yedir-ai Dependency Risk Register

Last local audit snapshot: 2026-05-27.

This register tracks dependency security debt that cannot safely be fixed as an incidental change. It exists so commercial delivery and open-source review do not rely on hidden tribal knowledge.

Audit Command

Use the official npm registry for audit checks:

pnpm audit:security
pnpm audit:security:json
pnpm --silent audit:security:json > audit-security.json

The explicit registry is intentional. Some mirrors do not implement the npm audit endpoint, which makes audit fail for infrastructure reasons rather than project reasons. Use pnpm --silent audit:security:json when another script needs machine-readable JSON without pnpm's script header.

GitHub Actions also runs .github/workflows/dependency-audit.yml on push, pull request, weekly schedule and manual dispatch. Keep that workflow independent from the fast quality gate so registry or network issues do not hide lint/typecheck feedback.

Current Snapshot

pnpm --silent audit:security:json currently reports:

Critical: 0 advisories.
High: 0 advisories.
Moderate: 44 advisories.
Low: 1 advisory.

The previous local baseline was Critical: 2 / High: 31. The remediation batches upgraded direct dependencies, patched transitive packages via pnpm.overrides, and removed the vulnerable xlsx parser dependency.

Priority Remediation Buckets

xlsx: remediated by replacing spreadsheet import parsing with the existing exceljs dependency and dropping legacy .xls upload support from affected import paths.
next: remediated by resolving Next.js to 16.2.6; keep route smoke tests in the verification path.
fast-xml-parser: remediated through a transitive override resolving to 5.8.0.
protobufjs: remediated through a transitive override resolving to 7.5.6.
drizzle-orm: remediated by upgrading to 0.45.2; keep migration and route checks in future data-access changes.
@vercel/blob / undici: remediated through a transitive override resolving undici to a patched 6.x line.
ultracite transitive dev tooling chain: remediated through targeted transitive overrides for Vite/Rollup/Picomatch/tRPC/Lodash.

Release Policy

Keep pnpm audit:security in the independent Dependency Audit workflow and as a pre-release review command rather than embedding it in pnpm check:quality; the registry-backed audit endpoint can fail for network or mirror reasons.
New direct dependencies should be checked with pnpm audit:security before merging.
Critical advisories in runtime dependencies should block production release unless they are proven unreachable and documented here.
High advisories should have either a remediation PR or an explicit risk acceptance note before commercial deployment.

Verification After Remediation

After each dependency remediation batch:

pnpm install --frozen-lockfile
pnpm check:quality
pnpm audit:security
AUTH_TRUST_HOST=true PORT=3001 pnpm dev
SMOKE_BASE_URL=http://127.0.0.1:3001 pnpm smoke:routes

Record the remaining critical/high count in this file until the audit baseline reaches zero or only accepted exceptions remain.

3.1 KiB Raw Blame History