start-ui-web is BearStudio's open-source React starter (~1.7k GitHub stars,
actively maintained): TanStack Start and Vite up front, Prisma and better-auth
behind, TypeScript throughout, pnpm holding it together. We ran ChainStrip on
it exactly as its lockfile stood on commit 81d5424, because it's the
typical shape of a young product: a modern stack, a
thin test suite (six files), and dependencies chosen this year, one of them
carrying an unpatched CVE the team hadn't noticed yet.
Day one
Before any integration, the cold scorer read the full install — dev toolchain included — in about two minutes:
$ chainstrip score --dir . querying OSV: 80 advisories across 36 packages... 871 packages — A 774 · B 48 · C 27 · D 16 · F 6 36 with known CVEs · 6 with install scripts · 10 with native code F @vitest/browser@4.0.18 3 CVEs: 3 CRITICAL surface: network · dynamic-import · fs-write F better-auth@1.5.2 10 CVEs: 1 CRITICAL, 7 HIGH, 1 MODERATE, 1 LOW surface: network F fast-xml-parser@5.3.3 7 CVEs: 1 CRITICAL, 3 HIGH, 2 MODERATE, 1 LOW surface: fs-write · bin F undici@7.19.2 11 CVEs: 4 HIGH, 5 MODERATE, 2 LOW surface: obfuscation · network · fs-write F h3@2.0.1-rc.14 6 CVEs: 2 HIGH, 3 MODERATE, 1 LOW surface: network · bin F kysely@0.28.11 3 CVEs: 3 HIGH surface: dynamic-require · network · dynamic-import D nodemailer@7.0.13 6 CVEs: 1 HIGH, 4 MODERATE, 1 LOW surface: child_process · network · fs-write D minimatch@3.1.2 3 CVEs: 3 HIGH surface: none D minimatch@10.1.1 3 CVEs: 3 HIGH surface: none D minimatch@9.0.5 3 CVEs: 3 HIGH surface: none D minimatch@5.1.6 3 CVEs: 3 HIGH surface: none D shell-quote@1.8.3 2 CVEs: 1 CRITICAL, 1 HIGH surface: none D brace-expansion@5.0.4 4 CVEs: 2 HIGH, 2 MODERATE surface: none D svgo@3.3.2 2 CVEs: 2 HIGH surface: dynamic-require · network · dynamic-import · fs-write · bin D prisma@6.19.2 no known CVEs surface: install-script · native · obfuscation · eval · process.binding · child_process · dynamic-require · network · dynamic-import · fs-write · bin D brace-expansion@2.0.2 3 CVEs: 2 HIGH, 1 MODERATE surface: none D brace-expansion@1.1.12 3 CVEs: 2 HIGH, 1 MODERATE surface: none D postcss@8.5.8 3 CVEs: 2 HIGH, 1 MODERATE surface: none D postcss@8.5.6 3 CVEs: 2 HIGH, 1 MODERATE surface: none D @orpc/client@1.13.4 1 CVEs: 1 CRITICAL surface: network D brace-expansion@1.1.15 2 CVEs: 2 HIGH surface: none D seroval@1.5.0 1 CVEs: 1 CRITICAL surface: none C lodash-es@4.17.23 2 CVEs: 1 HIGH, 1 MODERATE surface: process.binding · fs-write C @prisma/client@6.19.2 no known CVEs surface: install-script · obfuscation · child_process · dynamic-require · network · fs-write C effect@3.18.4 1 CVEs: 1 HIGH surface: eval · network · fs-write C ws@8.19.0 2 CVEs: 1 HIGH, 1 MODERATE surface: network C @prisma/engines@6.19.2 no known CVEs surface: install-script · native · child_process · dynamic-require · fs-write C cnfast@0.0.8 no known CVEs surface: obfuscation · process.binding · child_process · dynamic-require · network · dynamic-import · fs-write · bin C js-yaml@4.1.1 2 CVEs: 1 HIGH, 1 MODERATE surface: bin C vite@7.3.5 no known CVEs surface: obfuscation · eval · child_process · dynamic-require · network · dynamic-import · fs-write · bin C esbuild@0.27.7 1 CVEs: 1 LOW surface: install-script · child_process · dynamic-require · network · fs-write · bin C storybook@10.2.14 no known CVEs surface: eval · process.binding · child_process · dynamic-require · network · dynamic-import · fs-write · bin C picomatch@4.0.3 2 CVEs: 1 HIGH, 1 MODERATE surface: none C esbuild@0.27.2 no known CVEs surface: install-script · child_process · dynamic-require · network · fs-write · bin C tsx@4.21.0 no known CVEs surface: obfuscation · child_process · dynamic-require · network · dynamic-import · fs-write · bin C eslint@9.39.2 no known CVEs surface: eval · child_process · dynamic-require · network · dynamic-import · fs-write · bin C nitro-nightly@3.0.1-20260219-081345-4df7aab2 no known CVEs surface: eval · child_process · dynamic-require · network · dynamic-import · fs-write · bin C oxfmt@0.36.0 no known CVEs surface: eval · child_process · dynamic-require · network · dynamic-import · fs-write · bin C pino@10.3.0 no known CVEs surface: eval · child_process · dynamic-require · network · dynamic-import · fs-write · bin C playwright@1.60.0 no known CVEs surface: eval · child_process · dynamic-require · network · dynamic-import · fs-write · bin C prettier@3.8.1 no known CVEs surface: eval · child_process · dynamic-require · network · dynamic-import · fs-write · bin C rollup@4.60.1 no known CVEs surface: eval · child_process · dynamic-require · network · dynamic-import · fs-write · bin C playwright-core@1.60.0 no known CVEs surface: eval · child_process · dynamic-require · network · fs-write · bin C @isaacs/brace-expansion@5.0.0 1 CVEs: 1 HIGH surface: none C @orpc/openapi@1.13.4 1 CVEs: 1 HIGH surface: none C defu@6.1.4 1 CVEs: 1 HIGH surface: none C drizzle-orm@0.45.1 1 CVEs: 1 HIGH surface: none C rolldown@1.0.0-rc.5 no known CVEs surface: eval · child_process · dynamic-require · dynamic-import · fs-write · bin C srvx@0.11.7 1 CVEs: 1 MODERATE surface: child_process · network · dynamic-import · bin B @prisma/get-platform@6.19.2 no known CVEs surface: eval · process.binding · child_process · fs-write B lefthook@2.0.16 no known CVEs surface: install-script · child_process · bin B giget@2.0.0 no known CVEs surface: process.binding · child_process · network · fs-write · bin B prettier@2.8.8 no known CVEs surface: child_process · dynamic-require · network · dynamic-import · fs-write · bin B vitest@4.1.0 no known CVEs surface: child_process · dynamic-require · network · dynamic-import · fs-write · bin B oxlint@1.54.0 no known CVEs surface: child_process · dynamic-require · network · dynamic-import · bin B ajv@6.15.0 no known CVEs surface: eval · dynamic-require · network · fs-write B eslint-plugin-sonarjs@3.0.6 no known CVEs surface: eval · child_process · network B prismjs@1.30.0 no known CVEs surface: eval · dynamic-require · network · dynamic-import B @tanstack/start-server-core@1.166.0 1 CVEs: 1 MODERATE surface: network · dynamic-import B babel-plugin-react-compiler@1.0.0 no known CVEs surface: child_process · dynamic-require · network · dynamic-import B launch-editor@2.12.0 1 CVEs: 1 MODERATE surface: child_process B tinypool@2.1.0 no known CVEs surface: eval · child_process · dynamic-import B @storybook/builder-vite@10.2.14 no known CVEs surface: obfuscation · dynamic-import · fs-write B marked@15.0.12 no known CVEs surface: child_process · dynamic-require · fs-write · bin B typescript@5.9.3 no known CVEs surface: child_process · network · fs-write · bin B @react-email/code-block@0.1.0 no known CVEs surface: eval · network · dynamic-import B node-fetch-native@1.6.7 no known CVEs surface: obfuscation · network B real-require@0.2.0 no known CVEs surface: eval · dynamic-require · dynamic-import B tsconfig-paths@4.2.0 no known CVEs surface: child_process · dynamic-require · network B xmlbuilder2@4.0.3 no known CVEs surface: eval · network · dynamic-import B @prisma/fetch-engine@6.19.2 no known CVEs surface: child_process · network · fs-write B @tanstack/devtools-vite@0.5.2 no known CVEs surface: child_process · network · fs-write B @vitest/mocker@4.1.0 no known CVEs surface: obfuscation · dynamic-import B es-module-lexer@2.3.0 no known CVEs surface: obfuscation · dynamic-import B resolve@1.22.11 no known CVEs surface: dynamic-require · network · fs-write · bin B why-is-node-running@2.3.0 no known CVEs surface: child_process · network · bin B @orpc/interop@1.13.4 no known CVEs surface: process.binding · network B lz-string@1.5.0 no known CVEs surface: obfuscation · bin B pino-pretty@13.1.3 no known CVEs surface: child_process · fs-write · bin B update-browserslist-db@1.2.3 no known CVEs surface: child_process · fs-write · bin B whatwg-url@14.2.0 no known CVEs surface: eval · network B @mongodb-js/saslprep@1.4.12 no known CVEs surface: obfuscation B @oxfmt/binding-darwin-arm64@0.36.0 no known CVEs surface: native B @oxlint/binding-darwin-arm64@1.54.0 no known CVEs surface: native B @rolldown/binding-darwin-arm64@1.0.0-rc.5 no known CVEs surface: native B @rollup/rollup-darwin-arm64@4.60.1 no known CVEs surface: native B @storybook/react@10.2.14 no known CVEs surface: child_process · network B @tailwindcss/oxide@4.1.18 no known CVEs surface: child_process · dynamic-require B @tailwindcss/oxide-darwin-arm64@4.1.18 no known CVEs surface: native B @vitest/snapshot@4.1.0 no known CVEs surface: eval · fs-write B entities@7.0.1 no known CVEs surface: obfuscation B exsolve@1.0.8 no known CVEs surface: child_process · network B fsevents@2.3.3 no known CVEs surface: native B fsevents@2.3.2 no known CVEs surface: native B lightningcss-darwin-arm64@1.30.2 no known CVEs surface: native B mongodb@7.1.0 no known CVEs surface: child_process · network B unenv@2.0.0-rc.24 no known CVEs surface: child_process · network A @svgr/cli@8.1.0 no known CVEs surface: dynamic-require · fs-write · bin A @tanstack/start-plugin-core@1.166.1 no known CVEs surface: network · dynamic-import · fs-write A jiti@2.6.1 no known CVEs surface: dynamic-require · dynamic-import · bin A pidtree@0.3.1 no known CVEs surface: child_process · bin A sonic-boom@4.2.0 no known CVEs surface: child_process · fs-write A thread-stream@4.0.0 no known CVEs surface: child_process · fs-write A axe-core@4.11.1 no known CVEs surface: eval A builtin-modules@3.3.0 no known CVEs surface: process.binding A eslint-scope@8.4.0 no known CVEs surface: eval A globalthis@1.0.4 no known CVEs surface: eval A is-core-module@2.16.1 no known CVEs surface: dynamic-require · network A lodash.merge@4.6.2 no known CVEs surface: process.binding A rou3@0.7.12 no known CVEs surface: eval A safer-buffer@2.1.2 no known CVEs surface: process.binding A solid-js@1.9.11 no known CVEs surface: eval A source-map-js@1.2.1 no known CVEs surface: eval A tapable@2.3.0 no known CVEs surface: eval A @better-auth/core@1.5.2 no known CVEs surface: network · dynamic-import A @better-auth/kysely-adapter@1.5.2 no known CVEs surface: network · dynamic-import A ast-types@0.16.1 no known CVEs surface: dynamic-require · dynamic-import A browserslist@4.28.1 no known CVEs surface: dynamic-require · bin A bson@7.3.1 no known CVEs surface: child_process A commander@7.2.0 no known CVEs surface: child_process A commander@9.5.0 no known CVEs surface: child_process A cross-spawn@7.0.6 no known CVEs surface: child_process A cross-spawn@6.0.6 no known CVEs surface: child_process A default-browser@5.4.0 no known CVEs surface: child_process A default-browser-id@5.0.1 no known CVEs surface: child_process A detect-libc@2.1.2 no known CVEs surface: child_process A memorystream@0.3.1 no known CVEs surface: network · fs-write A npm-run-all@4.1.5 no known CVEs surface: dynamic-require · bin A on-exit-leak-free@2.1.2 no known CVEs surface: child_process A open@10.2.0 no known CVEs surface: child_process A process-warning@5.0.0 no known CVEs surface: child_process A run-applescript@7.1.0 no known CVEs surface: child_process A tinyexec@1.2.4 no known CVEs surface: child_process A unicorn-magic@0.3.0 no known CVEs surface: child_process A unstorage@2.0.0-alpha.5 no known CVEs surface: network · fs-write A @babel/core@7.29.0 1 CVEs: 1 LOW surface: dynamic-import A @babel/core@7.28.6 1 CVEs: 1 LOW surface: dynamic-import A @babel/parser@7.28.6 no known CVEs surface: dynamic-import · bin A @babel/parser@7.29.0 no known CVEs surface: dynamic-import · bin A c12@3.1.0 no known CVEs surface: dynamic-import · fs-write A json5@2.2.3 no known CVEs surface: fs-write · bin A nypm@0.6.4 no known CVEs surface: fs-write · bin A @better-fetch/fetch@1.1.21 no known CVEs surface: network A @better-upload/client@3.0.12 no known CVEs surface: network A @better-upload/server@3.0.12 no known CVEs surface: network A @eslint/eslintrc@3.3.5 no known CVEs surface: dynamic-require A @faker-js/faker@10.2.0 no known CVEs surface: network A @hookform/resolvers@5.2.2 no known CVEs surface: network A @oozcitak/url@3.0.0 no known CVEs surface: network A @orpc/server@1.13.4 no known CVEs surface: network A @orpc/standard-server-node@1.13.4 no known CVEs surface: network A @storybook/addon-docs@10.2.14 no known CVEs surface: network A @svgr/core@8.1.0 no known CVEs surface: dynamic-require A @tanstack/devtools@0.10.8 no known CVEs surface: network A @tanstack/devtools-event-bus@0.4.1 no known CVEs surface: network A @tanstack/query-core@5.90.20 no known CVEs surface: network A @tanstack/query-devtools@5.93.0 no known CVEs surface: network A @tanstack/react-router@1.163.3 no known CVEs surface: network A @tanstack/react-start@1.166.1 no known CVEs surface: network A @typescript-eslint/scope-manager@8.54.0 no known CVEs surface: network A aws4fetch@1.0.20 no known CVEs surface: network A better-call@1.3.2 no known CVEs surface: network A crossws@0.4.4 no known CVEs surface: network A domutils@3.2.2 no known CVEs surface: network A fast-check@3.23.2 no known CVEs surface: network A fast-json-stable-stringify@2.1.0 no known CVEs surface: dynamic-require A glob@13.0.6 no known CVEs surface: network A hosted-git-info@2.8.9 no known CVEs surface: network A import-fresh@3.3.1 no known CVEs surface: dynamic-require A joycon@3.1.1 no known CVEs surface: dynamic-require A keyv@4.5.4 no known CVEs surface: dynamic-require A lightningcss@1.30.2 no known CVEs surface: dynamic-require A lru-cache@11.2.5 no known CVEs surface: network A ofetch@2.0.0-alpha.3 no known CVEs surface: network A parse5-parser-stream@7.1.2 no known CVEs surface: network A pino-abstract-transport@3.0.0 no known CVEs surface: dynamic-require A pino-std-serializers@7.1.0 no known CVEs surface: network A react-hook-form@7.71.1 no known CVEs surface: network A remeda@2.33.4 no known CVEs surface: dynamic-require A sirv@3.0.2 no known CVEs surface: network A source-map@0.7.6 no known CVEs surface: network A ts-pattern@5.9.0 no known CVEs surface: network A uri-js@4.4.1 no known CVEs surface: network A zod@4.3.6 no known CVEs surface: network A zod@3.25.76 no known CVEs surface: network A @adobe/css-tools@4.4.4 no known CVEs surface: dynamic-import A @better-auth/telemetry@1.5.2 no known CVEs surface: dynamic-import A @humanfs/node@0.16.8 no known CVEs surface: fs-write A @humanwhocodes/module-importer@1.0.1 no known CVEs surface: dynamic-import A @pinojs/redact@0.4.0 no known CVEs surface: fs-write A @playwright/test@1.60.0 no known CVEs surface: bin A @tailwindcss/node@4.1.18 no known CVEs surface: dynamic-import A @tanstack/router-generator@1.164.0 no known CVEs surface: fs-write A @typescript-eslint/typescript-estree@8.54.0 no known CVEs surface: fs-write A @vitejs/plugin-react@5.1.2 no known CVEs surface: dynamic-import A @vitest/mocker@4.0.18 no known CVEs surface: dynamic-import A acorn@8.17.0 no known CVEs surface: bin A acorn@8.15.0 no known CVEs surface: bin A argparse@2.0.1 no known CVEs surface: fs-write A baseline-browser-mapping@2.9.18 no known CVEs surface: bin A copy-file@11.1.0 no known CVEs surface: fs-write A cosmiconfig@8.3.6 no known CVEs surface: dynamic-import A cross-env@10.1.0 no known CVEs surface: bin A dotenv-cli@11.0.0 no known CVEs surface: bin A esprima@4.0.1 no known CVEs surface: bin A flat-cache@4.0.1 no known CVEs surface: fs-write A get-tsconfig@4.13.0 no known CVEs surface: fs-write A graceful-fs@4.2.11 no known CVEs surface: fs-write A is-docker@3.0.0 no known CVEs surface: bin A is-inside-container@1.0.0 no known CVEs surface: bin A isexe@2.0.0 no known CVEs surface: fs-write A js-yaml@4.3.0 no known CVEs surface: bin A jsesc@3.1.0 no known CVEs surface: bin A nanoid@3.3.11 no known CVEs surface: bin A nf3@0.3.10 no known CVEs surface: fs-write A pixelmatch@7.1.0 no known CVEs surface: bin A pkg-types@2.3.0 no known CVEs surface: fs-write A pump@3.0.3 no known CVEs surface: fs-write A rc9@2.1.2 no known CVEs surface: fs-write A react-docgen@8.0.2 no known CVEs surface: dynamic-import A recast@0.23.11 no known CVEs surface: dynamic-import A semver@6.3.1 no known CVEs surface: bin A semver@7.7.4 no known CVEs surface: bin A semver@5.7.2 no known CVEs surface: bin A semver@7.7.3 no known CVEs surface: bin A ts-api-utils@2.4.0 no known CVEs surface: dynamic-import A tsconfck@3.1.6 no known CVEs surface: bin A unplugin@2.3.11 no known CVEs surface: fs-write A vite-tsconfig-paths@6.0.5 no known CVEs surface: fs-write A which@2.0.2 no known CVEs surface: bin A which@1.3.1 no known CVEs surface: bin A @alloc/quick-lru@5.2.0 no known CVEs surface: none A @babel/code-frame@7.29.0 no known CVEs surface: none A @babel/code-frame@7.29.7 no known CVEs surface: none A @babel/code-frame@7.27.1 no known CVEs surface: none A @babel/code-frame@7.28.6 no known CVEs surface: none A @babel/compat-data@7.28.6 no known CVEs surface: none A @babel/generator@7.29.1 no known CVEs surface: none A @babel/generator@7.28.6 no known CVEs surface: none A @babel/helper-compilation-targets@7.28.6 no known CVEs surface: none A @babel/helper-globals@7.28.0 no known CVEs surface: none A @babel/helper-module-imports@7.28.6 no known CVEs surface: none A @babel/helper-module-transforms@7.28.6 no known CVEs surface: none A @babel/helper-plugin-utils@7.28.6 no known CVEs surface: none A @babel/helper-string-parser@7.27.1 no known CVEs surface: none A @babel/helper-validator-identifier@7.29.7 no known CVEs surface: none A @babel/helper-validator-identifier@7.28.5 no known CVEs surface: none A @babel/helper-validator-option@7.27.1 no known CVEs surface: none A @babel/helpers@7.28.6 no known CVEs surface: none A @babel/plugin-syntax-jsx@7.28.6 no known CVEs surface: none A @babel/plugin-syntax-typescript@7.28.6 no known CVEs surface: none A @babel/plugin-transform-react-jsx-self@7.27.1 no known CVEs surface: none A @babel/plugin-transform-react-jsx-source@7.27.1 no known CVEs surface: none A @babel/runtime@7.29.7 no known CVEs surface: none A @babel/runtime@7.28.6 no known CVEs surface: none A @babel/template@7.28.6 no known CVEs surface: none A @babel/traverse@7.29.0 no known CVEs surface: none A @babel/traverse@7.28.6 no known CVEs surface: none A @babel/types@7.29.0 no known CVEs surface: none A @babel/types@7.28.6 no known CVEs surface: none A @base-ui/react@1.2.0 no known CVEs surface: none A @base-ui/utils@0.2.5 no known CVEs surface: none A @bearstudio/ui-state@1.1.0 no known CVEs surface: none A @better-auth/drizzle-adapter@1.5.2 no known CVEs surface: none A @better-auth/expo@1.5.2 no known CVEs surface: none A @better-auth/memory-adapter@1.5.2 no known CVEs surface: none A @better-auth/mongo-adapter@1.5.2 no known CVEs surface: none A @better-auth/prisma-adapter@1.5.2 no known CVEs surface: none A @better-auth/utils@0.3.1 no known CVEs surface: none A @date-fns/tz@1.4.1 no known CVEs surface: none A @epic-web/invariant@1.0.0 no known CVEs surface: none A @esbuild/darwin-arm64@0.27.2 no known CVEs surface: none A @esbuild/darwin-arm64@0.27.7 no known CVEs surface: none A @eslint-community/eslint-utils@4.9.1 no known CVEs surface: none A @eslint-community/regexpp@4.12.2 no known CVEs surface: none A @eslint/config-array@0.21.2 no known CVEs surface: none A @eslint/config-helpers@0.4.2 no known CVEs surface: none A @eslint/core@0.17.0 no known CVEs surface: none A @eslint/js@9.39.2 no known CVEs surface: none A @eslint/object-schema@2.1.7 no known CVEs surface: none A @eslint/plugin-kit@0.4.1 no known CVEs surface: none A @floating-ui/core@1.7.4 no known CVEs surface: none A @floating-ui/dom@1.7.5 no known CVEs surface: none A @floating-ui/react-dom@2.1.7 no known CVEs surface: none A @floating-ui/utils@0.2.10 no known CVEs surface: none A @fontsource-variable/inter@5.2.8 no known CVEs surface: none A @humanfs/core@0.19.2 no known CVEs surface: none A @humanfs/types@0.15.0 no known CVEs surface: none A @humanwhocodes/retry@0.4.3 no known CVEs surface: none A @isaacs/balanced-match@4.0.1 no known CVEs surface: none A @joshwooding/vite-plugin-react-docgen-typescript@0.6.4 no known CVEs surface: none A @jridgewell/gen-mapping@0.3.13 no known CVEs surface: none A @jridgewell/remapping@2.3.5 no known CVEs surface: none A @jridgewell/resolve-uri@3.1.2 no known CVEs surface: none A @jridgewell/sourcemap-codec@1.5.5 no known CVEs surface: none A @jridgewell/trace-mapping@0.3.31 no known CVEs surface: none A @mdx-js/react@3.1.1 no known CVEs surface: none A @noble/ciphers@2.1.1 no known CVEs surface: none A @noble/hashes@2.0.1 no known CVEs surface: none A @nodelib/fs.scandir@2.1.5 no known CVEs surface: none A @nodelib/fs.stat@2.0.5 no known CVEs surface: none A @nodelib/fs.walk@1.2.8 no known CVEs surface: none A @oozcitak/dom@2.0.2 no known CVEs surface: none A @oozcitak/infra@2.0.2 no known CVEs surface: none A @oozcitak/util@10.0.0 no known CVEs surface: none A @orpc/contract@1.13.4 no known CVEs surface: none A @orpc/json-schema@1.13.4 no known CVEs surface: none A @orpc/openapi-client@1.13.4 no known CVEs surface: none A @orpc/react-query@1.13.4 no known CVEs surface: none A @orpc/shared@1.13.4 no known CVEs surface: none A @orpc/standard-server@1.13.4 no known CVEs surface: none A @orpc/standard-server-aws-lambda@1.13.4 no known CVEs surface: none A @orpc/standard-server-fastify@1.13.4 no known CVEs surface: none A @orpc/standard-server-fetch@1.13.4 no known CVEs surface: none A @orpc/standard-server-peer@1.13.4 no known CVEs surface: none A @orpc/tanstack-query@1.13.4 no known CVEs surface: none A @orpc/zod@1.13.4 no known CVEs surface: none A @oxc-project/types@0.114.0 no known CVEs surface: none A @polka/url@1.0.0-next.29 no known CVEs surface: none A @prisma/config@6.19.2 no known CVEs surface: none A @prisma/debug@6.19.2 no known CVEs surface: none A @prisma/engines-version@7.1.1-3.c2990dca591cba766e3b7ef5d9e8a84796e47ab7 no known CVEs surface: none A @react-email/body@0.1.0 no known CVEs surface: none A @react-email/button@0.2.0 no known CVEs surface: none A @react-email/code-inline@0.0.5 no known CVEs surface: none A @react-email/column@0.0.13 no known CVEs surface: none A @react-email/components@0.5.7 no known CVEs surface: none A @react-email/container@0.0.15 no known CVEs surface: none A @react-email/font@0.0.9 no known CVEs surface: none A @react-email/head@0.0.12 no known CVEs surface: none A @react-email/heading@0.0.15 no known CVEs surface: none A @react-email/hr@0.0.11 no known CVEs surface: none A @react-email/html@0.0.11 no known CVEs surface: none A @react-email/img@0.0.11 no known CVEs surface: none A @react-email/link@0.0.12 no known CVEs surface: none A @react-email/markdown@0.0.16 no known CVEs surface: none A @react-email/preview@0.0.13 no known CVEs surface: none A @react-email/render@1.4.0 no known CVEs surface: none A @react-email/row@0.0.12 no known CVEs surface: none A @react-email/section@0.0.16 no known CVEs surface: none A @react-email/tailwind@1.2.2 no known CVEs surface: none A @react-email/text@0.1.5 no known CVEs surface: none A @rolldown/pluginutils@1.0.0-rc.5 no known CVEs surface: none A @rolldown/pluginutils@1.0.0-beta.53 no known CVEs surface: none A @rolldown/pluginutils@1.0.0-beta.40 no known CVEs surface: none A @rollup/pluginutils@5.3.0 no known CVEs surface: none A @selderee/plugin-htmlparser2@0.11.0 no known CVEs surface: none A @sindresorhus/merge-streams@4.0.0 no known CVEs surface: none A @solid-primitives/event-listener@2.4.3 no known CVEs surface: none A @solid-primitives/keyboard@1.3.3 no known CVEs surface: none A @solid-primitives/resize-observer@2.1.3 no known CVEs surface: none A @solid-primitives/rootless@1.5.2 no known CVEs surface: none A @solid-primitives/static-store@0.1.2 no known CVEs surface: none A @solid-primitives/utils@6.3.2 no known CVEs surface: none A @standard-schema/spec@1.1.0 no known CVEs surface: none A @standard-schema/utils@0.3.0 no known CVEs surface: none A @storybook/addon-a11y@10.2.14 no known CVEs surface: none A @storybook/csf-plugin@10.2.14 no known CVEs surface: none A @storybook/global@5.0.0 no known CVEs surface: none A @storybook/icons@2.0.1 no known CVEs surface: none A @storybook/react-dom-shim@10.2.14 no known CVEs surface: none A @storybook/react-vite@10.2.14 no known CVEs surface: none A @svgr/babel-plugin-add-jsx-attribute@8.0.0 no known CVEs surface: none A @svgr/babel-plugin-remove-jsx-attribute@8.0.0 no known CVEs surface: none A @svgr/babel-plugin-remove-jsx-empty-expression@8.0.0 no known CVEs surface: none A @svgr/babel-plugin-replace-jsx-attribute-value@8.0.0 no known CVEs surface: none A @svgr/babel-plugin-svg-dynamic-title@8.0.0 no known CVEs surface: none A @svgr/babel-plugin-svg-em-dimensions@8.0.0 no known CVEs surface: none A @svgr/babel-plugin-transform-react-native-svg@8.1.0 no known CVEs surface: none A @svgr/babel-plugin-transform-svg-component@8.0.0 no known CVEs surface: none A @svgr/babel-preset@8.1.0 no known CVEs surface: none A @svgr/hast-util-to-babel-ast@8.0.0 no known CVEs surface: none A @svgr/plugin-jsx@8.1.0 no known CVEs surface: none A @svgr/plugin-prettier@8.1.0 no known CVEs surface: none A @svgr/plugin-svgo@8.1.0 no known CVEs surface: none A @t3-oss/env-core@0.13.10 no known CVEs surface: none A @tailwindcss/postcss@4.1.18 no known CVEs surface: none A @tanstack/devtools-client@0.0.5 no known CVEs surface: none A @tanstack/devtools-event-client@0.4.0 no known CVEs surface: none A @tanstack/devtools-ui@0.4.4 no known CVEs surface: none A @tanstack/eslint-plugin-query@5.91.4 no known CVEs surface: none A @tanstack/eslint-plugin-router@1.161.4 no known CVEs surface: none A @tanstack/history@1.161.4 no known CVEs surface: none A @tanstack/react-devtools@0.9.7 no known CVEs surface: none A @tanstack/react-query@5.90.21 no known CVEs surface: none A @tanstack/react-query-devtools@5.91.3 no known CVEs surface: none A @tanstack/react-router-devtools@1.163.3 no known CVEs surface: none A @tanstack/react-start-client@1.164.1 no known CVEs surface: none A @tanstack/react-start-server@1.166.0 no known CVEs surface: none A @tanstack/react-store@0.9.1 no known CVEs surface: none A @tanstack/router-core@1.163.3 no known CVEs surface: none A @tanstack/router-devtools-core@1.163.3 no known CVEs surface: none A @tanstack/router-plugin@1.164.0 no known CVEs surface: none A @tanstack/router-utils@1.161.4 no known CVEs surface: none A @tanstack/start-client-core@1.164.1 no known CVEs surface: none A @tanstack/start-fn-stubs@1.161.4 no known CVEs surface: none A @tanstack/start-storage-context@1.163.3 no known CVEs surface: none A @tanstack/store@0.9.1 no known CVEs surface: none A @tanstack/virtual-file-routes@1.161.4 no known CVEs surface: none A @tanstack/zod-adapter@1.163.3 no known CVEs surface: none A @testing-library/dom@10.4.1 no known CVEs surface: none A @testing-library/jest-dom@6.9.1 no known CVEs surface: none A @testing-library/user-event@14.6.1 no known CVEs surface: none A @trysound/sax@0.2.0 no known CVEs surface: none A @types/aria-query@5.0.4 no known CVEs surface: none A @types/babel__core@7.20.5 no known CVEs surface: none A @types/babel__generator@7.27.0 no known CVEs surface: none A @types/babel__template@7.4.4 no known CVEs surface: none A @types/babel__traverse@7.28.0 no known CVEs surface: none A @types/chai@5.2.3 no known CVEs surface: none A @types/deep-eql@4.0.2 no known CVEs surface: none A @types/doctrine@0.0.9 no known CVEs surface: none A @types/estree@1.0.9 no known CVEs surface: none A @types/estree@1.0.8 no known CVEs surface: none A @types/json-schema@7.0.15 no known CVEs surface: none A @types/mdx@2.0.13 no known CVEs surface: none A @types/node@25.0.10 no known CVEs surface: none A @types/nodemailer@7.0.9 no known CVEs surface: none A @types/react@19.2.10 no known CVEs surface: none A @types/react-dom@19.2.3 no known CVEs surface: none A @types/resolve@1.20.6 no known CVEs surface: none A @types/webidl-conversions@7.0.3 no known CVEs surface: none A @types/whatwg-url@13.0.0 no known CVEs surface: none A @typescript-eslint/project-service@8.54.0 no known CVEs surface: none A @typescript-eslint/tsconfig-utils@8.54.0 no known CVEs surface: none A @typescript-eslint/types@8.54.0 no known CVEs surface: none A @typescript-eslint/utils@8.54.0 no known CVEs surface: none A @typescript-eslint/visitor-keys@8.54.0 no known CVEs surface: none A @uidotdev/usehooks@2.4.1 no known CVEs surface: none A @vitest/browser-playwright@4.0.18 no known CVEs surface: none A @vitest/expect@3.2.4 no known CVEs surface: none A @vitest/expect@4.1.0 no known CVEs surface: none A @vitest/pretty-format@3.2.4 no known CVEs surface: none A @vitest/pretty-format@4.1.0 no known CVEs surface: none A @vitest/pretty-format@4.0.18 no known CVEs surface: none A @vitest/runner@4.1.0 no known CVEs surface: none A @vitest/spy@3.2.4 no known CVEs surface: none A @vitest/spy@4.1.0 no known CVEs surface: none A @vitest/spy@4.0.18 no known CVEs surface: none A @vitest/utils@3.2.4 no known CVEs surface: none A @vitest/utils@4.1.0 no known CVEs surface: none A @vitest/utils@4.0.18 no known CVEs surface: none A @vueless/storybook-dark-mode@10.0.7 no known CVEs surface: none A acorn-jsx@5.3.2 no known CVEs surface: none A ansi-regex@5.0.1 no known CVEs surface: none A ansi-styles@3.2.1 no known CVEs surface: none A ansi-styles@5.2.0 no known CVEs surface: none A ansi-styles@4.3.0 no known CVEs surface: none A ansis@4.2.0 no known CVEs surface: none A anymatch@3.1.3 no known CVEs surface: none A aria-query@5.3.2 no known CVEs surface: none A aria-query@5.3.0 no known CVEs surface: none A array-buffer-byte-length@1.0.2 no known CVEs surface: none A arraybuffer.prototype.slice@1.0.4 no known CVEs surface: none A assertion-error@2.0.1 no known CVEs surface: none A async-function@1.0.0 no known CVEs surface: none A atomic-sleep@1.0.0 no known CVEs surface: none A available-typed-arrays@1.0.7 no known CVEs surface: none A babel-dead-code-elimination@1.0.12 no known CVEs surface: none A balanced-match@1.0.2 no known CVEs surface: none A balanced-match@4.0.4 no known CVEs surface: none A binary-extensions@2.3.0 no known CVEs surface: none A boolbase@1.0.0 no known CVEs surface: none A boring-avatars@2.0.4 no known CVEs surface: none A braces@3.0.3 no known CVEs surface: none A bundle-name@4.1.0 no known CVEs surface: none A bytes@3.1.2 no known CVEs surface: none A call-bind@1.0.8 no known CVEs surface: none A call-bind-apply-helpers@1.0.2 no known CVEs surface: none A call-bound@1.0.4 no known CVEs surface: none A callsites@3.1.0 no known CVEs surface: none A camelcase@6.3.0 no known CVEs surface: none A caniuse-lite@1.0.30001766 no known CVEs surface: none A chai@6.2.2 no known CVEs surface: none A chai@5.3.3 no known CVEs surface: none A chalk@4.1.2 no known CVEs surface: none A chalk@2.4.2 no known CVEs surface: none A chalk@5.6.2 no known CVEs surface: none A check-error@2.1.3 no known CVEs surface: none A cheerio@1.2.0 no known CVEs surface: none A cheerio-select@2.1.0 no known CVEs surface: none A chokidar@4.0.3 no known CVEs surface: none A chokidar@3.6.0 no known CVEs surface: none A citty@0.1.6 no known CVEs surface: none A citty@0.2.0 no known CVEs surface: none A class-variance-authority@0.7.1 no known CVEs surface: none A clsx@2.1.1 no known CVEs surface: none A color-convert@2.0.1 no known CVEs surface: none A color-convert@1.9.3 no known CVEs surface: none A color-name@1.1.4 no known CVEs surface: none A color-name@1.1.3 no known CVEs surface: none A colorette@2.0.20 no known CVEs surface: none A concat-map@0.0.1 no known CVEs surface: none A confbox@0.2.2 no known CVEs surface: none A consola@3.4.2 no known CVEs surface: none A convert-source-map@2.0.0 no known CVEs surface: none A cookie@1.1.1 no known CVEs surface: none A cookie-es@2.0.0 no known CVEs surface: none A cpy@12.1.0 no known CVEs surface: none A css-select@5.2.2 no known CVEs surface: none A css-tree@2.3.1 no known CVEs surface: none A css-tree@2.2.1 no known CVEs surface: none A css-what@6.2.2 no known CVEs surface: none A css.escape@1.5.1 no known CVEs surface: none A csso@5.0.5 no known CVEs surface: none A csstype@3.2.3 no known CVEs surface: none A dashify@2.0.0 no known CVEs surface: none A data-view-buffer@1.0.2 no known CVEs surface: none A data-view-byte-length@1.0.2 no known CVEs surface: none A data-view-byte-offset@1.0.1 no known CVEs surface: none A date-fns@4.1.0 no known CVEs surface: none A date-fns-jalali@4.1.0-0 no known CVEs surface: none A dateformat@4.6.3 no known CVEs surface: none A dayjs@1.11.19 no known CVEs surface: none A db0@0.3.4 no known CVEs surface: none A debug@4.4.3 no known CVEs surface: none A deep-eql@5.0.2 no known CVEs surface: none A deep-is@0.1.4 no known CVEs surface: none A deepmerge@4.3.1 no known CVEs surface: none A deepmerge-ts@7.1.5 no known CVEs surface: none A define-data-property@1.1.4 no known CVEs surface: none A define-lazy-prop@3.0.0 no known CVEs surface: none A define-properties@1.2.1 no known CVEs surface: none A dequal@2.0.3 no known CVEs surface: none A destr@2.0.5 no known CVEs surface: none A diff@8.0.3 no known CVEs surface: none A doctrine@3.0.0 no known CVEs surface: none A dom-accessibility-api@0.6.3 no known CVEs surface: none A dom-accessibility-api@0.5.16 no known CVEs surface: none A dom-serializer@2.0.0 no known CVEs surface: none A domelementtype@2.3.0 no known CVEs surface: none A domhandler@5.0.3 no known CVEs surface: none A dot-case@3.0.4 no known CVEs surface: none A dotenv@16.6.1 no known CVEs surface: none A dotenv@17.2.3 no known CVEs surface: none A dotenv-expand@12.0.3 no known CVEs surface: none A dunder-proto@1.0.1 no known CVEs surface: none A electron-to-chromium@1.5.279 no known CVEs surface: none A empathic@2.0.0 no known CVEs surface: none A encoding-sniffer@0.2.1 no known CVEs surface: none A end-of-stream@1.4.5 no known CVEs surface: none A enhanced-resolve@5.18.4 no known CVEs surface: none A entities@4.5.0 no known CVEs surface: none A entities@6.0.1 no known CVEs surface: none A error-ex@1.3.4 no known CVEs surface: none A es-abstract@1.24.1 no known CVEs surface: none A es-define-property@1.0.1 no known CVEs surface: none A es-errors@1.3.0 no known CVEs surface: none A es-object-atoms@1.1.1 no known CVEs surface: none A es-set-tostringtag@2.1.0 no known CVEs surface: none A es-to-primitive@1.3.0 no known CVEs surface: none A escalade@3.2.0 no known CVEs surface: none A escape-string-regexp@5.0.0 no known CVEs surface: none A escape-string-regexp@1.0.5 no known CVEs surface: none A escape-string-regexp@4.0.0 no known CVEs surface: none A eslint-plugin-simple-import-sort@12.1.1 no known CVEs surface: none A eslint-plugin-storybook@10.2.14 no known CVEs surface: none A eslint-visitor-keys@4.2.1 no known CVEs surface: none A eslint-visitor-keys@3.4.3 no known CVEs surface: none A espree@10.4.0 no known CVEs surface: none A esquery@1.7.0 no known CVEs surface: none A esrecurse@4.3.0 no known CVEs surface: none A estraverse@5.3.0 no known CVEs surface: none A estree-walker@3.0.3 no known CVEs surface: none A estree-walker@2.0.2 no known CVEs surface: none A esutils@2.0.3 no known CVEs surface: none A expect-type@1.4.0 no known CVEs surface: none A fast-copy@4.0.2 no known CVEs surface: none A fast-deep-equal@3.1.3 no known CVEs surface: none A fast-deep-equal@2.0.1 no known CVEs surface: none A fast-glob@3.3.3 no known CVEs surface: none A fast-levenshtein@2.0.6 no known CVEs surface: none A fast-safe-stringify@2.1.1 no known CVEs surface: none A fastq@1.20.1 no known CVEs surface: none A fdir@6.5.0 no known CVEs surface: none A file-entry-cache@8.0.0 no known CVEs surface: none A fill-range@7.1.1 no known CVEs surface: none A find-up@5.0.0 no known CVEs surface: none A flatted@3.4.2 no known CVEs surface: none A for-each@0.3.5 no known CVEs surface: none A fs.realpath@1.0.0 no known CVEs surface: none A function-bind@1.1.2 no known CVEs surface: none A function.prototype.name@1.1.8 no known CVEs surface: none A functional-red-black-tree@1.0.1 no known CVEs surface: none A functions-have-names@1.2.3 no known CVEs surface: none A generator-function@2.0.1 no known CVEs surface: none A gensync@1.0.0-beta.2 no known CVEs surface: none A get-intrinsic@1.3.0 no known CVEs surface: none A get-proto@1.0.1 no known CVEs surface: none A get-symbol-description@1.1.0 no known CVEs surface: none A glob@8.1.0 no known CVEs surface: none A glob-parent@5.1.2 no known CVEs surface: none A glob-parent@6.0.2 no known CVEs surface: none A globals@14.0.0 no known CVEs surface: none A globby@15.0.0 no known CVEs surface: none A globrex@0.1.2 no known CVEs surface: none A goober@2.1.18 no known CVEs surface: none A gopd@1.2.0 no known CVEs surface: none A has-bigints@1.1.0 no known CVEs surface: none A has-flag@4.0.0 no known CVEs surface: none A has-flag@3.0.0 no known CVEs surface: none A has-property-descriptors@1.0.2 no known CVEs surface: none A has-proto@1.2.0 no known CVEs surface: none A has-symbols@1.1.0 no known CVEs surface: none A has-tostringtag@1.0.2 no known CVEs surface: none A hasown@2.0.2 no known CVEs surface: none A help-me@5.0.0 no known CVEs surface: none A hookable@6.0.1 no known CVEs surface: none A html-parse-stringify@3.0.1 no known CVEs surface: none A html-to-text@9.0.5 no known CVEs surface: none A htmlparser2@10.1.0 no known CVEs surface: none A htmlparser2@8.0.2 no known CVEs surface: none A i18next@25.8.0 no known CVEs surface: none A i18next-browser-languagedetector@8.2.0 no known CVEs surface: none A iconv-lite@0.6.3 no known CVEs surface: none A ignore@5.3.2 no known CVEs surface: none A ignore@7.0.5 no known CVEs surface: none A imurmurhash@0.1.4 no known CVEs surface: none A indent-string@4.0.0 no known CVEs surface: none A inflight@1.0.6 no known CVEs surface: none A inherits@2.0.4 no known CVEs surface: none A input-otp@1.4.2 no known CVEs surface: none A internal-slot@1.1.0 no known CVEs surface: none A is-array-buffer@3.0.5 no known CVEs surface: none A is-arrayish@0.2.1 no known CVEs surface: none A is-async-function@2.1.1 no known CVEs surface: none A is-bigint@1.1.0 no known CVEs surface: none A is-binary-path@2.1.0 no known CVEs surface: none A is-boolean-object@1.2.2 no known CVEs surface: none A is-callable@1.2.7 no known CVEs surface: none A is-data-view@1.0.2 no known CVEs surface: none A is-date-object@1.1.0 no known CVEs surface: none A is-extglob@2.1.1 no known CVEs surface: none A is-finalizationregistry@1.1.1 no known CVEs surface: none A is-generator-function@1.1.2 no known CVEs surface: none A is-glob@4.0.3 no known CVEs surface: none A is-map@2.0.3 no known CVEs surface: none A is-negative-zero@2.0.3 no known CVEs surface: none A is-number@7.0.0 no known CVEs surface: none A is-number-object@1.1.1 no known CVEs surface: none A is-regex@1.2.1 no known CVEs surface: none A is-set@2.0.3 no known CVEs surface: none A is-shared-array-buffer@1.0.4 no known CVEs surface: none A is-string@1.1.1 no known CVEs surface: none A is-symbol@1.1.1 no known CVEs surface: none A is-typed-array@1.1.15 no known CVEs surface: none A is-weakmap@2.0.2 no known CVEs surface: none A is-weakref@1.1.1 no known CVEs surface: none A is-weakset@2.0.4 no known CVEs surface: none A is-wsl@3.1.0 no known CVEs surface: none A isarray@2.0.5 no known CVEs surface: none A isbot@5.1.34 no known CVEs surface: none A jose@6.1.3 no known CVEs surface: none A js-tokens@4.0.0 no known CVEs surface: none A json-buffer@3.0.1 no known CVEs surface: none A json-parse-better-errors@1.0.2 no known CVEs surface: none A json-parse-even-better-errors@2.3.1 no known CVEs surface: none A json-schema-traverse@0.4.1 no known CVEs surface: none A json-schema-typed@8.0.2 no known CVEs surface: none A json-stable-stringify-without-jsonify@1.0.1 no known CVEs surface: none A jsx-ast-utils-x@0.1.0 no known CVEs surface: none A junk@4.0.1 no known CVEs surface: none A leac@0.6.0 no known CVEs surface: none A lefthook-darwin-arm64@2.0.16 no known CVEs surface: none A levn@0.4.1 no known CVEs surface: none A lines-and-columns@1.2.4 no known CVEs surface: none A load-json-file@4.0.0 no known CVEs surface: none A locate-path@6.0.0 no known CVEs surface: none A loupe@3.2.1 no known CVEs surface: none A lower-case@2.0.2 no known CVEs surface: none A lru-cache@5.1.1 no known CVEs surface: none A lucide-react@0.563.0 no known CVEs surface: none A magic-string@0.30.21 no known CVEs surface: none A math-intrinsics@1.1.0 no known CVEs surface: none A mdn-data@2.0.30 no known CVEs surface: none A mdn-data@2.0.28 no known CVEs surface: none A memory-pager@1.5.0 no known CVEs surface: none A merge2@1.4.1 no known CVEs surface: none A micromatch@4.0.8 no known CVEs surface: none A min-indent@1.0.1 no known CVEs surface: none A minimatch@3.1.5 no known CVEs surface: none A minimatch@10.2.4 no known CVEs surface: none A minimist@1.2.8 no known CVEs surface: none A minipass@7.1.3 no known CVEs surface: none A mongodb-connection-string-url@7.0.1 no known CVEs surface: none A mrmime@2.0.1 no known CVEs surface: none A ms@2.1.3 no known CVEs surface: none A nanostores@1.1.1 no known CVEs surface: none A natural-compare@1.4.0 no known CVEs surface: none A next-themes@0.4.6 no known CVEs surface: none A nice-try@1.0.5 no known CVEs surface: none A no-case@3.0.4 no known CVEs surface: none A node-releases@2.0.27 no known CVEs surface: none A normalize-package-data@2.5.0 no known CVEs surface: none A normalize-path@3.0.0 no known CVEs surface: none A nth-check@2.1.1 no known CVEs surface: none A object-inspect@1.13.4 no known CVEs surface: none A object-keys@1.1.1 no known CVEs surface: none A object.assign@4.1.7 no known CVEs surface: none A obug@2.1.3 no known CVEs surface: none A ohash@2.0.11 no known CVEs surface: none A once@1.4.0 no known CVEs surface: none A openapi-types@12.1.3 no known CVEs surface: none A optionator@0.9.4 no known CVEs surface: none A own-keys@1.0.1 no known CVEs surface: none A p-event@6.0.1 no known CVEs surface: none A p-filter@4.1.0 no known CVEs surface: none A p-limit@3.1.0 no known CVEs surface: none A p-locate@5.0.0 no known CVEs surface: none A p-map@7.0.4 no known CVEs surface: none A p-timeout@6.1.4 no known CVEs surface: none A parent-module@1.0.1 no known CVEs surface: none A parse-json@5.2.0 no known CVEs surface: none A parse-json@4.0.0 no known CVEs surface: none A parse5@7.3.0 no known CVEs surface: none A parse5-htmlparser2-tree-adapter@7.1.0 no known CVEs surface: none A parseley@0.12.1 no known CVEs surface: none A path-exists@4.0.0 no known CVEs surface: none A path-key@3.1.1 no known CVEs surface: none A path-key@2.0.1 no known CVEs surface: none A path-parse@1.0.7 no known CVEs surface: none A path-scurry@2.0.2 no known CVEs surface: none A path-type@4.0.0 no known CVEs surface: none A path-type@3.0.0 no known CVEs surface: none A path-type@6.0.0 no known CVEs surface: none A pathe@2.0.3 no known CVEs surface: none A pathval@2.0.1 no known CVEs surface: none A peberminta@0.9.0 no known CVEs surface: none A perfect-debounce@1.0.0 no known CVEs surface: none A picocolors@1.1.1 no known CVEs surface: none A picomatch@4.0.4 no known CVEs surface: none A picomatch@2.3.2 no known CVEs surface: none A pify@3.0.0 no known CVEs surface: none A pngjs@7.0.0 no known CVEs surface: none A possible-typed-array-names@1.1.0 no known CVEs surface: none A prelude-ls@1.2.1 no known CVEs surface: none A pretty-format@27.5.1 no known CVEs surface: none A punycode@2.3.1 no known CVEs surface: none A pure-rand@6.1.0 no known CVEs surface: none A queue-microtask@1.2.3 no known CVEs surface: none A quick-format-unescaped@4.0.4 no known CVEs surface: none A radash@12.1.1 no known CVEs surface: none A react@19.2.4 no known CVEs surface: none A react-day-picker@9.13.0 no known CVEs surface: none A react-docgen-typescript@2.4.0 no known CVEs surface: none A react-dom@19.2.4 no known CVEs surface: none A react-error-boundary@6.1.0 no known CVEs surface: none A react-i18next@16.5.4 no known CVEs surface: none A react-is@17.0.2 no known CVEs surface: none A react-merge-refs@3.0.2 no known CVEs surface: none A react-promise-suspense@0.3.4 no known CVEs surface: none A react-refresh@0.18.0 no known CVEs surface: none A react-textarea-autosize@8.5.9 no known CVEs surface: none A react-use-disclosure@9.0.0 no known CVEs surface: none A read-pkg@3.0.0 no known CVEs surface: none A readdirp@4.1.2 no known CVEs surface: none A readdirp@3.6.0 no known CVEs surface: none A redent@3.0.0 no known CVEs surface: none A refa@0.12.1 no known CVEs surface: none A reflect.getprototypeof@1.0.10 no known CVEs surface: none A regexp-ast-analysis@0.7.1 no known CVEs surface: none A regexp.prototype.flags@1.5.4 no known CVEs surface: none A reselect@5.1.1 no known CVEs surface: none A resize-observer-polyfill@1.5.1 no known CVEs surface: none A resolve-from@4.0.0 no known CVEs surface: none A resolve-pkg-maps@1.0.0 no known CVEs surface: none A reusify@1.1.0 no known CVEs surface: none A run-parallel@1.2.0 no known CVEs surface: none A safe-array-concat@1.1.3 no known CVEs surface: none A safe-push-apply@1.0.0 no known CVEs surface: none A safe-regex-test@1.1.0 no known CVEs surface: none A safe-stable-stringify@2.5.0 no known CVEs surface: none A scheduler@0.27.0 no known CVEs surface: none A scslre@0.3.0 no known CVEs surface: none A secure-json-parse@4.1.0 no known CVEs surface: none A selderee@0.11.0 no known CVEs surface: none A seroval@1.5.4 no known CVEs surface: none A seroval-plugins@1.5.0 no known CVEs surface: none A seroval-plugins@1.5.4 no known CVEs surface: none A set-cookie-parser@3.0.1 no known CVEs surface: none A set-function-length@1.2.2 no known CVEs surface: none A set-function-name@2.0.2 no known CVEs surface: none A set-proto@1.0.0 no known CVEs surface: none A shebang-command@2.0.0 no known CVEs surface: none A shebang-command@1.2.0 no known CVEs surface: none A shebang-regex@3.0.0 no known CVEs surface: none A shebang-regex@1.0.0 no known CVEs surface: none A side-channel@1.1.0 no known CVEs surface: none A side-channel-list@1.0.0 no known CVEs surface: none A side-channel-map@1.0.1 no known CVEs surface: none A side-channel-weakmap@1.0.2 no known CVEs surface: none A siginfo@2.0.0 no known CVEs surface: none A slash@5.1.0 no known CVEs surface: none A snake-case@3.0.4 no known CVEs surface: none A sonner@2.0.7 no known CVEs surface: none A source-map@0.6.1 no known CVEs surface: none A sparse-bitfield@3.0.3 no known CVEs surface: none A spdx-correct@3.2.0 no known CVEs surface: none A spdx-exceptions@2.5.0 no known CVEs surface: none A spdx-expression-parse@3.0.1 no known CVEs surface: none A spdx-license-ids@3.0.22 no known CVEs surface: none A split2@4.2.0 no known CVEs surface: none A stackback@0.0.2 no known CVEs surface: none A std-env@4.1.0 no known CVEs surface: none A stop-iteration-iterator@1.1.0 no known CVEs surface: none A string.prototype.padend@3.1.6 no known CVEs surface: none A string.prototype.trim@1.2.10 no known CVEs surface: none A string.prototype.trimend@1.0.9 no known CVEs surface: none A string.prototype.trimstart@1.0.8 no known CVEs surface: none A strip-bom@3.0.0 no known CVEs surface: none A strip-indent@3.0.0 no known CVEs surface: none A strip-indent@4.1.1 no known CVEs surface: none A strip-json-comments@5.0.3 no known CVEs surface: none A strip-json-comments@3.1.1 no known CVEs surface: none A strnum@2.1.2 no known CVEs surface: none A supports-color@7.2.0 no known CVEs surface: none A supports-color@5.5.0 no known CVEs surface: none A supports-preserve-symlinks-flag@1.0.0 no known CVEs surface: none A svg-parser@2.0.4 no known CVEs surface: none A tabbable@6.4.0 no known CVEs surface: none A tagged-tag@1.0.0 no known CVEs surface: none A tailwind-merge@3.4.0 no known CVEs surface: none A tailwindcss@4.1.18 no known CVEs surface: none A tiny-invariant@1.3.3 no known CVEs surface: none A tiny-warning@1.0.3 no known CVEs surface: none A tinybench@2.9.0 no known CVEs surface: none A tinyglobby@0.2.17 no known CVEs surface: none A tinyglobby@0.2.15 no known CVEs surface: none A tinyrainbow@3.1.0 no known CVEs surface: none A tinyrainbow@2.0.0 no known CVEs surface: none A tinyrainbow@3.0.3 no known CVEs surface: none A tinyspy@4.0.4 no known CVEs surface: none A to-regex-range@5.0.1 no known CVEs surface: none A totalist@3.0.1 no known CVEs surface: none A tr46@5.1.1 no known CVEs surface: none A ts-dedent@2.2.0 no known CVEs surface: none A ts-plugin-sort-import-suggestions@1.0.4 no known CVEs surface: none A tslib@2.8.1 no known CVEs surface: none A tw-animate-css@1.4.0 no known CVEs surface: none A type-check@0.4.0 no known CVEs surface: none A type-fest@5.4.2 no known CVEs surface: none A typed-array-buffer@1.0.3 no known CVEs surface: none A typed-array-byte-length@1.0.3 no known CVEs surface: none A typed-array-byte-offset@1.0.4 no known CVEs surface: none A typed-array-length@1.0.7 no known CVEs surface: none A ufo@1.6.3 no known CVEs surface: none A unbox-primitive@1.1.0 no known CVEs surface: none A undici-types@7.16.0 no known CVEs surface: none A use-composed-ref@1.4.0 no known CVEs surface: none A use-isomorphic-layout-effect@1.2.1 no known CVEs surface: none A use-latest@1.3.0 no known CVEs surface: none A use-sync-external-store@1.6.0 no known CVEs surface: none A validate-npm-package-license@3.0.4 no known CVEs surface: none A vitefu@1.1.1 no known CVEs surface: none A vitest-browser-react@2.0.4 no known CVEs surface: none A void-elements@3.1.0 no known CVEs surface: none A webidl-conversions@7.0.0 no known CVEs surface: none A webpack-virtual-modules@0.6.2 no known CVEs surface: none A whatwg-encoding@3.1.1 no known CVEs surface: none A whatwg-mimetype@4.0.0 no known CVEs surface: none A which-boxed-primitive@1.1.1 no known CVEs surface: none A which-builtin-type@1.2.1 no known CVEs surface: none A which-collection@1.0.2 no known CVEs surface: none A which-typed-array@1.1.20 no known CVEs surface: none A wildcard-match@5.1.4 no known CVEs surface: none A word-wrap@1.2.5 no known CVEs surface: none A wrappy@1.0.2 no known CVEs surface: none A wsl-utils@0.1.0 no known CVEs surface: none A yallist@3.1.1 no known CVEs surface: none A yocto-queue@0.1.0 no known CVEs surface: none A zustand@5.0.10 no known CVEs surface: none
Two cards in that deck to hold onto. better-auth is the loud F near the
top that every scanner would show you. Forty-three cards further down sits
a quiet C, @orpc/openapi, and it turns out to be the interesting one: a
score can tell you what a package carries, but only the full run can tell
you which of these two packages carries code your build can drop. It isn't
the F.
The run
chainstrip run went from nothing to a packed, validated artifact in
24 minutes, unattended. Those minutes are a one-time cost, not a build
tax: every later build reuses the artifact as-is, a PR costs about one
second of fingerprint checking, and only a dependency that actually
changes re-enters the pipeline. Of the 67 runtime dependencies, 30 were extracted
down to what start-ui-web's code reaches, 14 were
pruned conservatively but kept complete, and 23 shipped as pinned stock for
want of evidence. Every one is hash-pinned and update-gated.
| installed | shipped | change | |
|---|---|---|---|
| dependencies | 67 | 30 extracted + 14 pruned + 23 pinned stock | all update-gated |
| files, extracted set | 4,554 | 156 | −96.6% |
| bytes, extracted set | 25.1 MB | 23.2 MB | −7.7% |
The two numbers disagree on purpose. Extraction here removed unreached paths — whole files the app never imports, like the plugin in the next section — while the bytes that remain are mostly code the app genuinely uses. On a starter this young there is little dead weight inside the files it does reach; the wins are elsewhere.
The thin suite shows in the evidence mix: 44 hardened dependencies were overlaid and the suite plus a from-scratch production build (no build cache) passed with zero new failures, but only 5 extractions were validated by tests — the build oracle carried the other 25, and 16 dependencies whose mapped tests fail as-found in the stock repo are recorded as exceptions.
The CVEs
The install carried 75 advisories. After hardening, each has a verdict backed by what's actually in the artifact:
| verdict | count | meaning here |
|---|---|---|
| not shipped | 55 | the affected package or version never enters the artifact — almost always dev or build tooling (test runners, bundlers, linters) that production never needs; that's where most advisories live |
| eliminated | 1 | vulnerable symbol proven dead and removed; build + suite pass without it |
| reached | 14 | start-ui-web really runs this code; the fix is upgrading, not removal |
| unresolved | 5 | advisory too coarse to map to a symbol; disclosed, not cleared |
The eliminated advisory is unpatched in the stock repo today: start-ui-web
ships @orpc/openapi 1.13.4, and the fix for GHSA-7f6v — a HIGH stored XSS in oRPC's
opt-in reference-docs plugin, where renderDocsHtml() embeds a spec into a
<script> tag without escaping — landed upstream only in 1.13.9. start-ui-web
imports oRPC's schema generator and fetch handler but never the docs plugin,
so the run pruned the unreached plugin file and renderDocsHtml(), the
advisory's sink, is provably absent from the shipped tree; the dependency
shrank from 30 files to 16 in the process. A different app that does serve
oRPC docs pages would get reached for the same advisory — the removal is a
property of this project's usage, not of the package.
The other side of the ledger: the 14 reached advisories sit mostly in better-auth and nodemailer, which resolve modules dynamically and therefore ship whole. Their fix is upgrading, and the report says exactly that.
The work
| step | human time |
|---|---|
| cold score on the checkout | ~2 min |
| config file (8 lines) | minutes |
chainstrip run, zero to artifact | none — 24 min unattended |
| total, one-time | under an hour, reading included |
| ongoing, per PR | ~1 s, automatic |
We wrote no tests and ran no probe campaign: everything above is what the
run produces on the suite as found. What the run did leave behind is a
worklist — every under-tested dependency, ranked, with the functions in
start-ui-web's own code that call it. It's real output, and @orpc/client
sits on top of it with a live CRITICAL and 3% coverage:
$ chainstrip coverage --callers
whole-suite coverage gap — 5 deps measured · median 18% of functions executed
0–25%: 4 · 25–50%: 0 · 50–75%: 1 · 75–100%: 0
⚠ = vulnerable AND under-tested (live CVE + low coverage) — TEST THESE FIRST.
LEAST-COVERED — under-tested deps and YOUR functions that use them (write tests for those):
3% @orpc/client ⚠ 1 live CVE (CRITICAL) (7/208 fns run, 201 never run, 2 file(s) never loaded) · e.g. assertEventComment, assertEventId, assertEventName, assertEventRetry…
src/features/book/app/page-book.tsx → (anonymous)
src/features/book/manager/page-book-new.tsx → onError
src/features/book/manager/page-book-update.tsx → onError
src/features/book/manager/page-book.tsx → (anonymous)
src/features/user/manager/page-user-new.tsx → onError
src/features/user/manager/page-user-update.tsx → (anonymous), onError
src/features/user/manager/page-user.tsx → (anonymous)
src/lib/orpc/client.ts → (anonymous), (module scope)
src/server/routers/book.ts → (anonymous)
src/server/routers/user.ts → (anonymous)
1% remeda (5/408 fns run, 403 never run, 1 file(s) never loaded) · e.g. a, a$1, a$2, a$3…
src/components/form/field-number/index.tsx → formatValue
src/features/book/manager/form-book.tsx → FormBook
src/lib/i18n/config.ts → (module scope)
18% zod (407/2203 fns run, 1796 never run, 9 file(s) never loaded) · e.g. $ZodAny, $ZodArray, $ZodAsyncError, $ZodBase64…
src/env/client.ts → (module scope)
src/env/server.ts → (module scope), zOptionalWithReplaceMe
src/features/account/schema.ts → zFormFieldsAccountUpdateName
src/features/auth/permissions.ts → zRole
src/features/auth/schema.ts → zFormFieldsLogin, zFormFieldsLoginVerify, zFormFieldsOnboarding, zOtp
src/features/book/schema.ts → zBook
src/features/genre/schema.ts → zGenre
src/features/user/schema.ts → zSession, zUser
src/lib/zod/zod-utils.ts → nullable, nullish, optional, required
src/routes/login/error.index.tsx → (module scope)
src/routes/login/verify.index.tsx → (module scope)
src/routes/manager/books/index.tsx → (module scope)
src/routes/manager/users/index.tsx → (module scope)
src/server/logger.ts → messageFormat
src/server/routers/account.ts → (module scope)
src/server/routers/book.ts → (module scope)
src/server/routers/config.ts → (module scope)
src/server/routers/genre.ts → (module scope)
src/server/routers/user.ts → (module scope)
18% @orpc/server (42/237 fns run, 195 never run, 8 file(s) never loaded) · e.g. $config, $input, $meta, $route…
src/routes/api/rest.$.ts → (module scope)
src/routes/api/rpc.$.ts → (module scope)
src/server/orpc.ts → (anonymous), (module scope)
54% dayjs (55/102 fns run, 47 never run, 4 file(s) never loaded) · e.g. $g, $utils, a, add…
src/components/ui/date-input.tsx → DateInput, handleInputBlur, handleInputChange, useDatePickerInputManagement
src/features/build-info/script-to-generate-json.ts → getContent
src/features/user/manager/page-user.tsx → (anonymous)
src/features/user/manager/page-users.tsx → (anonymous)
src/lib/dayjs/config.ts → (module scope)
src/lib/dayjs/parse-string-to-date.ts → parseStringToDate
src/lib/i18n/index.ts → syncLanguage
The generated work order is just as real, and on this repo it currently declines every target: 0 testable, 30 recommended skips, each carrying its reason — imports that live outside the unit runner's scope, wiring-only imports an isolated test can't exercise. The evidence path for this tree runs through e2e and probes rather than unit tests, and until one of those is spent, the numbers above are a floor.
# Test-writing task — close chainstrip coverage gaps for start-ui-web You are an expert test author. Write tests that exercise the dependencies below by testing **this project's own functions that call them**. The goal is **attack surface removed — safely**. Each dep is tagged by exactly what a test buys, and the list is ordered by payoff: - **UNLOCK <size>** — the dep ships whole or under weaker evidence today (no test loads it, or covtrim's trim rolled back). A test lets chainstrip measure/remove it: NEW surface reduction. These are the biggest wins. - **CLASSIFY <size>** — functions reachable from your imports that no test ever executed. A test converts unknown risk into truth: what it executes is proven LIVE (correctly kept — a false-dead averted); what stays unexecuted stays held. Safety value, not bytes. - **FIRM UP <size>** — chainstrip already shipped stubs on reachable-but-unexecuted functions (aggressive mode). A test on those paths retires the false-dead risk (or catches the live one before production does). De-risking, not new bytes. ## How to write the tests - Test runner: **vitest** (`pnpm vitest run`). Match this repo's existing tests — open a neighbouring `*.test.*` first and copy its import style, setup, and mocking. - Do NOT test the dependency's API directly. Test **your** function at the call site listed under each dep — exercising your REAL, used path is what proves the app works without the dependency's unused code. - **DETERMINISM IS THE #1 REQUIREMENT — a flaky test is WORSE than no test.** chainstrip removes a dependency's unexercised functions only if every test that touches that dep passes *repeatably* against the trimmed copy; if a test flakes even once, it REVERTS the removal — so a timing-flaky test will DESTROY eliminations the existing suite already had. Therefore: never use `setTimeout`, arbitrary `await new Promise(r => setTimeout(r,0))`, or any wall-clock wait to let async work "settle." Instead **`await` the real promise**, or **capture synchronously at call time** (e.g. record the argument inside a `sendMail`/handler spy when it is *called*, not after it resolves). If a value is produced asynchronously, await the actual operation — don't guess a delay. - You do NOT need to reach the "never-run functions" listed per dep — chainstrip will remove them *because* they're unexercised. Reaching them keeps them in the artifact. Just cover the path your code genuinely uses, cleanly. (The list is shown only so you recognise which behaviour is already covered vs not.) - Mock only external I/O (network, DB, clock) the way nearby tests do. Every test must assert real behaviour, not just call-and-ignore. - Put each test next to the file under test. Run each file you write multiple times (`pnpm vitest run <path>`, twice) to confirm it is NOT flaky before moving on. - Do NOT conclude a location can't run under the test runner by reading workspace/config files — two prior sessions skipped valid targets that way. VERIFY empirically (run the runner's list command on your intended path, or run a trivial probe test there); only a verified exclusion counts, and report it as such. Entries below include "Runner evidence" — a traced test that already runs near the call site — when we have it. ## Priority worklist ⚠ = has a live CVE AND is under-tested — do these first. ## Recommended skips — reasons given; override only with good cause 30 dep(s) we recommend NOT writing unit tests for. Each lists why — if you disagree (e.g. you can add a test under the right runner, or an e2e), go ahead; otherwise leave them: they are covered by the production-build oracle + pinning. - `kysely` (~1.3MB) — skip because it has no plain function call site — only module-scope/DI/decorator wiring imports it, so a unit test can't exercise it in isolation. An e2e/integration test could; meanwhile the production-build oracle + pinning cover it. imported at: `.output/server/_ssr/router-Cc0R36Wx.mjs` - `nodemailer` (~489KB) — skip because it has no plain function call site — only module-scope/DI/decorator wiring imports it, so a unit test can't exercise it in isolation. An e2e/integration test could; meanwhile the production-build oracle + pinning cover it. imported at: `.output/server/_id.index-8XoSUQMz.mjs`, `.output/server/_id.index-DNNFTVm6.mjs`, `.output/server/_id.index-DZpXMhtm.mjs`, `.output/server/_id.update.index-BSLkHcXb.mjs` … - `@orpc/client` (~37KB) — skip because every importer sits outside vitest's scope (no traced test file lives in those packages) — a unit test here can't load it via the sanctioned runner. Coverable only with that package's own runner or an e2e. imported at: `src/features/book/app/page-book.tsx`, `src/features/book/manager/page-book-new.tsx`, `src/features/book/manager/page-book-update.tsx`, `src/features/book/manager/page-book.tsx` … - `vite-tsconfig-paths` (~9.1MB) — skip because it has no plain function call site — only module-scope/DI/decorator wiring imports it, so a unit test can't exercise it in isolation. An e2e/integration test could; meanwhile the production-build oracle + pinning cover it. imported at: `vite.storybook.ts` - `@faker-js/faker` (~4.0MB) — skip because every importer sits outside vitest's scope (no traced test file lives in those packages) — a unit test here can't load it via the sanctioned runner. Coverable only with that package's own runner or an e2e. imported at: `prisma/seed/book.ts`, `prisma/seed/user.ts` - `@storybook/react-vite` (~453KB) — skip because it has no plain function call site — only module-scope/DI/decorator wiring imports it, so a unit test can't exercise it in isolation. An e2e/integration test could; meanwhile the production-build oracle + pinning cover it. imported at: `.storybook/main.ts`, `.storybook/preview.tsx` - `@tanstack/react-router-devtools` (~312KB) — skip because every importer sits outside vitest's scope (no traced test file lives in those packages) — a unit test here can't load it via the sanctioned runner. Coverable only with that package's own runner or an e2e. imported at: `src/routes/__root.tsx` - `@tanstack/react-query` (~297KB) — skip because every importer sits outside vitest's scope (no traced test file lives in those packages) — a unit test here can't load it via the sanctioned runner. Coverable only with that package's own runner or an e2e. imported at: `src/components/upload/upload-button.tsx`, `src/components/upload/upload-input.tsx`, `src/components/upload/utils.tsx`, `src/devtools/maildev.tsx` … - `@fontsource-variable/inter` (~222KB) — skip because it has no plain function call site — only module-scope/DI/decorator wiring imports it, so a unit test can't exercise it in isolation. An e2e/integration test could; meanwhile the production-build oracle + pinning cover it. imported at: `src/providers.tsx` - `cnfast` (~208KB) — skip because it has no plain function call site — only module-scope/DI/decorator wiring imports it, so a unit test can't exercise it in isolation. An e2e/integration test could; meanwhile the production-build oracle + pinning cover it. imported at: `src/lib/tailwind/utils.ts` - `i18next` (~163KB) — skip because every importer sits outside vitest's scope (no traced test file lives in those packages) — a unit test here can't load it via the sanctioned runner. Coverable only with that package's own runner or an e2e. imported at: `src/features/auth/schema.ts`, `src/features/book/schema.ts`, `src/features/genre/schema.ts`, `src/features/user/schema.ts` … - `zod` (~140KB) — skip because every importer sits outside vitest's scope (no traced test file lives in those packages) — a unit test here can't load it via the sanctioned runner. Coverable only with that package's own runner or an e2e. imported at: `src/components/form/form-test-utils.tsx`, `src/env/client.ts`, `src/env/server.ts`, `src/features/account/schema.ts` … - `pino-pretty` (~125KB) — skip because it has no plain function call site — only module-scope/DI/decorator wiring imports it, so a unit test can't exercise it in isolation. An e2e/integration test could; meanwhile the production-build oracle + pinning cover it. imported at: `src/server/logger.ts` - `@better-upload/server` (~102KB) — skip because every importer sits outside vitest's scope (no traced test file lives in those packages) — a unit test here can't load it via the sanctioned runner. Coverable only with that package's own runner or an e2e. imported at: `src/routes/api/upload.ts`, `src/server/s3.ts`, `src/server/upload/book-cover.ts` - `@vueless/storybook-dark-mode` (~59KB) — skip because every importer sits outside vitest's scope (no traced test file lives in those packages) — a unit test here can't load it via the sanctioned runner. Coverable only with that package's own runner or an e2e. imported at: `.storybook/preview.tsx` - `@uidotdev/usehooks` (~34KB) — skip because every importer sits outside vitest's scope (no traced test file lives in those packages) — a unit test here can't load it via the sanctioned runner. Coverable only with that package's own runner or an e2e. imported at: `src/hooks/use-clipboard.ts` - `i18next-browser-languagedetector` (~32KB) — skip because it has no plain function call site — only module-scope/DI/decorator wiring imports it, so a unit test can't exercise it in isolation. An e2e/integration test could; meanwhile the production-build oracle + pinning cover it. imported at: `src/lib/i18n/index.ts` - `@orpc/server` (~27KB) — skip because every importer sits outside vitest's scope (no traced test file lives in those packages) — a unit test here can't load it via the sanctioned runner. Coverable only with that package's own runner or an e2e. imported at: `src/lib/orpc/client.ts`, `src/routes/api/rest.$.ts`, `src/routes/api/rpc.$.ts`, `src/server/orpc.ts` … - `@better-upload/client` (~20KB) — skip because every importer sits outside vitest's scope (no traced test file lives in those packages) — a unit test here can't load it via the sanctioned runner. Coverable only with that package's own runner or an e2e. imported at: `src/components/upload/upload-button.tsx`, `src/components/upload/upload-input.tsx` - `@tanstack/react-query-devtools` (~17KB) — skip because every importer sits outside vitest's scope (no traced test file lives in those packages) — a unit test here can't load it via the sanctioned runner. Coverable only with that package's own runner or an e2e. imported at: `src/routes/__root.tsx` - `@hookform/resolvers` (~16KB) — skip because every importer sits outside vitest's scope (no traced test file lives in those packages) — a unit test here can't load it via the sanctioned runner. Coverable only with that package's own runner or an e2e. imported at: `src/components/form/form-test-utils.tsx`, `src/features/account/change-name-drawer.tsx`, `src/features/auth/page-login-verify.tsx`, `src/features/auth/page-login.tsx` … - `colorette` (~12KB) — skip because every importer sits outside vitest's scope (no traced test file lives in those packages) — a unit test here can't load it via the sanctioned runner. Coverable only with that package's own runner or an e2e. imported at: `src/server/logger.ts` - `zustand` (~8KB) — skip because it has no plain function call site — only module-scope/DI/decorator wiring imports it, so a unit test can't exercise it in isolation. An e2e/integration test could; meanwhile the production-build oracle + pinning cover it. imported at: `src/features/auth/mascot.ts`, `src/features/demo/demo-mode-drawer.tsx`, `src/layout/app/layout.tsx` - `react-error-boundary` (~8KB) — skip because every importer sits outside vitest's scope (no traced test file lives in those packages) — a unit test here can't load it via the sanctioned runner. Coverable only with that package's own runner or an e2e. imported at: `src/components/errors/error-boundary.tsx` - `@tanstack/zod-adapter` (~5KB) — skip because it has no plain function call site — only module-scope/DI/decorator wiring imports it, so a unit test can't exercise it in isolation. An e2e/integration test could; meanwhile the production-build oracle + pinning cover it. imported at: `src/routes/login/error.index.tsx`, `src/routes/login/verify.index.tsx`, `src/routes/manager/books/index.tsx`, `src/routes/manager/users/index.tsx` - `@orpc/react-query` (~5KB) — skip because it has no plain function call site — only module-scope/DI/decorator wiring imports it, so a unit test can't exercise it in isolation. An e2e/integration test could; meanwhile the production-build oracle + pinning cover it. imported at: `src/lib/orpc/client.ts` - `@t3-oss/env-core` (~4KB) — skip because it has no plain function call site — only module-scope/DI/decorator wiring imports it, so a unit test can't exercise it in isolation. An e2e/integration test could; meanwhile the production-build oracle + pinning cover it. imported at: `src/env/client.ts`, `src/env/server.ts` - `@bearstudio/ui-state` (~3KB) — skip because every importer sits outside vitest's scope (no traced test file lives in those packages) — a unit test here can't load it via the sanctioned runner. Coverable only with that package's own runner or an e2e. imported at: `src/components/upload/upload-input.tsx`, `src/devtools/maildev.tsx`, `src/features/book/app/page-book.tsx`, `src/features/book/app/page-books.tsx` … - `dayjs` (~2KB) — skip because every importer sits outside vitest's scope (no traced test file lives in those packages) — a unit test here can't load it via the sanctioned runner. Coverable only with that package's own runner or an e2e. imported at: `src/components/ui/date-input.tsx`, `src/features/build-info/script-to-generate-json.ts`, `src/features/user/manager/page-user.tsx`, `src/features/user/manager/page-users.tsx` … - `remeda` (~0KB) — skip because every importer sits outside vitest's scope (no traced test file lives in those packages) — a unit test here can't load it via the sanctioned runner. Coverable only with that package's own runner or an e2e. imported at: `src/components/form/field-number/index.tsx`, `src/features/book/manager/form-book.tsx`, `src/lib/i18n/config.ts` ## When done Run `pnpm vitest run` until green, then re-run `chainstrip coverage` — the covered percentages should rise and chainstrip can trim/eliminate more of those dependencies. _Generated by `chainstrip coverage --prompt` at 2026-07-26T19:16:22.547Z. Worklist is prioritised: live-CVE deps first, then least-covered._
What's left
The 23 pinned-stock dependencies are held for want of evidence, not proof of safety: hash-pinned, update-gated, and waiting on the tests or probes this repo doesn't have yet. The 14 reached advisories are upgrade work ChainStrip can't do for the team — better-auth's are the loudest, and it ships whole because its dynamic module resolution can't be pruned safely. Sixteen dependencies have mapped tests that fail in the stock checkout, so their extractions leaned on the build oracle alone; that boundary is recorded per-dependency in the run report, and two conservative prunes that validation pushed back on were restored rather than shipped.
And the standing caveat: "eliminated" above means proven dead, removed from the artifact, and revalidated by start-ui-web's own build and suite — not "verified safe in production."
Sound like your stack?
These results should transfer if:
- You're on a modern TypeScript meta-framework (TanStack Start, Next.js, Remix-class) with a pnpm or npm workspace and a young codebase.
- Your test suite is thin — a handful of files, not a wall. The build oracle carries validation until the tests arrive, and the worklist tells you which tests are worth writing first.
- Your auth or payments run through a large dynamic library you could never prune — the honest outcome there is pinned-whole and update-gated, and the wins come from everything around it.
- You want a day-one result without writing a single test: here that was one live HIGH XSS out of the artifact and 55 advisories that never enter it, in 24 unattended minutes.
Book a demo A 15-minute walkthrough: a live elimination on an open-source tree, plus a rough cut of your own ladder from nothing but your lockfile.