# yedir-ai Dependency Risk Register

Last local audit snapshot: 2026-05-27.

This register tracks dependency security debt that cannot safely be fixed as an incidental change. It exists so commercial delivery and open-source review do not rely on hidden tribal knowledge.

## Audit Command

Use the official npm registry for audit checks:

```bash
pnpm audit:security
pnpm audit:security:json
pnpm --silent audit:security:json > audit-security.json
```

The explicit registry is intentional. Some mirrors do not implement the npm audit endpoint, which makes audit fail for infrastructure reasons rather than project reasons.
Use `pnpm --silent audit:security:json` when another script needs machine-readable JSON without pnpm's script header.

## Current Snapshot

`pnpm --silent audit:security:json` currently reports:

- Critical: 0 advisories.
- High: 2 advisories.
- Moderate: 44 advisories.
- Low: 1 advisory.

The previous local baseline was Critical: 2 / High: 31. The first remediation batch upgraded direct dependencies and patched transitive packages via `pnpm.overrides`.

## Priority Remediation Buckets

- `xlsx`: two high advisories remain, and npm audit reports no patched version. Plan a replacement or isolation strategy rather than pretending a patch exists.
- `next`: remediated by resolving Next.js to `16.2.6`; keep route smoke tests in the verification path.
- `fast-xml-parser`: remediated through a transitive override resolving to `5.8.0`.
- `protobufjs`: remediated through a transitive override resolving to `7.5.6`.
- `drizzle-orm`: remediated by upgrading to `0.45.2`; keep migration and route checks in future data-access changes.
- `@vercel/blob` / `undici`: remediated through a transitive override resolving `undici` to a patched 6.x line.
- `ultracite` transitive dev tooling chain: remediated through targeted transitive overrides for Vite/Rollup/Picomatch/tRPC/Lodash.

## Release Policy

- Do not add `pnpm audit:security` to `pnpm check:quality` until the remaining `xlsx` advisories are removed or explicitly accepted with compensating controls.
- New direct dependencies should be checked with `pnpm audit:security` before merging.
- Critical advisories in runtime dependencies should block production release unless they are proven unreachable and documented here.
- High advisories should have either a remediation PR or an explicit risk acceptance note before commercial deployment.

## Verification After Remediation

After each dependency remediation batch:

```bash
pnpm install --frozen-lockfile
pnpm check:quality
pnpm audit:security
AUTH_TRUST_HOST=true PORT=3001 pnpm dev
SMOKE_BASE_URL=http://127.0.0.1:3001 pnpm smoke:routes
```

Record the remaining critical/high count in this file until the audit baseline reaches zero or only accepted exceptions remain.