withastro/flue tech-debt free score 0/100

Tech-debt free score

0/100

Rotting

19 critical or high advisories, 31 moderate advisories, 11 packages a whole major behind and 68 more behind the safe target.

How we got −31

Critical/high CVEs and outdated majors cost 80 of 131 lost points. Fix the 19 critical/high CVEs first.

19 critical/high CVEs19 × 25 = 475capped at 50costs −50 points, 38% of points lost
11 majors behind11 × 6 = 66capped at 30costs −30 points, 23% of points lost
31 moderate/low CVEs31 × 8 = 248capped at 24costs −24 points, 18% of points lost
3 deprecated packages3 × 5costs −15 points, 11% of points lost
55 minors behind55 × 2 = 110capped at 12costs −12 points, 9% of points lost

Nothing found in: Node runtime EOL

Debt-free score100 − 131 =−31

100 means no dependency debt; below zero means the debt outweighs the whole scale. Every advisory and every version behind costs points.

withastro/flue scores 0 out of 100 on the tech-debt free score (rotting; 100 means no dependency debt). 9 of its 107 packages carry known advisories, 19 of them critical or high. 11 packages are a whole major version behind and 68 more trail the safe target. The scan covers npm, github-actions and runtime. Last scanned 26 Oct 2026.

Last scanned 26 Oct 2026 · 1 public scan so far · re-scanned about once a week

Packages & tools

107

79 behind the safe target (74%)

Needs action

advisory, deprecated or a major behind

Behind target

minor or patch behind

Current

at or above the safe target

Advisories

across 9 packages, from OSV.dev

How the 107 packages splitred needs a ticket, amber a bump, green nothing

20 need action66 behind target21 current

01 · Worst first

The 5 packages costing withastro/flue the most

Each one links to its row in the table below, with the safe target and the advisories.

@astrojs/mdx 7.0.5 → 8.0.3
npm · a whole major behind
@cloudflare/sandbox 0.12.4 → 1.0.0
npm · a whole major behind
@cloudflare/vitest-pool-workers 0.19.1 → 0.23.0
npm · deprecated
@grammyjs/types 4.0.0 → 5.0.0
npm · a whole major behind
@linear/sdk 88.3.0 → 97.1.0
npm · a whole major behind

02 · Packages

107 packages, worst first

The safe target is the newest stable release that has been public for at least 14 days. Fresh releases are where supply-chain attacks land.

Packages with installed, latest and safe target versions
Status	Package	Installed	Latest	≥ 14d	Safe target	Drift	CVEs
Needs action	npmdependencies · ^7.0.3Sign up to research for @astrojs/mdx	7.0.5lockfile	8.1.121 Oct 2026	Latest release is only 4 days old, inside the 14-day window	8.0.36 Oct 2026	major	0
Upgrade path major Installed7.0.5 from the lockfile Safe target8.0.36 Oct 2026public for 14+ days Latest8.1.121 Oct 2026only 4d old, inside the 14-day window A whole major behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 7.0.5. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `7.0.5 → 8.0.3` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared ^7.0.3 Deprecated No
Needs action	npmdependencies · *Sign up to research for @cloudflare/sandbox	0.12.4lockfile	1.0.322 Oct 2026	Latest release is only 3 days old, inside the 14-day window	1.0.030 Sep 2026	major	0
Upgrade path major Installed0.12.4 from the lockfile Safe target1.0.030 Sep 2026public for 14+ days Latest1.0.322 Oct 2026only 3d old, inside the 14-day window A whole major behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 0.12.4. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `0.12.4 → 1.0.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared * Deprecated No
Needs action	npmdevDependencies · 0.19.1deprecatedSign up to research for @cloudflare/vitest-pool-workers	0.19.1lockfile	0.23.07 Oct 2026	Latest release is 18 days old, past the 14-day window	-	unknown	0
Upgrade path unknown Installed0.19.1 from the lockfile Safe target- no release has cleared the window yet Latest0.23.07 Oct 202618d public, past the window Could not tell how far behind this is. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 0.19.1. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `0.19.1 → target` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared 0.19.1 Deprecated Yes, by its maintainers
Needs action	npmdependencies · 4.0.0Sign up to research for @grammyjs/types	4.0.0lockfile	5.0.025 Aug 2026	Latest release is 61 days old, past the 14-day window	5.0.025 Aug 2026	major	0
Upgrade path major Installed4.0.0 from the lockfile Safe target · latest5.0.025 Aug 2026public for 14+ days A whole major behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 4.0.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `4.0.0 → 5.0.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared 4.0.0 Deprecated No
Needs action	npmdependencies · *Sign up to research for @linear/sdk	88.3.0lockfile	99.0.021 Oct 2026	Latest release is only 4 days old, inside the 14-day window	97.1.07 Oct 2026	major	0
Upgrade path major Installed88.3.0 from the lockfile Safe target97.1.07 Oct 2026public for 14+ days Latest99.0.021 Oct 2026only 4d old, inside the 14-day window A whole major behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 88.3.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `88.3.0 → 97.1.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared * Deprecated No
Needs action	npmdependencies · 2.0.0Sign up to research for @modelcontextprotocol/client	2.0.0lockfile	2.4.023 Oct 2026	Latest release is only 2 days old, inside the 14-day window	2.3.15 Oct 2026	minor	2
Upgrade path minor Installed2.0.0 from the lockfile Safe target2.3.15 Oct 2026public for 14+ days Latest2.4.023 Oct 2026only 2d old, inside the 14-day window A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 2 1 high, 1 moderate highCVSS 7.5GHSA-6qxp-vccf-f47h MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server CVE-2026-104850fixed in `2.2.0` moderateCVSS 6.5GHSA-6prh-2h8m-c8cw MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies CVE-2026-111769fixed in `2.3.0` Research not included on this scan Breaking changes, the work involved and the new features between `2.0.0 → 2.3.1` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared 2.0.0 Deprecated No
Needs action	npmdevDependencies · 2.0.0Sign up to research for @modelcontextprotocol/server	2.0.0lockfile	2.4.023 Oct 2026	Latest release is only 2 days old, inside the 14-day window	2.3.15 Oct 2026	minor	3
Upgrade path minor Installed2.0.0 from the lockfile Safe target2.3.15 Oct 2026public for 14+ days Latest2.4.023 Oct 2026only 2d old, inside the 14-day window A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 3 2 high, 1 moderate highCVSS 7.5GHSA-46jr-4wx8-v453 MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation CVE-2026-111768fixed in `2.3.0` highCVSS 7.7GHSA-jm63-cq47-j5jp MCP TypeScript server SDK: Shared transport or server instances delivered one HTTP client's messages to another CVE-2026-111770fixed in `2.3.0` moderateCVSS 6.8GHSA-rvq5-wwqv-78pq MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service CVE-2026-111771fixed in `2.3.0` Research not included on this scan Breaking changes, the work involved and the new features between `2.0.0 → 2.3.1` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared 2.0.0 Deprecated No
Needs action	npmdependencies · 7.6.1deprecatedSign up to research for @octokit/webhooks-types	7.6.1lockfile	7.6.13 Oct 2024	Latest release is 752 days old, past the 14-day window	-	unknown	0
Upgrade path unknown Installed7.6.1 from the lockfile Safe target- no release has cleared the window yet Latest7.6.13 Oct 2024752d public, past the window Could not tell how far behind this is. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 7.6.1. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `7.6.1 → target` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared 7.6.1 Deprecated Yes, by its maintainers
Needs action	npmdevDependencies · ^2.7.1deprecatedSign up to research for @opentelemetry/sdk-trace-base	2.10.0lockfile	2.12.06 Oct 2026	Latest release is 19 days old, past the 14-day window	-	unknown	0
Upgrade path unknown Installed2.10.0 from the lockfile Safe target- no release has cleared the window yet Latest2.12.06 Oct 202619d public, past the window Could not tell how far behind this is. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 2.10.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `2.10.0 → target` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared ^2.7.1 Deprecated Yes, by its maintainers
Needs action	npmdependencies · ^10.64.0Sign up to research for @sentry/node	10.69.0lockfile	11.9.023 Oct 2026	Latest release is only 3 days old, inside the 14-day window	11.6.08 Oct 2026	major	0
Upgrade path major Installed10.69.0 from the lockfile Safe target11.6.08 Oct 2026public for 14+ days Latest11.9.023 Oct 2026only 3d old, inside the 14-day window A whole major behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 10.69.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `10.69.0 → 11.6.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared ^10.64.0 Deprecated No
Needs action	npmdependencies · *Sign up to research for @shopify/admin-api-client	1.1.2lockfile	2.0.18 Oct 2026	Latest release is 17 days old, past the 14-day window	2.0.18 Oct 2026	major	0
Upgrade path major Installed1.1.2 from the lockfile Safe target · latest2.0.18 Oct 2026public for 14+ days A whole major behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 1.1.2. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `1.1.2 → 2.0.1` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared * Deprecated No
Needs action	npmdependencies · ^7.0.9Sign up to research for astro	7.1.6lockfile	7.4.221 Oct 2026	Latest release is only 4 days old, inside the 14-day window	7.3.88 Oct 2026	minor	9
Upgrade path minor Installed7.1.6 from the lockfile Safe target7.3.88 Oct 2026public for 14+ days Latest7.4.221 Oct 2026only 4d old, inside the 14-day window A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 9 1 critical, 1 high, 5 moderate, 2 low criticalCVSS 9.8GHSA-26w7-cxv4-gfx2 Astro: Remote code execution through AVIF image optimization fixed in `7.2.8` highCVSS 7.5GHSA-2pvr-wf23-7pc7 Astro: Host header SSRF in prerendered error page fetch CVE-2026-54299fixed in `6.4.6` moderateGHSA-376h-93r7-7g6f Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base CVE-2026-84376fixed in `7.2.4` moderateGHSA-4g3v-8h47-v7g6 Astro: Reflected XSS via unescaped View Transition animation properties CVE-2026-73422fixed in `7.1.0` moderateCVSS 6.5GHSA-98hj-9722-w3j8 Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering CVE-2026-114128fixed in `7.3.2` moderateGHSA-f48w-9m4c-m7f5 Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298) CVE-2026-59729fixed in `7.0.6` moderateCVSS 4.2GHSA-jrpj-wcv7-9fh9 Astro: XSS via Unescaped Attribute Names in Spread Props CVE-2026-54298fixed in `6.4.6` lowGHSA-7pw4-f3q4-r2p2 Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands CVE-2026-59727fixed in `7.0.4` lowGHSA-mpr7-6m5w-76rw Astro: Arbitrary CSS injection in Astro View Transitions CVE-2026-114127fixed in `7.3.3` Research not included on this scan Breaking changes, the work involved and the new features between `7.1.6 → 7.3.8` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared ^7.0.9 Deprecated No
Needs action	npmdevDependencies · ^20.11.0Sign up to research for happy-dom	20.11.1lockfile	21.0.420 Oct 2026	Latest release is only 5 days old, inside the 14-day window	21.0.112 Oct 2026	major	1
Upgrade path major Installed20.11.1 from the lockfile Safe target21.0.112 Oct 2026public for 14+ days Latest21.0.420 Oct 2026only 5d old, inside the 14-day window A whole major behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 1 1 high highCVSS 8.8GHSA-834v-8h66-3h79 Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution CVE-2026-115895fixed in `21.0.4` Research not included on this scan Breaking changes, the work involved and the new features between `20.11.1 → 21.0.1` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared ^20.11.0 Deprecated No
Needs action	npmdependencies · ^4.12.32Sign up to research for hono	4.12.32lockfile	4.13.1425 Oct 2026	Latest release is only 1 days old, inside the 14-day window	4.13.134 Oct 2026	minor	9
Upgrade path minor Installed4.12.32 from the lockfile Safe target4.13.134 Oct 2026public for 14+ days Latest4.13.1425 Oct 2026only 1d old, inside the 14-day window A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 9 8 moderate, 1 low moderateCVSS 5.3GHSA-54fx-42gc-7vw4 Hono: Algorithmic Complexity DoS in Language Middleware CVE-2026-71848fixed in `4.12.34` moderateCVSS 5.3GHSA-5r4p-p66f-jhc7 Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths CVE-2026-109955, CVE-2026-111757fixed in `4.13.11` moderateCVSS 5.3GHSA-8j4g-w8fx-2239 Hono: ReDoS in CORS middleware via Access-Control-Request-Headers CVE-2026-69207fixed in `4.12.34` moderateCVSS 5.9GHSA-crvj-82cr-hjcx Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials CVE-2026-84363fixed in `4.13.5` moderateCVSS 4.8GHSA-f23p-vx2j-j53r Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure CVE-2026-71850fixed in `4.12.34` moderateCVSS 5.3GHSA-g6gw-c38x-mqfc Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion CVE-2026-84364fixed in `4.13.5` moderateCVSS 6.5GHSA-gqvv-2mrq-wpjv Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory CVE-2026-84365fixed in `4.13.5` moderateCVSS 4.7GHSA-hxh3-vqpv-xpqv hono/jsx renders plain strings unescaped in boundary components, leading to XSS CVE-2026-93981fixed in `4.13.7` lowCVSS 3.7GHSA-79qm-7rj5-m7r9 Hono: Proxy Helper does not remove response headers listed in the `Connection` header CVE-2026-71849fixed in `4.12.34` Research not included on this scan Breaking changes, the work involved and the new features between `4.12.32 → 4.13.13` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared ^4.12.32 Deprecated No
Needs action	npmdependencies · ^5.2.1Sign up to research for js-yaml	5.2.2lockfile	5.5.015 Oct 2026	Latest release is only 10 days old, inside the 14-day window	5.4.35 Oct 2026	minor	1
Upgrade path minor Installed5.2.2 from the lockfile Safe target5.4.35 Oct 2026public for 14+ days Latest5.5.015 Oct 2026only 10d old, inside the 14-day window A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 1 1 moderate moderateCVSS 5.3GHSA-r3ph-w7gj-g6xm js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources fixed in `5.4.1` Research not included on this scan Breaking changes, the work involved and the new features between `5.2.2 → 5.4.3` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared ^5.2.1 Deprecated No
Needs action	npmtooling · 11.1.1Sign up to research for pnpm	11.1.1declared	12.15.021 Oct 2026	Latest release is only 4 days old, inside the 14-day window	12.12.111 Oct 2026	major	17
Upgrade path major Installed11.1.1 declared, no lockfile Safe target12.12.111 Oct 2026public for 14+ days Latest12.15.021 Oct 2026only 4d old, inside the 14-day window A whole major behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 17 11 high, 6 moderate highCVSS 7.5GHSA-5wx6-mg75-v57r pnpm: Manifest identity spoof satisfies allowBuilds and runs attacker lifecycle CVE-2026-55487fixed in `11.5.3` highCVSS 7.1GHSA-72r4-9c5j-mj57 pnpm: `patch-remove` could delete project-selected files outside the patches directory CVE-2026-59194fixed in `11.7.0` highCVSS 7.1GHSA-c59q-g84q-2gj5 pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph CVE-2026-82392fixed in `11.11.0` highCVSS 7.1GHSA-fr4h-3cph-29xv pnpm: Hoisted install imports lockfile alias outside node_modules CVE-2026-59196fixed in `11.7.0` highCVSS 7.5GHSA-gj8w-mvpf-x27x pnpm: Repository-controlled configDependencies can select a pacquet native install engine CVE-2026-55697fixed in `11.5.3` highCVSS 8.8GHSA-hwx4-2j3j-g496 pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement CVE-2026-50016fixed in `11.4.0` highCVSS 8.2GHSA-qrv3-253h-g69c pnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node_modules/.pnpm-config CVE-2026-59195fixed in `11.8.0` highCVSS 7.3GHSA-rxhj-4m44-96r4 pnpm Vulnerable to Arbitrary File Write/Delete via Malicious Patch File (Path Traversal) CVE-2026-50015fixed in `11.4.0` highCVSS 7.5GHSA-vq4v-j7r6-jq4m pnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on install CVE-2026-82393fixed in `11.11.0` highCVSS 7.4GHSA-vx52-2968-3vc6 pnpm: Environment secrets exfiltrated via env-placeholder expansion in proxy settings read from an untrusted pnpm-workspace.yaml CVE-2026-101043fixed in `10.34.5` highCVSS 8.8GHSA-w466-c33r-3gjp pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes CVE-2026-55698fixed in `11.5.3` moderateCVSS 6.5GHSA-3qhv-2rgh-x77r pnpm: Repository config can expand victim environment secrets into registry requests before scripts run CVE-2026-55180fixed in `11.5.3` moderateCVSS 6.5GHSA-4gxm-v5v7-fqc4 pnpm: Reserved bin name deletes PNPM_HOME during global remove CVE-2026-55699fixed in `11.5.3` moderateCVSS 6.8GHSA-54hh-g5mx-jqcp pnpm: Unsafe default behavior breaks integrity check CVE-2026-50573fixed in `11.4.0` moderateGHSA-cjhr-43r9-cfmw pnpm binds unscoped user-level npm auth credentials to a repository-selected registry CVE-2026-50017fixed in `11.4.0` moderateCVSS 6.4GHSA-p4xf-rf54-rj3x pnpm: Git Fetch Argument Injection via Lockfile resolution.commit CVE-2026-50014fixed in `11.4.0` moderateCVSS 6.8GHSA-q6j5-fjx5-2mc3 pnpm Has an Integrity Check Bypass via Missing Lockfile Integrity Field CVE-2026-50021fixed in `10.34.1` Research not included on this scan Breaking changes, the work involved and the new features between `11.1.1 → 12.12.1` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section tooling Declared 11.1.1 Deprecated No
Needs action	npmdependencies · *Sign up to research for stripe	22.4.0lockfile	23.0.122 Oct 2026	Latest release is only 3 days old, inside the 14-day window	23.0.01 Oct 2026	major	0
Upgrade path major Installed22.4.0 from the lockfile Safe target23.0.01 Oct 2026public for 14+ days Latest23.0.122 Oct 2026only 3d old, inside the 14-day window A whole major behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 22.4.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `22.4.0 → 23.0.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared * Deprecated No
Needs action	npmdevDependencies · ^7.0.2Sign up to research for typescript	6.0.3lockfile	7.0.28 Jul 2026	Latest release is 109 days old, past the 14-day window	7.0.28 Jul 2026	major	0
Upgrade path major Installed6.0.3 from the lockfile Safe target · latest7.0.28 Jul 2026public for 14+ days A whole major behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 6.0.3. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `6.0.3 → 7.0.2` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared ^7.0.2 Deprecated No
Needs action	npmdevDependencies · ^8.0.14Sign up to research for vite	8.1.5lockfile	8.3.521 Oct 2026	Latest release is only 5 days old, inside the 14-day window	8.3.48 Oct 2026	minor	7
Upgrade path minor Installed8.1.5 from the lockfile Safe target8.3.48 Oct 2026public for 14+ days Latest8.3.521 Oct 2026only 5d old, inside the 14-day window A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 7 2 high, 4 moderate, 1 low highGHSA-587h-7wmj-h5pm launch-editor: `fs.existsSync()` existence check can be bypassed on Windows CVE-2026-112942fixed in `6.4.4` highCVSS 7.5GHSA-fx2h-pf6j-xcff vite: `server.fs.deny` bypass on Windows alternate paths CVE-2026-53571fixed in `6.4.3` moderateGHSA-698v-4r3x-3vcv launch-editor: escapeCmdArgs() omits % escaping on Windows CVE-2026-112943fixed in `6.4.4` moderateGHSA-r825-w8mm-5pxw launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors CVE-2026-112944fixed in `6.4.4` moderateGHSA-rq7h-c2jc-7f22 Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine CVE-2026-112946fixed in `6.4.4` moderateGHSA-v6wh-96g9-6wx3 launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows CVE-2026-53632fixed in `6.4.3` lowGHSA-9jrq-w75r-8gcw Vite: Cross origin script execution through Vite custom middleware CVE-2026-112945fixed in `6.4.4` Research not included on this scan Breaking changes, the work involved and the new features between `8.1.5 → 8.3.4` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared ^8.0.14 Deprecated No
Needs action	npmdevDependencies · ^4.1.6Sign up to research for vitest	4.1.6declared	5.0.515 Oct 2026	Latest release is only 10 days old, inside the 14-day window	5.0.412 Oct 2026	major	1
Upgrade path major Installed4.1.6 declared, no lockfile Safe target5.0.412 Oct 2026public for 14+ days Latest5.0.515 Oct 2026only 10d old, inside the 14-day window A whole major behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 1 1 moderate moderateCVSS 5.9GHSA-82fw-gwwq-j7x9 Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock CVE-2026-84373fixed in `5.0.0-rc.2` Research not included on this scan Breaking changes, the work involved and the new features between `4.1.6 → 5.0.4` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared ^4.1.6 Deprecated No
Behind	github-actionstooling · 3d3c42e5aac5ba805825da76410c181273ba90b1Sign up to research for actions/checkout	3d3c42e5aac5ba805825da76410c181273ba90b1declared	7.0.120 Jul 2026	Latest release is 97 days old, past the 14-day window	7.0.120 Jul 2026	unknown	0
Upgrade path unknown Installed3d3c42e5aac5ba805825da76410c181273ba90b1 declared, no lockfile Safe target · latest7.0.120 Jul 2026public for 14+ days Could not tell how far behind this is. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 3d3c42e5aac5ba805825da76410c181273ba90b1. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `3d3c42e5aac5ba805825da76410c181273ba90b1 → 7.0.1` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem github-actions Section tooling Declared 3d3c42e5aac5ba805825da76410c181273ba90b1 Deprecated No
Behind	github-actionstooling · 3a2844b7e9c422d3c10d287c895573f7108da1b3Sign up to research for actions/github-script	3a2844b7e9c422d3c10d287c895573f7108da1b3declared	9.0.09 Apr 2026	Latest release is 199 days old, past the 14-day window	9.0.09 Apr 2026	unknown	0
Upgrade path unknown Installed3a2844b7e9c422d3c10d287c895573f7108da1b3 declared, no lockfile Safe target · latest9.0.09 Apr 2026public for 14+ days Could not tell how far behind this is. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 3a2844b7e9c422d3c10d287c895573f7108da1b3. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `3a2844b7e9c422d3c10d287c895573f7108da1b3 → 9.0.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem github-actions Section tooling Declared 3a2844b7e9c422d3c10d287c895573f7108da1b3 Deprecated No
Behind	github-actionstooling · 820762786026740c76f36085b0efc47a31fe5020Sign up to research for actions/setup-node	820762786026740c76f36085b0efc47a31fe5020declared	7.1.08 Oct 2026	Latest release is 18 days old, past the 14-day window	7.1.08 Oct 2026	unknown	0
Upgrade path unknown Installed820762786026740c76f36085b0efc47a31fe5020 declared, no lockfile Safe target · latest7.1.08 Oct 2026public for 14+ days Could not tell how far behind this is. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 820762786026740c76f36085b0efc47a31fe5020. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `820762786026740c76f36085b0efc47a31fe5020 → 7.1.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem github-actions Section tooling Declared 820762786026740c76f36085b0efc47a31fe5020 Deprecated No
Behind	github-actionstooling · 0977fd99725f1db4007ccb2928dbb4e90d06cc86Sign up to research for pnpm/action-setup	0977fd99725f1db4007ccb2928dbb4e90d06cc86declared	6.1.05 Sep 2026	Latest release is 51 days old, past the 14-day window	6.1.05 Sep 2026	unknown	0
Upgrade path unknown Installed0977fd99725f1db4007ccb2928dbb4e90d06cc86 declared, no lockfile Safe target · latest6.1.05 Sep 2026public for 14+ days Could not tell how far behind this is. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 0977fd99725f1db4007ccb2928dbb4e90d06cc86. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `0977fd99725f1db4007ccb2928dbb4e90d06cc86 → 6.1.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem github-actions Section tooling Declared 0977fd99725f1db4007ccb2928dbb4e90d06cc86 Deprecated No
Behind	npmdevDependencies · ^2.2.0Sign up to research for @biomejs/biome	2.5.6lockfile	2.6.324 Oct 2026	Latest release is only 1 days old, inside the 14-day window	2.5.1530 Sep 2026	patch	0
Upgrade path patch Installed2.5.6 from the lockfile Safe target2.5.1530 Sep 2026public for 14+ days Latest2.6.324 Oct 2026only 1d old, inside the 14-day window A patch behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 2.5.6. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `2.5.6 → 2.5.15` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared ^2.2.0 Deprecated No
Behind	npmdependencies · *Sign up to research for @chat-adapter/github	4.35.0lockfile	4.43.019 Oct 2026	Latest release is only 7 days old, inside the 14-day window	4.41.128 Sep 2026	minor	0
Upgrade path minor Installed4.35.0 from the lockfile Safe target4.41.128 Sep 2026public for 14+ days Latest4.43.019 Oct 2026only 7d old, inside the 14-day window A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 4.35.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `4.35.0 → 4.41.1` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared * Deprecated No
Behind	npmdependencies · *Sign up to research for @chat-adapter/state-memory	4.35.0lockfile	4.43.019 Oct 2026	Latest release is only 7 days old, inside the 14-day window	4.41.128 Sep 2026	minor	0
Upgrade path minor Installed4.35.0 from the lockfile Safe target4.41.128 Sep 2026public for 14+ days Latest4.43.019 Oct 2026only 7d old, inside the 14-day window A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 4.35.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `4.35.0 → 4.41.1` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared * Deprecated No
Behind	npmdependencies · ^0.1.1Sign up to research for @cloudflare/computer	0.1.1lockfile	0.7.023 Oct 2026	Latest release is only 3 days old, inside the 14-day window	0.5.09 Oct 2026	minor	0
Upgrade path minor Installed0.1.1 from the lockfile Safe target0.5.09 Oct 2026public for 14+ days Latest0.7.023 Oct 2026only 3d old, inside the 14-day window A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 0.1.1. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `0.1.1 → 0.5.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared ^0.1.1 Deprecated No
Behind	npmdevDependencies · ^1.39.2Sign up to research for @cloudflare/vite-plugin	1.49.0lockfile	1.65.023 Oct 2026	Latest release is only 3 days old, inside the 14-day window	1.63.18 Oct 2026	minor	0
Upgrade path minor Installed1.49.0 from the lockfile Safe target1.63.18 Oct 2026public for 14+ days Latest1.65.023 Oct 2026only 3d old, inside the 14-day window A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 1.49.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `1.49.0 → 1.63.1` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared ^1.39.2 Deprecated No
Behind	npmdevDependencies · ^5.20260721.1Sign up to research for @cloudflare/workers-types	5.20260731.1lockfile	5.20261026.126 Oct 2026	Latest release is only 0 days old, inside the 14-day window	5.20261012.112 Oct 2026	minor	0
Upgrade path minor Installed5.20260731.1 from the lockfile Safe target5.20261012.112 Oct 2026public for 14+ days Latest5.20261026.126 Oct 2026only 0d old, inside the 14-day window A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 5.20260731.1. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `5.20260731.1 → 5.20261012.1` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared ^5.20260721.1 Deprecated No
Behind	npmdependencies · *Sign up to research for @daytona/sdk	0.202.0lockfile	0.226.123 Oct 2026	Latest release is only 2 days old, inside the 14-day window	0.223.19 Oct 2026	minor	0
Upgrade path minor Installed0.202.0 from the lockfile Safe target0.223.19 Oct 2026public for 14+ days Latest0.226.123 Oct 2026only 2d old, inside the 14-day window A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 0.202.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `0.202.0 → 0.223.1` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared * Deprecated No
Behind	npmdependencies · ^0.2.6Sign up to research for @durable-streams/client	0.2.6lockfile	0.2.710 Sep 2026	Latest release is 45 days old, past the 14-day window	0.2.710 Sep 2026	patch	0
Upgrade path patch Installed0.2.6 from the lockfile Safe target · latest0.2.710 Sep 2026public for 14+ days A patch behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 0.2.6. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `0.2.6 → 0.2.7` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared ^0.2.6 Deprecated No
Behind	npmdevDependencies · ^0.5.4Sign up to research for @electric-sql/pglite	0.5.4lockfile	0.5.1121 Oct 2026	Latest release is only 4 days old, inside the 14-day window	0.5.912 Oct 2026	patch	0
Upgrade path patch Installed0.5.4 from the lockfile Safe target0.5.912 Oct 2026public for 14+ days Latest0.5.1121 Oct 2026only 4d old, inside the 14-day window A patch behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 0.5.4. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `0.5.4 → 0.5.9` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared ^0.5.4 Deprecated No
Behind	npmdependencies · ^2.0.3Sign up to research for @hono/node-server	2.0.12lockfile	2.1.513 Oct 2026	Latest release is only 13 days old, inside the 14-day window	2.1.48 Oct 2026	minor	0
Upgrade path minor Installed2.0.12 from the lockfile Safe target2.1.48 Oct 2026public for 14+ days Latest2.1.513 Oct 2026only 13d old, inside the 14-day window A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 2.0.12. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `2.0.12 → 2.1.4` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared ^2.0.3 Deprecated No
Behind	npmdependencies · *Sign up to research for @kapso/whatsapp-cloud-api	0.2.3lockfile	0.4.023 Oct 2026	Latest release is only 3 days old, inside the 14-day window	0.3.05 Aug 2026	minor	0
Upgrade path minor Installed0.2.3 from the lockfile Safe target0.3.05 Aug 2026public for 14+ days Latest0.4.023 Oct 2026only 3d old, inside the 14-day window A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 0.2.3. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `0.2.3 → 0.3.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared * Deprecated No
Behind	npmdevDependencies · ^0.17.3Sign up to research for @libsql/client	0.17.4lockfile	0.18.02 Sep 2026	Latest release is 54 days old, past the 14-day window	0.18.02 Sep 2026	minor	0
Upgrade path minor Installed0.17.4 from the lockfile Safe target · latest0.18.02 Sep 2026public for 14+ days A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 0.17.4. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `0.17.4 → 0.18.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared ^0.17.3 Deprecated No
Behind	npmdependencies · *Sign up to research for @notionhq/client	5.23.3lockfile	5.28.022 Oct 2026	Latest release is only 3 days old, inside the 14-day window	5.27.029 Sep 2026	minor	0
Upgrade path minor Installed5.23.3 from the lockfile Safe target5.27.029 Sep 2026public for 14+ days Latest5.28.022 Oct 2026only 3d old, inside the 14-day window A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 5.23.3. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `5.23.3 → 5.27.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared * Deprecated No
Behind	npmdevDependencies · ^2.7.1Sign up to research for @opentelemetry/context-async-hooks	2.10.0lockfile	3.0.020 Oct 2026	Latest release is only 5 days old, inside the 14-day window	2.12.06 Oct 2026	minor	0
Upgrade path minor Installed2.10.0 from the lockfile Safe target2.12.06 Oct 2026public for 14+ days Latest3.0.020 Oct 2026only 5d old, inside the 14-day window A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 2.10.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `2.10.0 → 2.12.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared ^2.7.1 Deprecated No
Behind	npmdevDependencies · ^2.7.1Sign up to research for @opentelemetry/core	2.10.0lockfile	3.0.020 Oct 2026	Latest release is only 5 days old, inside the 14-day window	2.12.06 Oct 2026	minor	0
Upgrade path minor Installed2.10.0 from the lockfile Safe target2.12.06 Oct 2026public for 14+ days Latest3.0.020 Oct 2026only 5d old, inside the 14-day window A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 2.10.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `2.10.0 → 2.12.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared ^2.7.1 Deprecated No
Behind	npmdependencies · 0.0.78Sign up to research for @paper-design/shaders	0.0.78lockfile	0.0.8221 Oct 2026	Latest release is only 5 days old, inside the 14-day window	0.0.8117 Sep 2026	patch	0
Upgrade path patch Installed0.0.78 from the lockfile Safe target0.0.8117 Sep 2026public for 14+ days Latest0.0.8221 Oct 2026only 5d old, inside the 14-day window A patch behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 0.0.78. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `0.0.78 → 0.0.81` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared 0.0.78 Deprecated No
Behind	npmdependencies · ^0.4.0Sign up to research for @platformatic/vfs	0.4.0lockfile	0.5.023 Sep 2026	Latest release is 32 days old, past the 14-day window	0.5.023 Sep 2026	minor	0
Upgrade path minor Installed0.4.0 from the lockfile Safe target · latest0.5.023 Sep 2026public for 14+ days A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 0.4.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `0.4.0 → 0.5.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared ^0.4.0 Deprecated No
Behind	npmdependencies · ^0.2.1Sign up to research for @shadcn/react	0.2.1lockfile	0.3.131 Aug 2026	Latest release is 56 days old, past the 14-day window	0.3.131 Aug 2026	minor	0
Upgrade path minor Installed0.2.1 from the lockfile Safe target · latest0.3.131 Aug 2026public for 14+ days A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 0.2.1. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `0.2.1 → 0.3.1` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared ^0.2.1 Deprecated No
Behind	npmdependencies · 3.0.0Sign up to research for @slack/types	3.0.0lockfile	3.2.030 Sep 2026	Latest release is 25 days old, past the 14-day window	3.2.030 Sep 2026	minor	0
Upgrade path minor Installed3.0.0 from the lockfile Safe target · latest3.2.030 Sep 2026public for 14+ days A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 3.0.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `3.0.0 → 3.2.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared 3.0.0 Deprecated No
Behind	npmdependencies · ^8.0.0Sign up to research for @slack/web-api	8.0.0lockfile	8.2.030 Sep 2026	Latest release is 25 days old, past the 14-day window	8.2.030 Sep 2026	minor	0
Upgrade path minor Installed8.0.0 from the lockfile Safe target · latest8.2.030 Sep 2026public for 14+ days A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 8.0.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `8.0.0 → 8.2.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared ^8.0.0 Deprecated No
Behind	npmdependencies · ^4.2.0Sign up to research for @tailwindcss/vite	4.2.2lockfile	4.3.316 Jul 2026	Latest release is 101 days old, past the 14-day window	4.3.316 Jul 2026	minor	0
Upgrade path minor Installed4.2.2 from the lockfile Safe target · latest4.3.316 Jul 2026public for 14+ days A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 4.2.2. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `4.2.2 → 4.3.3` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared ^4.2.0 Deprecated No
Behind	npmdependencies · ^1.135.4Sign up to research for @tanstack/react-router	1.170.18lockfile	1.170.4622 Oct 2026	Latest release is only 3 days old, inside the 14-day window	1.170.4210 Oct 2026	patch	0
Upgrade path patch Installed1.170.18 from the lockfile Safe target1.170.4210 Oct 2026public for 14+ days Latest1.170.4622 Oct 2026only 3d old, inside the 14-day window A patch behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 1.170.18. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `1.170.18 → 1.170.42` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared ^1.135.4 Deprecated No
Behind	npmdevDependencies · ^16.3.0Sign up to research for @testing-library/react	16.3.2lockfile	16.3.327 Aug 2026	Latest release is 59 days old, past the 14-day window	16.3.327 Aug 2026	patch	0
Upgrade path patch Installed16.3.2 from the lockfile Safe target · latest16.3.327 Aug 2026public for 14+ days A patch behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 16.3.2. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `16.3.2 → 16.3.3` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared ^16.3.0 Deprecated No
Behind	npmdevDependencies · ^26.1.1Sign up to research for @types/node	26.1.2lockfile	26.6.59 Oct 2026	Latest release is 16 days old, past the 14-day window	26.6.59 Oct 2026	minor	0
Upgrade path minor Installed26.1.2 from the lockfile Safe target · latest26.6.59 Oct 2026public for 14+ days A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 26.1.2. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `26.1.2 → 26.6.5` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared ^26.1.1 Deprecated No
Behind	npmdevDependencies · ^19.2.17Sign up to research for @types/react	19.2.17lockfile	19.3.09 Sep 2026	Latest release is 46 days old, past the 14-day window	19.3.09 Sep 2026	minor	0
Upgrade path minor Installed19.2.17 from the lockfile Safe target · latest19.3.09 Sep 2026public for 14+ days A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 19.2.17. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `19.2.17 → 19.3.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared ^19.2.17 Deprecated No
Behind	npmdevDependencies · ^19.2.3Sign up to research for @types/react-dom	19.2.3lockfile	19.3.09 Sep 2026	Latest release is 46 days old, past the 14-day window	19.3.09 Sep 2026	minor	0
Upgrade path minor Installed19.2.3 from the lockfile Safe target · latest19.3.09 Sep 2026public for 14+ days A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 19.2.3. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `19.2.3 → 19.3.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared ^19.2.3 Deprecated No
Behind	npmdependencies · ^1.3.0Sign up to research for @valibot/to-json-schema	1.7.1lockfile	1.8.011 Sep 2026	Latest release is 44 days old, past the 14-day window	1.8.011 Sep 2026	minor	0
Upgrade path minor Installed1.7.1 from the lockfile Safe target · latest1.8.011 Sep 2026public for 14+ days A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 1.7.1. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `1.7.1 → 1.8.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared ^1.3.0 Deprecated No
Behind	npmdependencies · ^1.2.3Sign up to research for @vercel/detect-agent	1.2.3lockfile	1.2.713 Oct 2026	Latest release is only 13 days old, inside the 14-day window	1.2.69 Oct 2026	patch	0
Upgrade path patch Installed1.2.3 from the lockfile Safe target1.2.69 Oct 2026public for 14+ days Latest1.2.713 Oct 2026only 13d old, inside the 14-day window A patch behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 1.2.3. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `1.2.3 → 1.2.6` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared ^1.2.3 Deprecated No
Behind	npmdevDependencies · ^6.0.2Sign up to research for @vitejs/plugin-react	6.0.4lockfile	6.1.25 Oct 2026	Latest release is 21 days old, past the 14-day window	6.1.25 Oct 2026	minor	0
Upgrade path minor Installed6.0.4 from the lockfile Safe target · latest6.1.25 Oct 2026public for 14+ days A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 6.0.4. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `6.0.4 → 6.1.2` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared ^6.0.2 Deprecated No
Behind	npmdependencies · ^0.20.1Sign up to research for agents	0.20.1lockfile	0.30.123 Oct 2026	Latest release is only 2 days old, inside the 14-day window	0.28.09 Oct 2026	minor	0
Upgrade path minor Installed0.20.1 from the lockfile Safe target0.28.09 Oct 2026public for 14+ days Latest0.30.123 Oct 2026only 2d old, inside the 14-day window A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 0.20.1. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `0.20.1 → 0.28.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared ^0.20.1 Deprecated No
Behind	npmdependencies · 3.25.0Sign up to research for braintrust	3.25.0lockfile	3.39.021 Oct 2026	Latest release is only 4 days old, inside the 14-day window	3.37.29 Oct 2026	minor	0
Upgrade path minor Installed3.25.0 from the lockfile Safe target3.37.29 Oct 2026public for 14+ days Latest3.39.021 Oct 2026only 4d old, inside the 14-day window A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 3.25.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `3.25.0 → 3.37.2` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared 3.25.0 Deprecated No
Behind	npmdependencies · ^7.0.0Sign up to research for cac	7.0.0lockfile	7.1.011 Oct 2026	Latest release is 14 days old, past the 14-day window	7.1.011 Oct 2026	minor	0
Upgrade path minor Installed7.0.0 from the lockfile Safe target · latest7.1.011 Oct 2026public for 14+ days A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 7.0.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `7.0.0 → 7.1.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared ^7.0.0 Deprecated No
Behind	npmdependencies · *Sign up to research for chat	4.35.0lockfile	4.43.019 Oct 2026	Latest release is only 7 days old, inside the 14-day window	4.41.128 Sep 2026	minor	0
Upgrade path minor Installed4.35.0 from the lockfile Safe target4.41.128 Sep 2026public for 14+ days Latest4.43.019 Oct 2026only 7d old, inside the 14-day window A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 4.35.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `4.35.0 → 4.41.1` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared * Deprecated No
Behind	npmdependencies · 0.38.52Sign up to research for discord-api-types	0.38.52lockfile	0.38.5719 Oct 2026	Latest release is only 6 days old, inside the 14-day window	0.38.5628 Sep 2026	patch	0
Upgrade path patch Installed0.38.52 from the lockfile Safe target0.38.5628 Sep 2026public for 14+ days Latest0.38.5719 Oct 2026only 6d old, inside the 14-day window A patch behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 0.38.52. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `0.38.52 → 0.38.56` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared 0.38.52 Deprecated No
Behind	npmdependencies · *Sign up to research for grammy	1.45.1lockfile	1.46.026 Aug 2026	Latest release is 60 days old, past the 14-day window	1.46.026 Aug 2026	minor	0
Upgrade path minor Installed1.45.1 from the lockfile Safe target · latest1.46.026 Aug 2026public for 14+ days A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 1.45.1. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `1.45.1 → 1.46.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared * Deprecated No
Behind	npmdependencies · *Sign up to research for jose	6.2.5lockfile	6.2.1320 Oct 2026	Latest release is only 6 days old, inside the 14-day window	6.2.125 Sep 2026	patch	0
Upgrade path patch Installed6.2.5 from the lockfile Safe target6.2.125 Sep 2026public for 14+ days Latest6.2.1320 Oct 2026only 6d old, inside the 14-day window A patch behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 6.2.5. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `6.2.5 → 6.2.12` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared * Deprecated No
Behind	npmdependencies · ^3.0.1Sign up to research for just-bash	3.2.0lockfile	3.6.01 Oct 2026	Latest release is 24 days old, past the 14-day window	3.6.01 Oct 2026	minor	0
Upgrade path minor Installed3.2.0 from the lockfile Safe target · latest3.6.01 Oct 2026public for 14+ days A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 3.2.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `3.2.0 → 3.6.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared ^3.0.1 Deprecated No
Behind	npmdevDependencies · ^6.14.2Sign up to research for knip	6.29.0lockfile	6.43.024 Oct 2026	Latest release is only 2 days old, inside the 14-day window	6.41.09 Oct 2026	minor	0
Upgrade path minor Installed6.29.0 from the lockfile Safe target6.41.09 Oct 2026public for 14+ days Latest6.43.024 Oct 2026only 2d old, inside the 14-day window A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 6.29.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `6.29.0 → 6.41.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared ^6.14.2 Deprecated No
Behind	npmdependencies · *Sign up to research for lossless-json	4.3.0lockfile	4.3.321 Oct 2026	Latest release is only 5 days old, inside the 14-day window	4.3.131 Jul 2026	patch	0
Upgrade path patch Installed4.3.0 from the lockfile Safe target4.3.131 Jul 2026public for 14+ days Latest4.3.321 Oct 2026only 5d old, inside the 14-day window A patch behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 4.3.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `4.3.0 → 4.3.1` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared * Deprecated No
Behind	npmdependencies · ^1.21.0Sign up to research for lucide-react	1.27.0lockfile	1.61.021 Oct 2026	Latest release is only 5 days old, inside the 14-day window	1.55.010 Oct 2026	minor	0
Upgrade path minor Installed1.27.0 from the lockfile Safe target1.55.010 Oct 2026public for 14+ days Latest1.61.021 Oct 2026only 5d old, inside the 14-day window A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 1.27.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `1.27.0 → 1.55.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared ^1.21.0 Deprecated No
Behind	npmdependencies · ^1.0.0Sign up to research for magic-string	1.1.0lockfile	1.4.426 Oct 2026	Latest release is only 0 days old, inside the 14-day window	1.4.35 Oct 2026	minor	0
Upgrade path minor Installed1.1.0 from the lockfile Safe target1.4.35 Oct 2026public for 14+ days Latest1.4.426 Oct 2026only 0d old, inside the 14-day window A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 1.1.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `1.1.0 → 1.4.3` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared ^1.0.0 Deprecated No
Behind	npmdevDependencies · ^7.5.0Sign up to research for mongodb	7.5.0lockfile	7.7.028 Sep 2026	Latest release is 27 days old, past the 14-day window	7.7.028 Sep 2026	minor	0
Upgrade path minor Installed7.5.0 from the lockfile Safe target · latest7.7.028 Sep 2026public for 14+ days A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 7.5.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `7.5.0 → 7.7.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared ^7.5.0 Deprecated No
Behind	npmdevDependencies · ^3.22.5Sign up to research for mysql2	3.23.2lockfile	3.24.613 Oct 2026	Latest release is only 12 days old, inside the 14-day window	3.24.529 Sep 2026	minor	0
Upgrade path minor Installed3.23.2 from the lockfile Safe target3.24.529 Sep 2026public for 14+ days Latest3.24.613 Oct 2026only 12d old, inside the 14-day window A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 3.23.2. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `3.23.2 → 3.24.5` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared ^3.22.5 Deprecated No
Behind	npmdevDependencies · ^1.69.0Sign up to research for oxlint	1.76.0lockfile	1.89.019 Oct 2026	Latest release is only 6 days old, inside the 14-day window	1.87.05 Oct 2026	minor	0
Upgrade path minor Installed1.76.0 from the lockfile Safe target1.87.05 Oct 2026public for 14+ days Latest1.89.019 Oct 2026only 6d old, inside the 14-day window A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 1.76.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `1.76.0 → 1.87.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared ^1.69.0 Deprecated No
Behind	npmdevDependencies · ^3.4.2Sign up to research for prettier	3.9.6lockfile	3.9.1010 Oct 2026	Latest release is 16 days old, past the 14-day window	3.9.1010 Oct 2026	patch	0
Upgrade path patch Installed3.9.6 from the lockfile Safe target · latest3.9.1010 Oct 2026public for 14+ days A patch behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 3.9.6. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `3.9.6 → 3.9.10` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared ^3.4.2 Deprecated No
Behind	npmdependencies · ^1.6.0Sign up to research for radix-ui	1.6.7lockfile	1.8.112 Oct 2026	Latest release is only 13 days old, inside the 14-day window	1.8.012 Oct 2026	minor	0
Upgrade path minor Installed1.6.7 from the lockfile Safe target1.8.012 Oct 2026public for 14+ days Latest1.8.112 Oct 2026only 13d old, inside the 14-day window A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 1.6.7. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `1.6.7 → 1.8.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared ^1.6.0 Deprecated No
Behind	npmdependencies · ^19.2.7Sign up to research for react	19.2.8lockfile	19.3.114 Oct 2026	Latest release is only 11 days old, inside the 14-day window	19.3.09 Sep 2026	minor	0
Upgrade path minor Installed19.2.8 from the lockfile Safe target19.3.09 Sep 2026public for 14+ days Latest19.3.114 Oct 2026only 11d old, inside the 14-day window A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 19.2.8. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `19.2.8 → 19.3.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared ^19.2.7 Deprecated No
Behind	npmdependencies · ^19.2.7Sign up to research for react-dom	19.2.8lockfile	19.3.114 Oct 2026	Latest release is only 11 days old, inside the 14-day window	19.3.09 Sep 2026	minor	0
Upgrade path minor Installed19.2.8 from the lockfile Safe target19.3.09 Sep 2026public for 14+ days Latest19.3.114 Oct 2026only 11d old, inside the 14-day window A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 19.2.8. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `19.2.8 → 19.3.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared ^19.2.7 Deprecated No
Behind	npmdevDependencies · ^6.1.0Sign up to research for redis	6.1.0lockfile	6.3.030 Sep 2026	Latest release is 25 days old, past the 14-day window	6.3.030 Sep 2026	minor	0
Upgrade path minor Installed6.1.0 from the lockfile Safe target · latest6.3.030 Sep 2026public for 14+ days A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 6.1.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `6.1.0 → 6.3.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared ^6.1.0 Deprecated No
Behind	npmdependencies · *Sign up to research for resend	6.18.1lockfile	6.34.116 Oct 2026	Latest release is only 9 days old, inside the 14-day window	6.32.16 Oct 2026	minor	0
Upgrade path minor Installed6.18.1 from the lockfile Safe target6.32.16 Oct 2026public for 14+ days Latest6.34.116 Oct 2026only 9d old, inside the 14-day window A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 6.18.1. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `6.18.1 → 6.32.1` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared * Deprecated No
Behind	npmdependencies · ^2.0.7Sign up to research for sonner	2.0.7lockfile	2.0.89 Aug 2026	Latest release is 78 days old, past the 14-day window	2.0.89 Aug 2026	patch	0
Upgrade path patch Installed2.0.7 from the lockfile Safe target · latest2.0.89 Aug 2026public for 14+ days A patch behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 2.0.7. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `2.0.7 → 2.0.8` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared ^2.0.7 Deprecated No
Behind	npmdependencies · ^2.5.0Sign up to research for streamdown	2.5.0lockfile	2.7.119 Oct 2026	Latest release is only 7 days old, inside the 14-day window	2.7.030 Sep 2026	minor	0
Upgrade path minor Installed2.5.0 from the lockfile Safe target2.7.030 Sep 2026public for 14+ days Latest2.7.119 Oct 2026only 7d old, inside the 14-day window A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 2.5.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `2.5.0 → 2.7.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared ^2.5.0 Deprecated No
Behind	npmdependencies · ^3.6.0Sign up to research for tailwind-merge	3.6.0lockfile	3.7.012 Sep 2026	Latest release is 43 days old, past the 14-day window	3.7.012 Sep 2026	minor	0
Upgrade path minor Installed3.6.0 from the lockfile Safe target · latest3.7.012 Sep 2026public for 14+ days A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 3.6.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `3.6.0 → 3.7.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared ^3.6.0 Deprecated No
Behind	npmdependencies · ^4.2.0Sign up to research for tailwindcss	4.2.2lockfile	4.3.316 Jul 2026	Latest release is 101 days old, past the 14-day window	4.3.316 Jul 2026	minor	0
Upgrade path minor Installed4.2.2 from the lockfile Safe target · latest4.3.316 Jul 2026public for 14+ days A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 4.2.2. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `4.2.2 → 4.3.3` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared ^4.2.0 Deprecated No
Behind	npmdevDependencies · ^0.22.7Sign up to research for tsdown	0.22.14lockfile	0.23.223 Oct 2026	Latest release is only 2 days old, inside the 14-day window	0.23.110 Oct 2026	minor	0
Upgrade path minor Installed0.22.14 from the lockfile Safe target0.23.110 Oct 2026public for 14+ days Latest0.23.223 Oct 2026only 2d old, inside the 14-day window A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 0.22.14. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `0.22.14 → 0.23.1` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared ^0.22.7 Deprecated No
Behind	npmdevDependencies · ^4.19.2Sign up to research for tsx	4.23.1lockfile	4.23.1520 Sep 2026	Latest release is 36 days old, past the 14-day window	4.23.1520 Sep 2026	patch	0
Upgrade path patch Installed4.23.1 from the lockfile Safe target · latest4.23.1520 Sep 2026public for 14+ days A patch behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 4.23.1. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `4.23.1 → 4.23.15` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared ^4.19.2 Deprecated No
Behind	npmdevDependencies · ^2.3.3Sign up to research for turbo	2.10.7lockfile	2.11.1020 Oct 2026	Latest release is only 5 days old, inside the 14-day window	2.11.72 Oct 2026	minor	0
Upgrade path minor Installed2.10.7 from the lockfile Safe target2.11.72 Oct 2026public for 14+ days Latest2.11.1020 Oct 2026only 5d old, inside the 14-day window A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 2.10.7. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `2.10.7 → 2.11.7` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared ^2.3.3 Deprecated No
Behind	npmdevDependencies · 6.0.2Sign up to research for twilio	6.0.2lockfile	6.2.012 Oct 2026	Latest release is only 13 days old, inside the 14-day window	6.1.228 Sep 2026	minor	0
Upgrade path minor Installed6.0.2 from the lockfile Safe target6.1.228 Sep 2026public for 14+ days Latest6.2.012 Oct 2026only 13d old, inside the 14-day window A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 6.0.2. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `6.0.2 → 6.1.2` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared 6.0.2 Deprecated No
Behind	npmdependencies · ^1.0.0Sign up to research for valibot	1.4.2lockfile	1.5.09 Sep 2026	Latest release is 46 days old, past the 14-day window	1.5.09 Sep 2026	minor	0
Upgrade path minor Installed1.4.2 from the lockfile Safe target · latest1.5.09 Sep 2026public for 14+ days A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 1.4.2. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `1.4.2 → 1.5.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section dependencies Declared ^1.0.0 Deprecated No
Behind	npmdevDependencies · ^0.15.0Sign up to research for vitest-evals	0.15.0lockfile	0.17.010 Sep 2026	Latest release is 45 days old, past the 14-day window	0.17.010 Sep 2026	minor	0
Upgrade path minor Installed0.15.0 from the lockfile Safe target · latest0.17.010 Sep 2026public for 14+ days A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 0.15.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `0.15.0 → 0.17.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared ^0.15.0 Deprecated No
Behind	npmdevDependencies · ^4.113.0Sign up to research for wrangler	4.116.0lockfile	4.152.022 Oct 2026	Latest release is only 3 days old, inside the 14-day window	4.149.08 Oct 2026	minor	0
Upgrade path minor Installed4.116.0 from the lockfile Safe target4.149.08 Oct 2026public for 14+ days Latest4.152.022 Oct 2026only 3d old, inside the 14-day window A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 4.116.0. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `4.116.0 → 4.149.0` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem npm Section devDependencies Declared ^4.113.0 Deprecated No
Behind	runtimetooling · >=22Sign up to research for node	22declared	26.12.121 Oct 2026	Latest release is only 5 days old, inside the 14-day window	22.23.323 Sep 2026	minor	0
Upgrade path minor Installed22 declared, no lockfile Safe target22.23.323 Sep 2026public for 14+ days Latest26.12.121 Oct 2026only 5d old, inside the 14-day window A minor release behind the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 22. Checked against OSV. Research not included on this scan Breaking changes, the work involved and the new features between `22 → 22.23.3` are researched for the top 3 tickets on a free scan. Create a free account to pick which tickets get researched. Sign up to research this upgrade Already have an account? Sign in Ecosystem runtime Section tooling Declared >=22 Deprecated No
Current	npmdependencies · *	2.6.3lockfile	2.6.319 Jul 2026	Latest release is 98 days old, past the 14-day window	2.6.319 Jul 2026	current	0
Upgrade path current Installed2.6.3 from the lockfile Safe target · latest2.6.319 Jul 2026public for 14+ days Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 2.6.3. Checked against OSV. Nothing to research: @discordjs/rest is at its safe target with no known advisories. Ecosystem npm Section dependencies Declared * Deprecated No
Current	npmdependencies · ^1.1.0	1.1.0lockfile	1.4.021 Oct 2026	Latest release is only 4 days old, inside the 14-day window	1.1.07 Oct 2026	current	0
Upgrade path current Installed1.1.0 from the lockfile Safe target1.1.07 Oct 2026public for 14+ days Latest1.4.021 Oct 2026only 4d old, inside the 14-day window Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 1.1.0. Checked against OSV. Nothing to research: @earendil-works/pi-agent-core is at its safe target with no known advisories. Ecosystem npm Section dependencies Declared ^1.1.0 Deprecated No
Current	npmdependencies · ^1.1.0	1.1.0declared	1.4.021 Oct 2026	Latest release is only 4 days old, inside the 14-day window	1.1.07 Oct 2026	current	0
Upgrade path current Installed1.1.0 declared, no lockfile Safe target1.1.07 Oct 2026public for 14+ days Latest1.4.021 Oct 2026only 4d old, inside the 14-day window Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 1.1.0. Checked against OSV. Nothing to research: @earendil-works/pi-ai is at its safe target with no known advisories. Ecosystem npm Section dependencies Declared ^1.1.0 Deprecated No
Current	npmdependencies · *	22.0.1lockfile	22.0.131 Oct 2025	Latest release is 359 days old, past the 14-day window	22.0.131 Oct 2025	current	0
Upgrade path current Installed22.0.1 from the lockfile Safe target · latest22.0.131 Oct 2025public for 14+ days Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 22.0.1. Checked against OSV. Nothing to research: @octokit/rest is at its safe target with no known advisories. Ecosystem npm Section dependencies Declared * Deprecated No
Current	npmdependencies · ^1.9.0	1.9.1lockfile	1.10.020 Oct 2026	Latest release is only 5 days old, inside the 14-day window	1.9.125 Mar 2026	current	0
Upgrade path current Installed1.9.1 from the lockfile Safe target1.9.125 Mar 2026public for 14+ days Latest1.10.020 Oct 2026only 5d old, inside the 14-day window Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 1.9.1. Checked against OSV. Nothing to research: @opentelemetry/api is at its safe target with no known advisories. Ecosystem npm Section dependencies Declared ^1.9.0 Deprecated No
Current	npmdevDependencies · ^2.4.9	2.4.9lockfile	2.4.921 Nov 2023	Latest release is 1070 days old, past the 14-day window	2.4.921 Nov 2023	current	0
Upgrade path current Installed2.4.9 from the lockfile Safe target · latest2.4.921 Nov 2023public for 14+ days Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 2.4.9. Checked against OSV. Nothing to research: @types/prompts is at its safe target with no known advisories. Ecosystem npm Section devDependencies Declared ^2.4.9 Deprecated No
Current	npmdependencies · 5.0.1	5.0.1lockfile	5.0.128 May 2026	Latest release is 150 days old, past the 14-day window	5.0.128 May 2026	current	0
Upgrade path current Installed5.0.1 from the lockfile Safe target · latest5.0.128 May 2026public for 14+ days Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 5.0.1. Checked against OSV. Nothing to research: @whatsapp-cloudapi/types is at its safe target with no known advisories. Ecosystem npm Section dependencies Declared 5.0.1 Deprecated No
Current	npmdevDependencies · ^0.3.0	0.3.0lockfile	0.3.011 Mar 2026	Latest release is 228 days old, past the 14-day window	0.3.011 Mar 2026	current	0
Upgrade path current Installed0.3.0 from the lockfile Safe target · latest0.3.011 Mar 2026public for 14+ days Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 0.3.0. Checked against OSV. Nothing to research: bgproc is at its safe target with no known advisories. Ecosystem npm Section devDependencies Declared ^0.3.0 Deprecated No
Current	npmdependencies · 4.23.3	4.23.3lockfile	4.23.327 Aug 2025	Latest release is 424 days old, past the 14-day window	4.23.327 Aug 2025	current	0
Upgrade path current Installed4.23.3 from the lockfile Safe target · latest4.23.327 Aug 2025public for 14+ days Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 4.23.3. Checked against OSV. Nothing to research: botframework-schema is at its safe target with no known advisories. Ecosystem npm Section dependencies Declared 4.23.3 Deprecated No
Current	npmdependencies · ^0.7.1	0.7.1lockfile	0.7.126 Nov 2024	Latest release is 699 days old, past the 14-day window	0.7.126 Nov 2024	current	0
Upgrade path current Installed0.7.1 from the lockfile Safe target · latest0.7.126 Nov 2024public for 14+ days Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 0.7.1. Checked against OSV. Nothing to research: class-variance-authority is at its safe target with no known advisories. Ecosystem npm Section dependencies Declared ^0.7.1 Deprecated No
Current	npmdependencies · ^2.1.1	2.1.1lockfile	2.1.123 Apr 2024	Latest release is 916 days old, past the 14-day window	2.1.123 Apr 2024	current	0
Upgrade path current Installed2.1.1 from the lockfile Safe target · latest2.1.123 Apr 2024public for 14+ days Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 2.1.1. Checked against OSV. Nothing to research: clsx is at its safe target with no known advisories. Ecosystem npm Section dependencies Declared ^2.1.1 Deprecated No
Current	npmdependencies · ^10.0.1	10.0.1lockfile	10.0.11 Feb 2026	Latest release is 266 days old, past the 14-day window	10.0.11 Feb 2026	current	0
Upgrade path current Installed10.0.1 from the lockfile Safe target · latest10.0.11 Feb 2026public for 14+ days Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 10.0.1. Checked against OSV. Nothing to research: croner is at its safe target with no known advisories. Ecosystem npm Section dependencies Declared ^10.0.1 Deprecated No
Current	npmdependencies · *	7.0.3lockfile	7.0.32 Feb 2026	Latest release is 265 days old, past the 14-day window	7.0.32 Feb 2026	current	0
Upgrade path current Installed7.0.3 from the lockfile Safe target · latest7.0.32 Feb 2026public for 14+ days Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 7.0.3. Checked against OSV. Nothing to research: intercom-client is at its safe target with no known advisories. Ecosystem npm Section dependencies Declared * Deprecated No
Current	npmdependencies · ^7.2.0	7.2.0lockfile	7.2.016 Sep 2025	Latest release is 404 days old, past the 14-day window	7.2.016 Sep 2025	current	0
Upgrade path current Installed7.2.0 from the lockfile Safe target · latest7.2.016 Sep 2025public for 14+ days Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 7.2.0. Checked against OSV. Nothing to research: minisearch is at its safe target with no known advisories. Ecosystem npm Section dependencies Declared ^7.2.0 Deprecated No
Current	npmdependencies · ^0.4.6	0.4.6lockfile	0.4.611 Mar 2025	Latest release is 593 days old, past the 14-day window	0.4.611 Mar 2025	current	0
Upgrade path current Installed0.4.6 from the lockfile Safe target · latest0.4.611 Mar 2025public for 14+ days Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 0.4.6. Checked against OSV. Nothing to research: next-themes is at its safe target with no known advisories. Ecosystem npm Section dependencies Declared ^0.4.6 Deprecated No
Current	npmdevDependencies · ^1.5.2	1.5.2lockfile	1.5.212 Apr 2026	Latest release is 196 days old, past the 14-day window	1.5.212 Apr 2026	current	0
Upgrade path current Installed1.5.2 from the lockfile Safe target · latest1.5.212 Apr 2026public for 14+ days Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 1.5.2. Checked against OSV. Nothing to research: pagefind is at its safe target with no known advisories. Ecosystem npm Section devDependencies Declared ^1.5.2 Deprecated No
Current	npmdependencies · ^1.1.1	1.1.1lockfile	1.1.116 Oct 2024	Latest release is 739 days old, past the 14-day window	1.1.116 Oct 2024	current	0
Upgrade path current Installed1.1.1 from the lockfile Safe target · latest1.1.116 Oct 2024public for 14+ days Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 1.1.1. Checked against OSV. Nothing to research: picocolors is at its safe target with no known advisories. Ecosystem npm Section dependencies Declared ^1.1.1 Deprecated No
Current	npmdependencies · ^2.4.2	2.4.2lockfile	2.4.27 Oct 2021	Latest release is 1844 days old, past the 14-day window	2.4.27 Oct 2021	current	0
Upgrade path current Installed2.4.2 from the lockfile Safe target · latest2.4.27 Oct 2021public for 14+ days Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 2.4.2. Checked against OSV. Nothing to research: prompts is at its safe target with no known advisories. Ecosystem npm Section dependencies Declared ^2.4.2 Deprecated No
Current	npmdependencies · ^0.2.15	0.2.17lockfile	0.2.1730 May 2026	Latest release is 148 days old, past the 14-day window	0.2.1730 May 2026	current	0
Upgrade path current Installed0.2.17 from the lockfile Safe target · latest0.2.1730 May 2026public for 14+ days Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 0.2.17. Checked against OSV. Nothing to research: tinyglobby is at its safe target with no known advisories. Ecosystem npm Section dependencies Declared ^0.2.15 Deprecated No
Current	npmdevDependencies · ^1.4.0	1.4.0lockfile	1.4.024 Sep 2025	Latest release is 397 days old, past the 14-day window	1.4.024 Sep 2025	current	0
Upgrade path current Installed1.4.0 from the lockfile Safe target · latest1.4.024 Sep 2025public for 14+ days Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 1.4.0. Checked against OSV. Nothing to research: tw-animate-css is at its safe target with no known advisories. Ecosystem npm Section devDependencies Declared ^1.4.0 Deprecated No
Current	npmdependencies · ^2.4.1	2.4.1lockfile	2.4.125 Aug 2024	Latest release is 791 days old, past the 14-day window	2.4.125 Aug 2024	current	0
Upgrade path current Installed2.4.1 from the lockfile Safe target · latest2.4.125 Aug 2024public for 14+ days Already at the safe target. The safe target is the newest stable release public for at least 14 days. Advisories 0 No known advisories for 2.4.1. Checked against OSV. Nothing to research: ulidx is at its safe target with no known advisories. Ecosystem npm Section dependencies Declared ^2.4.1 Deprecated No

Show top10

03 · Tickets

35 tickets, in the order to do them

Each one is a complete brief your coding agent can execute. A ticket only turns green when a rescan proves the lockfile moved.

What is in a ticket

P0tooling
TDB-0001L1 tooling
Tooling: upgrade pnpm 11.1.1 → 12.12.1
pnpm11.1.112.12.1
Upgrade the pnpm tooling pin in withastro/flue 11.1.1 → 12.12.1. Tooling goes first: every other lane waits for this lane.
- The manifest pins pnpm at exactly 12.12.1 — no ^, ~ or range.
- The lockfile is regenerated with the project's package manager, resolves pnpm to the target, and nothing newer than the target slipped in.
- A clean install from the lockfile succeeds: pnpm install --frozen-lockfile, npm ci, yarn install --immutable or bun install --frozen-lockfile (whichever matches the lockfile).
- Tests, lint, typecheck and build all pass, and your report contains their real output.
- No API that the release notes mark as removed remains in the code.
- A rescan of your branch shows no advisories for this package.
- No test was deleted, skipped or loosened; every changed test is listed in changed_tests with a reason.
P0cve
TDB-0005L2 @modelcontextprotocol
Fix 2 advisories in @modelcontextprotocol/client: 2.0.0 → 2.3.1
@modelcontextprotocol/client2.0.02.3.1
@modelcontextprotocol/client 2.0.0 in withastro/flue has 2 known advisories (1 moderate, 1 high). Upgrade 2.0.0 → 2.3.1 so the installed version is no longer affected.
- The manifest pins @modelcontextprotocol/client at exactly 2.3.1 — no ^, ~ or range.
- The lockfile is regenerated with the project's package manager, resolves @modelcontextprotocol/client to the target, and nothing newer than the target slipped in.
- A clean install from the lockfile succeeds: pnpm install --frozen-lockfile, npm ci, yarn install --immutable or bun install --frozen-lockfile (whichever matches the lockfile).
- Tests, lint, typecheck and build all pass, and your report contains their real output.
- No API that the release notes mark as removed remains in the code.
- A rescan of your branch shows no advisories for this package.
- No test was deleted, skipped or loosened; every changed test is listed in changed_tests with a reason.
after TDB-0004
P0cve
TDB-0006L2 @modelcontextprotocol
Fix 3 advisories in @modelcontextprotocol/server: 2.0.0 → 2.3.1
@modelcontextprotocol/server2.0.02.3.1
@modelcontextprotocol/server 2.0.0 in withastro/flue has 3 known advisories (2 high, 1 moderate). Upgrade 2.0.0 → 2.3.1 so the installed version is no longer affected.
- The manifest pins @modelcontextprotocol/server at exactly 2.3.1 — no ^, ~ or range.
- The lockfile is regenerated with the project's package manager, resolves @modelcontextprotocol/server to the target, and nothing newer than the target slipped in.
- A clean install from the lockfile succeeds: pnpm install --frozen-lockfile, npm ci, yarn install --immutable or bun install --frozen-lockfile (whichever matches the lockfile).
- Tests, lint, typecheck and build all pass, and your report contains their real output.
- No API that the release notes mark as removed remains in the code.
- A rescan of your branch shows no advisories for this package.
- No test was deleted, skipped or loosened; every changed test is listed in changed_tests with a reason.
after TDB-0005

32 more tickets in this queue

See all 35 tickets

Free, no card needed

04 · Questions

About withastro/flue's dependencies

Does withastro/flue have known vulnerabilities?

Yes. The latest scan found 50 known advisories across 9 packages, 19 rated critical or high. Advisories come from OSV and are matched against the installed versions in the lockfile.

How outdated are withastro/flue’s dependencies?

79 of its packages are behind the safe target (the newest stable release that has been public for at least 14 days). 11 packages are a whole major version behind. The tech-debt free score is 0/100. 100 means no dependency debt; below zero means the debt outweighs the whole scale.

Which package ecosystems does withastro/flue use?

npm, github-actions and runtime (107 packages in the manifests and lockfiles pinwise read).

When was withastro/flue last scanned?

26 Oct 2026. Public repo pages are re-scanned about once a week, and anyone can request a fresh scan from the free scanner.

05 · Share

Share this report

Public repos only. This page is permanent and re-scanned about once a week.

README badge

Shows the live score and links back here.

README.md

[![pinwise.dev debt-free score](https://pinwise.dev/badge/01M5VXZEH99T9WRRYJBN9VBZ80.svg)](https://pinwise.dev/scan/github/withastro/flue)

For maintainers

Is this your repo?

Claim withastro/flue to turn this report into a working plan, or decide whether this public page stays up.

Watch itWeekly re-scans and a nudge when a fix lands or a CVE appears.
TicketsEvery finding as a ready-to-ship ticket your coding agent can close.
Private scansScan branches and private repos inside your workspace.
BadgeA live debt-free score badge for your README.

Only the repo's owner can claim or change this page. We verify through your GitHub login, a connected workspace or the GitHub App installation, never a form.

Search visibility and removal

Pinwise scans public repositories from their manifests and lockfiles only. If you own withastro/flue, you can keep this page out of search engines or remove it. Private scans inside the app are not affected.

Tech-debt free score

How we got −31

Summary

@astrojs/mdx 7.0.5 → 8.0.3

@cloudflare/sandbox 0.12.4 → 1.0.0

@cloudflare/vitest-pool-workers 0.19.1 → 0.23.0

@grammyjs/types 4.0.0 → 5.0.0

@linear/sdk 88.3.0 → 97.1.0

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan

Research not included on this scan