bitvid/artifacts/deps-report.md

Dependency Security Daily Report

Date: 2026-02-13
Agent: deps-security-agent

Environment

• Package manager selected: npm (package-lock.json present)
• Node: v20.19.6
• npm: 11.4.2
• Constraint: project engine requires Node >=22, so clean install and upgrade validation were blocked in this environment.

Security Audit Summary (artifacts/npm-audit.json)

• Total vulnerabilities: 0
• Critical: 0
• High: 0
• Moderate: 0
• Low: 0

Immediate P0 Security Items

• None identified in this run.

Outdated Dependencies (artifacts/npm-outdated.json)

Detected 12 outdated packages.

Patch candidates (low risk, pending Node 22 runtime)

• @playwright/test 1.58.0 -> 1.58.2
• playwright 1.58.0 -> 1.58.2
• autoprefixer 10.4.23 -> 10.4.24

Minor candidates (review required)

• esbuild 0.25.12 -> 0.27.3
• nostr-tools 2.20.0 -> 2.23.1 (security-sensitive/protocol library — do not auto-upgrade)

Major candidates (issue-first path)

• cross-env 7.0.3 -> 10.1.0
• jsdom 27.4.0 -> 28.0.0

Additional latest-only drift (outside wanted range)

• pixelmatch latest 7.1.0 (current/wanted 5.3.0)
• postcss-import latest 16.1.1 (current/wanted 15.1.0)
• prettier-plugin-tailwindcss latest 0.7.2 (current/wanted 0.6.14)
• stylelint latest 17.2.0 (current/wanted 16.26.1)
• tailwindcss latest 4.1.18 (current/wanted 3.4.19)

Triage Decisions

1. No vulnerability escalation needed (no CRITICAL/HIGH findings).
2. No auto-upgrade PRs attempted due to Node engine mismatch in runtime environment.
3. Next execution should run under Node 22+ and then:
   • Apply patch bumps first (playwright, @playwright/test, autoprefixer).
   • Re-run full validation matrix before any PR.
   • Track nostr-tools as human-reviewed only.

Recommended Follow-ups

• Re-run this agent in a Node 22 environment to enable npm ci and upgrade testing.
• If Node 22 runtime is available, create small PR(s) for the three patch updates listed above.
• Open issue(s) for major upgrades (cross-env, jsdom) with staged migration plans.