No known critical vulnerabilities in dependencies

Dependencies that are multiple major versions behind their current release accumulate unpatched CVEs — many of them publicly documented with working exploits and CVSS scores above 9.0. React 16 shipped before multiple prototype pollution and XSS fixes present in React 18+; Next.js 10 predates authentication bypass fixes in later versions. OWASP A06 (Vulnerable and Outdated Components) is the top-ranked supply chain risk for web apps. CWE-1104 (Use of Unmaintained Third Party Components) and SSDF PW.4.1 (Identify and confirm vulnerabilities in software) directly apply. Known-compromised packages like event-stream@3.3.6 are particularly dangerous because the malicious code runs in your build environment, not just at runtime.

Run npm audit to enumerate known vulnerabilities and apply automatic fixes where safe. Review the output for critical and high severity findings before accepting any changes.

# Enumerate all vulnerabilities
npm audit

# Apply safe automatic fixes
npm audit fix

# Force-fix breaking changes (review the diff before committing)
npm audit fix --force

For dependencies that can't be auto-fixed, check the advisory linked in the audit output for the manual upgrade path. Prioritize production dependencies over devDependencies — devDep vulnerabilities rarely affect deployed code. For ongoing supply chain monitoring, the Dependency & Supply Chain Audit covers lockfile integrity, typosquatting, and license compliance.