console-dev/docs/dependency-audit.json

{
  "checkedOn": "2026-11-05",
  "command": "npm audit --json",
  "exitCode": 1,
  "interpretation": "12 dependency findings: 6 low, 6 moderate; no high/critical. Primarily propagated through Nuxt/Nitro build tooling. Not a zero-vulnerability claim; production reachability has not been exhaustively determined.",
  "decision": "Retain current pinned Nuxt and lockfile. Do not apply the suggested force downgrade to Nuxt 4.1.3 without compatibility and security review. Reassess before external release.",
  "auditReportVersion": 2,
  "vulnerabilities": {
    "@nuxt/nitro-server": {
      "name": "@nuxt/nitro-server",
      "severity": "low",
      "isDirect": false,
      "via": ["nitropack", "nuxt"],
      "effects": ["nuxt"],
      "range": ">=3.20.0",
      "nodes": ["node_modules/@nuxt/nitro-server"],
      "fixAvailable": {
        "name": "nuxt",
        "version": "4.1.3",
        "isSemVerMajor": true
      }
    },
    "@nuxt/vite-builder": {
      "name": "@nuxt/vite-builder",
      "severity": "low",
      "isDirect": false,
      "via": ["nuxt"],
      "effects": ["nuxt"],
      "range": "3.20.0 - 3.21.11 || >=4.2.0",
      "nodes": ["node_modules/@nuxt/vite-builder"],
      "fixAvailable": {
        "name": "nuxt",
        "version": "4.1.3",
        "isSemVerMajor": true
      }
    },
    "@nuxt/vite-server": {
      "name": "@nuxt/vite-server",
      "severity": "low",
      "isDirect": false,
      "via": ["nuxt"],
      "effects": ["nuxt"],
      "range": ">=4.6.0",
      "nodes": ["node_modules/@nuxt/vite-server"],
      "fixAvailable": {
        "name": "nuxt",
        "version": "4.1.3",
        "isSemVerMajor": true
      }
    },
    "@rollup/plugin-node-resolve": {
      "name": "@rollup/plugin-node-resolve",
      "severity": "low",
      "isDirect": false,
      "via": ["deepmerge"],
      "effects": ["nitropack"],
      "range": ">=8.0.0",
      "nodes": ["node_modules/@rollup/plugin-node-resolve"],
      "fixAvailable": {
        "name": "nuxt",
        "version": "4.1.3",
        "isSemVerMajor": true
      }
    },
    "@vercel/nft": {
      "name": "@vercel/nft",
      "severity": "moderate",
      "isDirect": false,
      "via": ["glob"],
      "effects": ["nitropack"],
      "range": ">=0.29.2",
      "nodes": ["node_modules/@vercel/nft"],
      "fixAvailable": {
        "name": "nuxt",
        "version": "4.1.3",
        "isSemVerMajor": true
      }
    },
    "archiver": {
      "name": "archiver",
      "severity": "moderate",
      "isDirect": false,
      "via": ["readdir-glob"],
      "effects": ["nitropack"],
      "range": ">=8.0.0",
      "nodes": ["node_modules/archiver"],
      "fixAvailable": {
        "name": "nuxt",
        "version": "4.1.3",
        "isSemVerMajor": true
      }
    },
    "deepmerge": {
      "name": "deepmerge",
      "severity": "low",
      "isDirect": false,
      "via": [
        {
          "source": 1243505,
          "name": "deepmerge",
          "dependency": "deepmerge",
          "title": "deepmerge mergeObject() allows prototype poisoning of returned objects",
          "url": "https://github.com/advisories/GHSA-gcqx-w48m-w2h4",
          "severity": "low",
          "cwe": ["CWE-1321"],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
          },
          "range": ">=4.2.0 <=4.3.1"
        }
      ],
      "effects": ["@rollup/plugin-node-resolve"],
      "range": ">=4.2.0",
      "nodes": ["node_modules/deepmerge"],
      "fixAvailable": {
        "name": "nuxt",
        "version": "4.1.3",
        "isSemVerMajor": true
      }
    },
    "glob": {
      "name": "glob",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1244013,
          "name": "glob",
          "dependency": "glob",
          "title": "Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal",
          "url": "https://github.com/advisories/GHSA-3g3m-2fjr-6pw4",
          "severity": "moderate",
          "cwe": ["CWE-400"],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=9.0.0 <=14.0.1"
        },
        "minimatch"
      ],
      "effects": ["@vercel/nft"],
      "range": "9.0.0 - 14.0.1",
      "nodes": ["node_modules/glob"],
      "fixAvailable": {
        "name": "nuxt",
        "version": "4.1.3",
        "isSemVerMajor": true
      }
    },
    "minimatch": {
      "name": "minimatch",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1244623,
          "name": "minimatch",
          "dependency": "minimatch",
          "title": "minimatch has potential denial of service via globparts amplification",
          "url": "https://github.com/advisories/GHSA-g3hv-75wg-m249",
          "severity": "moderate",
          "cwe": ["CWE-405"],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=7.0.0 <11.0.1"
        }
      ],
      "effects": ["glob", "readdir-glob"],
      "range": "7.0.0 - 11.0.0",
      "nodes": ["node_modules/minimatch"],
      "fixAvailable": {
        "name": "nuxt",
        "version": "4.1.3",
        "isSemVerMajor": true
      }
    },
    "nitropack": {
      "name": "nitropack",
      "severity": "moderate",
      "isDirect": false,
      "via": ["@rollup/plugin-node-resolve", "@vercel/nft", "archiver"],
      "effects": ["@nuxt/nitro-server"],
      "range": ">=0.1.0",
      "nodes": ["node_modules/nitropack"],
      "fixAvailable": {
        "name": "nuxt",
        "version": "4.1.3",
        "isSemVerMajor": true
      }
    },
    "nuxt": {
      "name": "nuxt",
      "severity": "low",
      "isDirect": true,
      "via": ["@nuxt/nitro-server", "@nuxt/vite-builder", "@nuxt/vite-server"],
      "effects": [
        "@nuxt/nitro-server",
        "@nuxt/vite-builder",
        "@nuxt/vite-server"
      ],
      "range": "3.20.0 - 3.21.11 || >=4.2.0",
      "nodes": ["node_modules/nuxt"],
      "fixAvailable": {
        "name": "nuxt",
        "version": "4.1.3",
        "isSemVerMajor": true
      }
    },
    "readdir-glob": {
      "name": "readdir-glob",
      "severity": "moderate",
      "isDirect": false,
      "via": ["minimatch"],
      "effects": ["archiver"],
      "range": ">=2.0.0",
      "nodes": ["node_modules/readdir-glob"],
      "fixAvailable": {
        "name": "nuxt",
        "version": "4.1.3",
        "isSemVerMajor": true
      }
    }
  },
  "metadata": {
    "vulnerabilities": {
      "info": 0,
      "low": 6,
      "moderate": 6,
      "high": 0,
      "critical": 0,
      "total": 12
    },
    "dependencies": {
      "prod": 571,
      "dev": 3,
      "optional": 79,
      "peer": 0,
      "peerOptional": 0,
      "total": 652
    }
  }
}