up to research for react	19.3.0lockfile	19.3.114 Oct 2026	Latest release is 14 days old, past the 14-day window	19.3.114 Oct 2026	patch	0
Upgrade path patch Installed19.3.0 from the lockfile Safe target · latest19.3.114 Oct 2026public for 14+ days A patch behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 19.3.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `19.3.0 → 19.3.1` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared catalog: Deprecated No
Behind	npmdependencies · catalog:Sign up to research for react-dom	19.3.0lockfile	19.3.114 Oct 2026	Latest release is 14 days old, past the 14-day window	19.3.114 Oct 2026	patch	0
Upgrade path patch Installed19.3.0 from the lockfile Safe target · latest19.3.114 Oct 2026public for 14+ days A patch behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 19.3.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `19.3.0 → 19.3.1` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared catalog: Deprecated No
Behind	npmdependencies · catalog:Sign up to research for react-server-dom-webpack	19.3.0lockfile	19.3.114 Oct 2026	Latest release is 14 days old, past the 14-day window	19.3.114 Oct 2026	patch	0
Upgrade path patch Installed19.3.0 from the lockfile Safe target · latest19.3.114 Oct 2026public for 14+ days A patch behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 19.3.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `19.3.0 → 19.3.1` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared catalog: Deprecated No
Behind	npmdependencies · catalog:Sign up to research for rolldown	1.2.5lockfile	1.2.1521 Oct 2026	Latest release is only 8 days old, inside the 14-day window	1.2.1414 Oct 2026	patch	0
Upgrade path patch Installed1.2.5 from the lockfile Safe target1.2.1414 Oct 2026public for 14+ days Latest1.2.1521 Oct 2026only 8d old, inside the 14-day window A patch behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 1.2.5. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `1.2.5 → 1.2.14` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared catalog: Deprecated No
Behind	npmdependencies · catalog:Sign up to research for solid-js	1.9.15lockfile	1.9.177 Oct 2026	Latest release is 21 days old, past the 14-day window	1.9.177 Oct 2026	patch	0
Upgrade path patch Installed1.9.15 from the lockfile Safe target · latest1.9.177 Oct 2026public for 14+ days A patch behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 1.9.15. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `1.9.15 → 1.9.17` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared catalog: Deprecated No
Behind	npmdependencies · catalog:Sign up to research for starlight-blog	0.29.0lockfile	0.30.214 Oct 2026	Latest release is 14 days old, past the 14-day window	0.30.214 Oct 2026	minor	0
Upgrade path minor Installed0.29.0 from the lockfile Safe target · latest0.30.214 Oct 2026public for 14+ days A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 0.29.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `0.29.0 → 0.30.2` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared catalog: Deprecated No
Behind	npmdevDependencies · catalog:Sign up to research for svelte	5.56.8lockfile	5.57.326 Oct 2026	Latest release is only 2 days old, inside the 14-day window	5.57.26 Oct 2026	minor	0
Upgrade path minor Installed5.56.8 from the lockfile Safe target5.57.26 Oct 2026public for 14+ days Latest5.57.326 Oct 2026only 2d old, inside the 14-day window A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 5.56.8. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `5.56.8 → 5.57.2` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Behind	npmdependencies · catalog:Sign up to research for takumi-js	2.13.5lockfile	2.18.226 Oct 2026	Latest release is only 2 days old, inside the 14-day window	2.16.214 Oct 2026	minor	0
Upgrade path minor Installed2.13.5 from the lockfile Safe target2.16.214 Oct 2026public for 14+ days Latest2.18.226 Oct 2026only 2d old, inside the 14-day window A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 2.13.5. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `2.13.5 → 2.16.2` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared catalog: Deprecated No
Behind	npmdevDependencies · catalog:Sign up to research for toucan-js	4.0.0lockfile	4.1.128 Feb 2025	Latest release is 607 days old, past the 14-day window	4.1.128 Feb 2025	minor	0
Upgrade path minor Installed4.0.0 from the lockfile Safe target · latest4.1.128 Feb 2025public for 14+ days A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 4.0.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `4.0.0 → 4.1.1` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Behind	npmdevDependencies · catalog:Sign up to research for tsdown	0.22.14lockfile	0.23.328 Oct 2026	Latest release is only 1 days old, inside the 14-day window	0.23.110 Oct 2026	minor	0
Upgrade path minor Installed0.22.14 from the lockfile Safe target0.23.110 Oct 2026public for 14+ days Latest0.23.328 Oct 2026only 1d old, inside the 14-day window A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 0.22.14. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `0.22.14 → 0.23.1` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Behind	npmdevDependencies · catalog:Sign up to research for tsx	4.23.12lockfile	4.23.1520 Sep 2026	Latest release is 39 days old, past the 14-day window	4.23.1520 Sep 2026	patch	0
Upgrade path patch Installed4.23.12 from the lockfile Safe target · latest4.23.1520 Sep 2026public for 14+ days A patch behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 4.23.12. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `4.23.12 → 4.23.15` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Behind	npmdevDependencies · catalog:Sign up to research for turbo	2.10.9lockfile	2.11.1020 Oct 2026	Latest release is only 8 days old, inside the 14-day window	2.11.813 Oct 2026	minor	0
Upgrade path minor Installed2.10.9 from the lockfile Safe target2.11.813 Oct 2026public for 14+ days Latest2.11.1020 Oct 2026only 8d old, inside the 14-day window A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 2.10.9. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `2.10.9 → 2.11.8` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Behind	npmdevDependencies · catalog:Sign up to research for typescript-api	typescript@7.1.0-dev.20260905.1lockfile	1.0.03 Apr 2014	Latest release is 4592 days old, past the 14-day window	1.0.03 Apr 2014	unknown	0
Upgrade path unknown Installedtypescript@7.1.0-dev.20260905.1 from the lockfile Safe target · latest1.0.03 Apr 2014public for 14+ days Could not tell how far behind this is. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for typescript@7.1.0-dev.20260905.1. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `typescript@7.1.0-dev.20260905.1 → 1.0.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Behind	npmdevDependencies · catalog:Sign up to research for uuid	14.0.1lockfile	14.0.310 Oct 2026	Latest release is 19 days old, past the 14-day window	14.0.310 Oct 2026	patch	0
Upgrade path patch Installed14.0.1 from the lockfile Safe target · latest14.0.310 Oct 2026public for 14+ days A patch behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 14.0.1. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `14.0.1 → 14.0.3` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Behind	npmdependencies · ^1.0.0-beta.10Sign up to research for vinext	1.0.0-beta.10lockfile	1.4.028 Oct 2026	Latest release is only 0 days old, inside the 14-day window	1.2.014 Oct 2026	minor	0
Upgrade path minor Installed1.0.0-beta.10 from the lockfile Safe target1.2.014 Oct 2026public for 14+ days Latest1.4.028 Oct 2026only 0d old, inside the 14-day window A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 1.0.0-beta.10. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `1.0.0-beta.10 → 1.2.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared ^1.0.0-beta.10 Deprecated No
Behind	npmdependencies · catalog:Sign up to research for vocs	2.8.2lockfile	2.12.026 Oct 2026	Latest release is only 2 days old, inside the 14-day window	2.10.314 Oct 2026	minor	0
Upgrade path minor Installed2.8.2 from the lockfile Safe target2.10.314 Oct 2026public for 14+ days Latest2.12.026 Oct 2026only 2d old, inside the 14-day window A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 2.8.2. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `2.8.2 → 2.10.3` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared catalog: Deprecated No
Behind	npmdependencies · catalog:Sign up to research for vue-router	5.2.0lockfile	5.4.07 Oct 2026	Latest release is 21 days old, past the 14-day window	5.4.07 Oct 2026	minor	0
Upgrade path minor Installed5.2.0 from the lockfile Safe target · latest5.4.07 Oct 2026public for 14+ days A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 5.2.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `5.2.0 → 5.4.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared catalog: Deprecated No
Behind	npmdevDependencies · catalog:Sign up to research for vue-tsc	3.3.9lockfile	3.3.1310 Oct 2026	Latest release is 18 days old, past the 14-day window	3.3.1310 Oct 2026	patch	0
Upgrade path patch Installed3.3.9 from the lockfile Safe target · latest3.3.1310 Oct 2026public for 14+ days A patch behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 3.3.9. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `3.3.9 → 3.3.13` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Behind	npmdependencies · catalog:Sign up to research for waku	-	1.0.0-rc.422 Oct 2026	Latest release is only 7 days old, inside the 14-day window	0.27.517 Dec 2025	unknown	0
Upgrade path unknown Installed- Safe target0.27.517 Dec 2025public for 14+ days Latest1.0.0-rc.422 Oct 2026only 7d old, inside the 14-day window Could not tell how far behind this is. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for the installed version. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `? → 0.27.5` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared catalog: Deprecated No
Behind	npmdependencies · catalog:Sign up to research for workerd	1.20260918.1lockfile	1.20261029.129 Oct 2026	Latest release is only 0 days old, inside the 14-day window	1.20261015.115 Oct 2026	minor	0
Upgrade path minor Installed1.20260918.1 from the lockfile Safe target1.20261015.115 Oct 2026public for 14+ days Latest1.20261029.129 Oct 2026only 0d old, inside the 14-day window A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 1.20260918.1. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `1.20260918.1 → 1.20261015.1` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared catalog: Deprecated No
Behind	npmdevDependencies · catalog:Sign up to research for wrangler	4.127.1lockfile	4.155.028 Oct 2026	Latest release is only 0 days old, inside the 14-day window	4.151.014 Oct 2026	minor	0
Upgrade path minor Installed4.127.1 from the lockfile Safe target4.151.014 Oct 2026public for 14+ days Latest4.155.028 Oct 2026only 0d old, inside the 14-day window A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 4.127.1. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `4.127.1 → 4.151.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Behind	npmdevDependencies · catalog:Sign up to research for ws	8.21.3lockfile	8.22.026 Sep 2026	Latest release is 32 days old, past the 14-day window	8.22.026 Sep 2026	minor	0
Upgrade path minor Installed8.21.3 from the lockfile Safe target · latest8.22.026 Sep 2026public for 14+ days A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 8.21.3. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `8.21.3 → 8.22.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Behind	npmdependencies · catalog:Sign up to research for yaml	2.9.0lockfile	2.9.111 Sep 2026	Latest release is 47 days old, past the 14-day window	2.9.111 Sep 2026	patch	0
Upgrade path patch Installed2.9.0 from the lockfile Safe target · latest2.9.111 Sep 2026public for 14+ days A patch behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 2.9.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `2.9.0 → 2.9.1` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared catalog: Deprecated No
Current	npmdependencies · catalog:	0.9.10lockfile	0.9.1221 Oct 2026	Latest release is only 8 days old, inside the 14-day window	0.9.1027 Jul 2026	current	0
Upgrade path current Installed0.9.10 from the lockfile Safe target0.9.1027 Jul 2026public for 14+ days Latest0.9.1221 Oct 2026only 8d old, inside the 14-day window Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 0.9.10. Checked against OSV. Nothing to research: @astrojs/check is at its safe target with no known advisories. Ecosystem npm Section dependencies Declared catalog: Deprecated No
Current	npmdependencies · catalog:	3.7.4lockfile	3.7.431 Aug 2026	Latest release is 58 days old, past the 14-day window	3.7.431 Aug 2026	current	0
Upgrade path current Installed3.7.4 from the lockfile Safe target · latest3.7.431 Aug 2026public for 14+ days Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 3.7.4. Checked against OSV. Nothing to research: @astrojs/sitemap is at its safe target with no known advisories. Ecosystem npm Section dependencies Declared catalog: Deprecated No
Current	npmdependencies · catalog:	5.0.0lockfile	5.0.011 Mar 2026	Latest release is 232 days old, past the 14-day window	5.0.011 Mar 2026	current	0
Upgrade path current Installed5.0.0 from the lockfile Safe target · latest5.0.011 Mar 2026public for 14+ days Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 5.0.0. Checked against OSV. Nothing to research: @astrojs/starlight-tailwind is at its safe target with no known advisories. Ecosystem npm Section dependencies Declared catalog: Deprecated No
Current	npmdependencies · catalog:	5.3.0lockfile	5.3.019 Jul 2026	Latest release is 102 days old, past the 14-day window	5.3.019 Jul 2026	current	0
Upgrade path current Installed5.3.0 from the lockfile Safe target · latest5.3.019 Jul 2026public for 14+ days Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 5.3.0. Checked against OSV. Nothing to research: @fontsource-variable/caveat is at its safe target with no known advisories. Ecosystem npm Section dependencies Declared catalog: Deprecated No
Current	npmdependencies · catalog:	5.3.0lockfile	5.3.019 Jul 2026	Latest release is 102 days old, past the 14-day window	5.3.019 Jul 2026	current	0
Upgrade path current Installed5.3.0 from the lockfile Safe target · latest5.3.019 Jul 2026public for 14+ days Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 5.3.0. Checked against OSV. Nothing to research: @fontsource-variable/inter is at its safe target with no known advisories. Ecosystem npm Section dependencies Declared catalog: Deprecated No
Current	npmdependencies · catalog:	5.3.0lockfile	5.3.019 Jul 2026	Latest release is 102 days old, past the 14-day window	5.3.019 Jul 2026	current	0
Upgrade path current Installed5.3.0 from the lockfile Safe target · latest5.3.019 Jul 2026public for 14+ days Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 5.3.0. Checked against OSV. Nothing to research: @fontsource-variable/jetbrains-mono is at its safe target with no known advisories. Ecosystem npm Section dependencies Declared catalog: Deprecated No
Current	npmdependencies · catalog:	6.0.2lockfile	6.0.319 Oct 2026	Latest release is only 9 days old, inside the 14-day window	6.0.215 Sep 2025	current	0
Upgrade path current Installed6.0.2 from the lockfile Safe target6.0.215 Sep 2025public for 14+ days Latest6.0.319 Oct 2026only 9d old, inside the 14-day window Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 6.0.2. Checked against OSV. Nothing to research: @iconify/react is at its safe target with no known advisories. Ecosystem npm Section dependencies Declared catalog: Deprecated No
Current	npmdependencies · catalog:	0.11.0lockfile	0.11.016 Sep 2026	Latest release is 42 days old, past the 14-day window	0.11.016 Sep 2026	current	0
Upgrade path current Installed0.11.0 from the lockfile Safe target · latest0.11.016 Sep 2026public for 14+ days Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 0.11.0. Checked against OSV. Nothing to research: @neon/functions is at its safe target with no known advisories. Ecosystem npm Section dependencies Declared catalog: Deprecated No
Current	npmdependencies · catalog:	22.0.1lockfile	22.0.131 Oct 2025	Latest release is 362 days old, past the 14-day window	22.0.131 Oct 2025	current	0
Upgrade path current Installed22.0.1 from the lockfile Safe target · latest22.0.131 Oct 2025public for 14+ days Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 22.0.1. Checked against OSV. Nothing to research: @octokit/rest is at its safe target with no known advisories. Ecosystem npm Section dependencies Declared catalog: Deprecated No
Current	npmdependencies · catalog:	14.2.0lockfile	14.2.03 Dec 2025	Latest release is 329 days old, past the 14-day window	14.2.03 Dec 2025	current	0
Upgrade path current Installed14.2.0 from the lockfile Safe target · latest14.2.03 Dec 2025public for 14+ days Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 14.2.0. Checked against OSV. Nothing to research: @octokit/webhooks is at its safe target with no known advisories. Ecosystem npm Section dependencies Declared catalog: Deprecated No
Current	npmdevDependencies · catalog:	8.0.0-rc.11lockfile	8.0.0-rc.2127 Oct 2026	Latest release is only 1 days old, inside the 14-day window	0.17.04 Aug 2026	current	0
Upgrade path current Installed8.0.0-rc.11 from the lockfile Safe target0.17.04 Aug 2026public for 14+ days Latest8.0.0-rc.2127 Oct 2026only 1d old, inside the 14-day window Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 8.0.0-rc.11. Checked against OSV. Nothing to research: @prisma/orm-family-sql is at its safe target with no known advisories. Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Current	npmdependencies · catalog:	8.0.0-rc.11lockfile	8.0.0-rc.2127 Oct 2026	Latest release is only 1 days old, inside the 14-day window	0.17.04 Aug 2026	current	0
Upgrade path current Installed8.0.0-rc.11 from the lockfile Safe target0.17.04 Aug 2026public for 14+ days Latest8.0.0-rc.2127 Oct 2026only 1d old, inside the 14-day window Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 8.0.0-rc.11. Checked against OSV. Nothing to research: @prisma/orm-postgres is at its safe target with no known advisories. Ecosystem npm Section dependencies Declared catalog: Deprecated No
Current	npmdependencies · catalog:	0.29.4lockfile	0.29.415 May 2024	Latest release is 896 days old, past the 14-day window	0.29.415 May 2024	current	0
Upgrade path current Installed0.29.4 from the lockfile Safe target · latest0.29.415 May 2024public for 14+ days Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 0.29.4. Checked against OSV. Nothing to research: @solidjs/meta is at its safe target with no known advisories. Ecosystem npm Section dependencies Declared catalog: Deprecated No
Current	npmdependencies · catalog:	0.3.2lockfile	0.1.024 Nov 2025	Latest release is 338 days old, past the 14-day window	0.3.216 Jul 2026	current	0
Upgrade path current Installed0.3.2 from the lockfile Safe target0.3.216 Jul 2026public for 14+ days Latest0.1.024 Nov 2025338d public, past the window Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 0.3.2. Checked against OSV. Nothing to research: @solidjs/vite-plugin-nitro-2 is at its safe target with no known advisories. Ecosystem npm Section dependencies Declared catalog: Deprecated No
Current	npmdevDependencies · catalog:	4.3.3lockfile	4.3.316 Jul 2026	Latest release is 105 days old, past the 14-day window	4.3.316 Jul 2026	current	0
Upgrade path current Installed4.3.3 from the lockfile Safe target · latest4.3.316 Jul 2026public for 14+ days Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 4.3.3. Checked against OSV. Nothing to research: @tailwindcss/postcss is at its safe target with no known advisories. Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Current	npmdevDependencies · catalog:	0.5.20lockfile	0.5.208 Jun 2026	Latest release is 143 days old, past the 14-day window	0.5.208 Jun 2026	current	0
Upgrade path current Installed0.5.20 from the lockfile Safe target · latest0.5.208 Jun 2026public for 14+ days Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 0.5.20. Checked against OSV. Nothing to research: @tailwindcss/typography is at its safe target with no known advisories. Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Current	npmdevDependencies · catalog:	4.3.3lockfile	4.3.316 Jul 2026	Latest release is 105 days old, past the 14-day window	4.3.316 Jul 2026	current	0
Upgrade path current Installed4.3.3 from the lockfile Safe target · latest4.3.316 Jul 2026public for 14+ days Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 4.3.3. Checked against OSV. Nothing to research: @tailwindcss/vite is at its safe target with no known advisories. Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Current	npmdevDependencies · catalog:	0.8.5lockfile	0.8.520 Aug 2026	Latest release is 70 days old, past the 14-day window	0.8.520 Aug 2026	current	0
Upgrade path current Installed0.8.5 from the lockfile Safe target · latest0.8.520 Aug 2026public for 14+ days Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 0.8.5. Checked against OSV. Nothing to research: @tanstack/devtools-vite is at its safe target with no known advisories. Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Current	npmdependencies · catalog:	0.10.13lockfile	0.10.1323 Sep 2026	Latest release is 36 days old, past the 14-day window	0.10.1323 Sep 2026	current	0
Upgrade path current Installed0.10.13 from the lockfile Safe target · latest0.10.1323 Sep 2026public for 14+ days Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 0.10.13. Checked against OSV. Nothing to research: @tanstack/react-devtools is at its safe target with no known advisories. Ecosystem npm Section dependencies Declared catalog: Deprecated No
Current	npmdependencies · catalog:	1.167.2lockfile	1.167.213 Sep 2026	Latest release is 46 days old, past the 14-day window	1.167.213 Sep 2026	current	0
Upgrade path current Installed1.167.2 from the lockfile Safe target · latest1.167.213 Sep 2026public for 14+ days Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 1.167.2. Checked against OSV. Nothing to research: @tanstack/react-router-devtools is at its safe target with no known advisories. Ecosystem npm Section dependencies Declared catalog: Deprecated No
Current	npmdevDependencies · catalog:	4.2.0lockfile	4.2.027 Jan 2026	Latest release is 275 days old, past the 14-day window	4.2.027 Jan 2026	current	0
Upgrade path current Installed4.2.0 from the lockfile Safe target · latest4.2.027 Jan 2026public for 14+ days Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 4.2.0. Checked against OSV. Nothing to research: @types/http-cache-semantics is at its safe target with no known advisories. Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Current	npmdevDependencies · catalog:	4.0.3lockfile	4.0.33 Apr 2026	Latest release is 209 days old, past the 14-day window	4.0.33 Apr 2026	current	0
Upgrade path current Installed4.0.3 from the lockfile Safe target · latest4.0.33 Apr 2026public for 14+ days Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 4.0.3. Checked against OSV. Nothing to research: @types/picomatch is at its safe target with no known advisories. Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Current	npmdevDependencies · catalog:	0.9.1lockfile	0.9.124 Mar 2026	Latest release is 219 days old, past the 14-day window	0.9.124 Mar 2026	current	0
Upgrade path current Installed0.9.1 from the lockfile Safe target · latest0.9.124 Mar 2026public for 14+ days Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 0.9.1. Checked against OSV. Nothing to research: @vue/tsconfig is at its safe target with no known advisories. Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Current	npmdependencies · 2.0.0-beta.39	2.0.0-beta.39declared	2.0.0-beta.8424 Oct 2026	Latest release is only 5 days old, inside the 14-day window	0.94.01 Aug 2026	current	0
Upgrade path current Installed2.0.0-beta.39 declared, no lockfile Safe target0.94.01 Aug 2026public for 14+ days Latest2.0.0-beta.8424 Oct 2026only 5d old, inside the 14-day window Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 2.0.0-beta.39. Checked against OSV. Nothing to research: alchemy is at its safe target with no known advisories. Ecosystem npm Section dependencies Declared 2.0.0-beta.39 Deprecated No
Current	npmdevDependencies · catalog:	1.0.20lockfile	1.0.2028 Aug 2024	Latest release is 792 days old, past the 14-day window	1.0.2028 Aug 2024	current	0
Upgrade path current Installed1.0.20 from the lockfile Safe target · latest1.0.2028 Aug 2024public for 14+ days Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 1.0.20. Checked against OSV. Nothing to research: aws4fetch is at its safe target with no known advisories. Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Current	npmdependencies · catalog:	0.0.16lockfile	0.0.1614 Aug 2026	Latest release is 75 days old, past the 14-day window	0.0.1614 Aug 2026	current	0
Upgrade path current Installed0.0.16 from the lockfile Safe target · latest0.0.1614 Aug 2026public for 14+ days Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 0.0.16. Checked against OSV. Nothing to research: capnp-es is at its safe target with no known advisories. Ecosystem npm Section dependencies Declared catalog: Deprecated No
Current	npmdependencies · catalog:	0.12.0lockfile	0.12.020 Aug 2026	Latest release is 69 days old, past the 14-day window	0.12.020 Aug 2026	current	0
Upgrade path current Installed0.12.0 from the lockfile Safe target · latest0.12.020 Aug 2026public for 14+ days Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 0.12.0. Checked against OSV. Nothing to research: capnweb is at its safe target with no known advisories. Ecosystem npm Section dependencies Declared catalog: Deprecated No
Current	npmdependencies · catalog:	5.0.0lockfile	6.0.019 Oct 2026	Latest release is only 9 days old, inside the 14-day window	5.0.025 Nov 2025	current	0
Upgrade path current Installed5.0.0 from the lockfile Safe target5.0.025 Nov 2025public for 14+ days Latest6.0.019 Oct 2026only 9d old, inside the 14-day window Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 5.0.0. Checked against OSV. Nothing to research: chokidar is at its safe target with no known advisories. Ecosystem npm Section dependencies Declared catalog: Deprecated No
Current	npmdependencies · catalog:	2.0.1lockfile	2.0.130 Jun 2026	Latest release is 120 days old, past the 14-day window	2.0.130 Jun 2026	current	0
Upgrade path current Installed2.0.1 from the lockfile Safe target · latest2.0.130 Jun 2026public for 14+ days Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 2.0.1. Checked against OSV. Nothing to research: cookie is at its safe target with no known advisories. Ecosystem npm Section dependencies Declared catalog: Deprecated No
Current	npmdevDependencies · catalog:	1.0.0-rc.5-ab785fclockfile	0.31.1121 Sep 2026	Latest release is 38 days old, past the 14-day window	0.31.1121 Sep 2026	current	0
Upgrade path current Installed1.0.0-rc.5-ab785fc from the lockfile Safe target · latest0.31.1121 Sep 2026public for 14+ days Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 1.0.0-rc.5-ab785fc. Checked against OSV. Nothing to research: drizzle-kit is at its safe target with no known advisories. Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Current	npmdependencies · catalog:	1.0.0-rc.5-ab785fclockfile	0.45.48 Oct 2026	Latest release is 21 days old, past the 14-day window	0.45.48 Oct 2026	current	0
Upgrade path current Installed1.0.0-rc.5-ab785fc from the lockfile Safe target · latest0.45.48 Oct 2026public for 14+ days Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 1.0.0-rc.5-ab785fc. Checked against OSV. Nothing to research: drizzle-orm is at its safe target with no known advisories. Ecosystem npm Section dependencies Declared catalog: Deprecated No
Current	npmdependencies · catalog:	0.28.2lockfile	0.28.28 Aug 2026	Latest release is 81 days old, past the 14-day window	0.28.28 Aug 2026	current	0
Upgrade path current Installed0.28.2 from the lockfile Safe target · latest0.28.28 Aug 2026public for 14+ days Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 0.28.2. Checked against OSV. Nothing to research: esbuild is at its safe target with no known advisories. Ecosystem npm Section dependencies Declared catalog: Deprecated No
Current	npmdependencies · catalog:	0.8.3lockfile	0.8.316 May 2026	Latest release is 166 days old, past the 14-day window	0.8.316 May 2026	current	0
Upgrade path current Installed0.8.3 from the lockfile Safe target · latest0.8.316 May 2026public for 14+ days Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 0.8.3. Checked against OSV. Nothing to research: fflate is at its safe target with no known advisories. Ecosystem npm Section dependencies Declared catalog: Deprecated No
Current	npmdevDependencies · catalog:	2.7.1lockfile	2.7.130 Sep 2025	Latest release is 394 days old, past the 14-day window	2.7.130 Sep 2025	current	0
Upgrade path current Installed2.7.1 from the lockfile Safe target · latest2.7.130 Sep 2025public for 14+ days Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 2.7.1. Checked against OSV. Nothing to research: heap-js is at its safe target with no known advisories. Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Current	npmdependencies · ^11.11.1	11.12.0lockfile	11.12.012 Aug 2026	Latest release is 78 days old, past the 14-day window	11.12.012 Aug 2026	current	0
Upgrade path current Installed11.12.0 from the lockfile Safe target · latest11.12.012 Aug 2026public for 14+ days Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 11.12.0. Checked against OSV. Nothing to research: highlight.js is at its safe target with no known advisories. Ecosystem npm Section dependencies Declared ^11.11.1 Deprecated No
Current	npmdevDependencies · catalog:	9.1.7lockfile	9.1.718 Nov 2024	Latest release is 709 days old, past the 14-day window	9.1.718 Nov 2024	current	0
Upgrade path current Installed9.1.7 from the lockfile Safe target · latest9.1.718 Nov 2024public for 14+ days Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 9.1.7. Checked against OSV. Nothing to research: husky is at its safe target with no known advisories. Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Current	npmdevDependencies · catalog:	2.0.2lockfile	2.0.226 Jul 2025	Latest release is 459 days old, past the 14-day window	2.0.226 Jul 2025	current	0
Upgrade path current Installed2.0.2 from the lockfile Safe target · latest2.0.226 Jul 2025public for 14+ days Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 2.0.2. Checked against OSV. Nothing to research: itty-time is at its safe target with no known advisories. Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Current	npmdependencies · catalog:	0.8.4lockfile	0.8.419 Apr 2026	Latest release is 193 days old, past the 14-day window	0.8.419 Apr 2026	current	0
Upgrade path current Installed0.8.4 from the lockfile Safe target · latest0.8.419 Apr 2026public for 14+ days Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 0.8.4. Checked against OSV. Nothing to research: libsodium-wrappers is at its safe target with no known advisories. Ecosystem npm Section dependencies Declared catalog: Deprecated No
Current	npmdependencies · ^2.2.2	2.2.4lockfile	2.2.47 Apr 2026	Latest release is 205 days old, past the 14-day window	2.2.47 Apr 2026	current	0
Upgrade path current Installed2.2.4 from the lockfile Safe target · latest2.2.47 Apr 2026public for 14+ days Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 2.2.4. Checked against OSV. Nothing to research: marked-highlight is at its safe target with no known advisories. Ecosystem npm Section dependencies Declared ^2.2.2 Deprecated No
Current	npmdevDependencies · catalog:	2.13.4lockfile	2.13.519 Oct 2026	Latest release is only 10 days old, inside the 14-day window	2.13.429 Apr 2026	current	0
Upgrade path current Installed2.13.4 from the lockfile Safe target2.13.429 Apr 2026public for 14+ days Latest2.13.519 Oct 2026only 10d old, inside the 14-day window Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 2.13.4. Checked against OSV. Nothing to research: nitropack is at its safe target with no known advisories. Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Current	npmdependencies · catalog:	2.0.3lockfile	2.0.311 Feb 2025	Latest release is 624 days old, past the 14-day window	2.0.311 Feb 2025	current	0
Upgrade path current Installed2.0.3 from the lockfile Safe target · latest2.0.311 Feb 2025public for 14+ days Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 2.0.3. Checked against OSV. Nothing to research: pathe is at its safe target with no known advisories. Ecosystem npm Section dependencies Declared catalog: Deprecated No
Current	npmdevDependencies · catalog:	8.0.0-rc.15lockfile	8.0.0-rc.2827 Oct 2026	Latest release is only 1 days old, inside the 14-day window	7.10.025 Aug 2026	current	0
Upgrade path current Installed8.0.0-rc.15 from the lockfile Safe target7.10.025 Aug 2026public for 14+ days Latest8.0.0-rc.2827 Oct 2026only 1d old, inside the 14-day window Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 8.0.0-rc.15. Checked against OSV. Nothing to research: prisma is at its safe target with no known advisories. Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Current	npmdependencies · catalog:	0.10.5lockfile	0.11.628 Oct 2026	Latest release is only 0 days old, inside the 14-day window	0.10.519 Aug 2026	current	0
Upgrade path current Installed0.10.5 from the lockfile Safe target0.10.519 Aug 2026public for 14+ days Latest0.11.628 Oct 2026only 0d old, inside the 14-day window Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 0.10.5. Checked against OSV. Nothing to research: satteri is at its safe target with no known advisories. Ecosystem npm Section dependencies Declared catalog: Deprecated No
Current	npmdevDependencies · catalog:	0.34.5lockfile	0.34.521 Jan 2026	Latest release is 280 days old, past the 14-day window	0.34.521 Jan 2026	current	0
Upgrade path current Installed0.34.5 from the lockfile Safe target · latest0.34.521 Jan 2026public for 14+ days Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 0.34.5. Checked against OSV. Nothing to research: solid-devtools is at its safe target with no known advisories. Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Current	npmdependencies · catalog:	1.0.5lockfile	1.0.827 Oct 2026	Latest release is only 2 days old, inside the 14-day window	1.0.514 Sep 2026	current	0
Upgrade path current Installed1.0.5 from the lockfile Safe target1.0.514 Sep 2026public for 14+ days Latest1.0.827 Oct 2026only 2d old, inside the 14-day window Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 1.0.5. Checked against OSV. Nothing to research: srvx is at its safe target with no known advisories. Ecosystem npm Section dependencies Declared catalog: Deprecated No
Current	npmdevDependencies · catalog:	4.3.3lockfile	4.3.316 Jul 2026	Latest release is 105 days old, past the 14-day window	4.3.316 Jul 2026	current	0
Upgrade path current Installed4.3.3 from the lockfile Safe target · latest4.3.316 Jul 2026public for 14+ days Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 4.3.3. Checked against OSV. Nothing to research: tailwindcss is at its safe target with no known advisories. Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Current	npmdependencies · catalog:	0.2.17lockfile	0.2.1730 May 2026	Latest release is 151 days old, past the 14-day window	0.2.1730 May 2026	current	0
Upgrade path current Installed0.2.17 from the lockfile Safe target · latest0.2.1730 May 2026public for 14+ days Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 0.2.17. Checked against OSV. Nothing to research: tinyglobby is at its safe target with no known advisories. Ecosystem npm Section dependencies Declared catalog: Deprecated No
Current	npmdevDependencies · catalog:	2.0.0-rc.24lockfile	1.10.016 Jul 2024	Latest release is 834 days old, past the 14-day window	1.10.016 Jul 2024	current	0
Upgrade path current Installed2.0.0-rc.24 from the lockfile Safe target · latest1.10.016 Jul 2024public for 14+ days Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 2.0.0-rc.24. Checked against OSV. Nothing to research: unenv is at its safe target with no known advisories. Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Current	npmdevDependencies · catalog:	2.11.14lockfile	2.11.1427 Jul 2026	Latest release is 94 days old, past the 14-day window	2.11.1427 Jul 2026	current	0
Upgrade path current Installed2.11.14 from the lockfile Safe target · latest2.11.1427 Jul 2026public for 14+ days Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 2.11.14. Checked against OSV. Nothing to research: vite-plugin-solid is at its safe target with no known advisories. Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Current	npmdevDependencies · catalog:	8.2.1lockfile	8.2.125 Jul 2026	Latest release is 96 days old, past the 14-day window	8.2.125 Jul 2026	current	0
Upgrade path current Installed8.2.1 from the lockfile Safe target · latest8.2.125 Jul 2026public for 14+ days Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 8.2.1. Checked against OSV. Nothing to research: vite-plugin-vue-devtools is at its safe target with no known advisories. Ecosystem npm Section devDependencies Declared catalog: Deprecated No
Current	npmdependencies · catalog:	3.6.0-beta.17lockfile	3.5.4413 Oct 2026	Latest release is 16 days old, past the 14-day window	3.5.4413 Oct 2026	current	0
Upgrade path current Installed3.6.0-beta.17 from the lockfile Safe target · latest3.5.4413 Oct 2026public for 14+ days Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 3.6.0-beta.17. Checked against OSV. Nothing to research: vue is at its safe target with no known advisories. Ecosystem npm Section dependencies Declared catalog: Deprecated No
Current	npmdependencies · catalog:	3.4.0lockfile	3.4.07 Jun 2026	Latest release is 144 days old, past the 14-day window	3.4.07 Jun 2026	current	0
Upgrade path current Installed3.4.0 from the lockfile Safe target · latest3.4.07 Jun 2026public for 14+ days Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 3.4.0. Checked against OSV. Nothing to research: yauzl is at its safe target with no known advisories. Ecosystem npm Section dependencies Declared catalog: Deprecated No

View all207packages

03 · Tickets

69 tickets, in the order to do them

Each one is a complete brief your coding agent can execute. A ticket only turns green when a rescan proves the lockfile moved.

What is in a ticket

P0cve
TDB-0011L2 @opennextjs/cloudflare
Fix 1 advisory in @opennextjs/cloudflare: 1.20.1 → 1.20.12
@opennextjs/cloudflare1.20.11.20.12
@opennextjs/cloudflare 1.20.1 in pingdotgg/t3code has 1 known advisory (1 high). Upgrade 1.20.1 → 1.20.12 so the installed version is no longer affected.
- The manifest pins @opennextjs/cloudflare at exactly 1.20.12: no ^, ~ or range.
- The lockfile is regenerated with the project's package manager, resolves @opennextjs/cloudflare to the target, and nothing newer than the target slipped in.
- A clean install from the lockfile succeeds: pnpm install --frozen-lockfile, npm ci, yarn install --immutable or bun install --frozen-lockfile (whichever matches the lockfile).
- Tests, lint, typecheck and build all pass, and your report contains their real output.
- No API that the release notes mark as removed remains in the code.
- A rescan of your branch shows no advisories for this package.
- No test was deleted, skipped or loosened; every changed test is listed in changed_tests with a reason.
after TDB-0010
P0cve
TDB-0012L3 @tanstack
Fix 1 advisory in @tanstack/react-start: 1.168.49 → 1.169.2
@tanstack/react-start1.168.491.169.2
@tanstack/react-start 1.168.49 in pingdotgg/t3code has 1 known advisory (1 critical). Upgrade 1.168.49 → 1.169.2 so the installed version is no longer affected.
- The manifest pins @tanstack/react-start at exactly 1.169.2: no ^, ~ or range.
- The lockfile is regenerated with the project's package manager, resolves @tanstack/react-start to the target, and nothing newer than the target slipped in.
- A clean install from the lockfile succeeds: pnpm install --frozen-lockfile, npm ci, yarn install --immutable or bun install --frozen-lockfile (whichever matches the lockfile).
- Tests, lint, typecheck and build all pass, and your report contains their real output.
- No API that the release notes mark as removed remains in the code.
- A rescan of your branch shows no advisories for this package.
- No test was deleted, skipped or loosened; every changed test is listed in changed_tests with a reason.
after TDB-0010
P0cve
TDB-0013L3 @tanstack
Fix 1 advisory in @tanstack/solid-start: 1.168.42 → 1.169.2
@tanstack/solid-start1.168.421.169.2
@tanstack/solid-start 1.168.42 in pingdotgg/t3code has 1 known advisory (1 critical). Upgrade 1.168.42 → 1.169.2 so the installed version is no longer affected.
- The manifest pins @tanstack/solid-start at exactly 1.169.2: no ^, ~ or range.
- The lockfile is regenerated with the project's package manager, resolves @tanstack/solid-start to the target, and nothing newer than the target slipped in.
- A clean install from the lockfile succeeds: pnpm install --frozen-lockfile, npm ci, yarn install --immutable or bun install --frozen-lockfile (whichever matches the lockfile).
- Tests, lint, typecheck and build all pass, and your report contains their real output.
- No API that the release notes mark as removed remains in the code.
- A rescan of your branch shows no advisories for this package.
- No test was deleted, skipped or loosened; every changed test is listed in changed_tests with a reason.
after TDB-0012

66 more tickets in this queue

See all 69 tickets

Free, no card needed

04 · Questions

About pingdotgg/t3code's dependencies

Does pingdotgg/t3code have known vulnerabilities?

Yes. The latest scan found 74 known advisories across 17 packages, 22 rated critical or high. Advisories come from OSV and are matched against the installed versions in the lockfile.

How outdated are pingdotgg/t3code’s dependencies?

132 of its packages are behind the safe target (the newest stable release that has been public for at least 14 days). 27 packages are a whole major version behind. The tech-debt free score is −36/100. 100 means no dependency debt; below zero means the debt outweighs the whole scale.

Which package ecosystems does pingdotgg/t3code use?

npm and github-actions (207 packages in the manifests and lockfiles pinwise read).

When was pingdotgg/t3code last scanned?

29 Oct 2026. Public repo pages are re-scanned about once a week, and anyone can request a fresh scan from the free scanner.

05 · Share

Share this report

Public repos only. This page is permanent and re-scanned about once a week.

README badge

Shows the live score and links back here.

README.md

[![pinwise.dev debt-free score](https://pinwise.dev/badge/01M640RFSDMPG7BSQ0ECX46EAH.svg)](https://pinwise.dev/scan/github/pingdotgg/t3code)

For maintainers

Is this your repo?

Claim pingdotgg/t3code to turn this report into a working plan, or decide whether this public page stays up.

Watch itWeekly re-scans and a nudge when a fix lands or a CVE appears.
TicketsEvery finding as a ready-to-ship ticket your coding agent can close.
Private scansScan branches and private repos inside your workspace.
BadgeA live debt-free score badge for your README.

Only the repo's owner can claim or change this page. We verify through your GitHub login, a connected workspace or the GitHub App installation, never a form.

Search visibility and removal

Pinwise scans public repositories from their manifests and lockfiles only. If you own pingdotgg/t3code, you can keep this page out of search engines or remove it. Private scans inside the app are not affected.

Tech-debt free score

How we got −36

Summary

actions/checkout v6 → 7.0.1

actions/create-github-app-token v2 → 3.3.0

actions/github-script v8 → 9.0.0

actions/setup-java v5 → 6.1.0

actions/stale v9 → 11.0.0

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan