What happened?
npm audit reports 9 advisories (4 moderate, 5 high) — all in build/dev dependencies, not the edge runtime: brace-expansion, esbuild (via drizzle-kit / @esbuild-kit), js-yaml (via gray-matter), postcss, and sharp. None are reachable in the deployed Worker at request time, so severity is low, but they're worth clearing to keep the toolchain clean and CI audits green.
Where did you see this?
Local / CI (build & dev tooling).
Suggested fix
- Run
npm audit fix for the non-breaking advisories.
- The
drizzle-kit → esbuild chain needs a major bump (npm audit fix --force moves drizzle-kit), so validate db:generate / db:migrate still work afterward.
- Track upstream releases for
gray-matter (js-yaml) and sharp.
What happened?
npm auditreports 9 advisories (4 moderate, 5 high) — all in build/dev dependencies, not the edge runtime:brace-expansion,esbuild(viadrizzle-kit/@esbuild-kit),js-yaml(viagray-matter),postcss, andsharp. None are reachable in the deployed Worker at request time, so severity is low, but they're worth clearing to keep the toolchain clean and CI audits green.Where did you see this?
Local / CI (build & dev tooling).
Suggested fix
npm audit fixfor the non-breaking advisories.drizzle-kit→esbuildchain needs a major bump (npm audit fix --forcemovesdrizzle-kit), so validatedb:generate/db:migratestill work afterward.gray-matter(js-yaml) andsharp.