Distillation

🔴 (09:35) Root package.json is @sentry/craft v2.27.0-dev.0. Node 22.12.0, pnpm 10.27.0 (Volta). All deps are devDependencies except 5 runtime deps: fastest-levenshtein ^1.0.16, ignore ^7.0.5, marked ^17.0.1, p-limit ^6.2.0, semver ^7.7.3.

🔴 (09:35) Root package.json pnpm overrides: fast-xml-parser ^5.8.0, minimatch ^10.2.1, ajv@<6.14.0 → ^6.14.0, postcss ^8.5.10, rollup ^4.59.0, flatted ^3.4.2, picomatch@<3 → ^2.3.2, uuid ^14.0.0, @tootallnate/once ^2.0.1.

🔴 (09:35) docs/package.json is craft-docs v1.0.0 (private). Deps: @astrojs/starlight ^0.38.3, astro ^6.1.10, sharp ^0.33.5. pnpm overrides: h3 ^1.15.6, devalue ^5.8.1, rollup ^4.59.0, svgo ^4.0.1, smol-toml ^1.6.1, defu ^6.1.5.

🔴 (09:36) Vulnerability #1 — tar@7.5.11 (root pnpm-lock.yaml): appears at lines 2779 and 6007 (two entries). Root package.json pins tar: 7.5.11 directly in devDependencies. Fix: bump to >= 7.5.16.

🔴 (09:36) Vulnerability #2 — form-data (root pnpm-lock.yaml): two copies present. form-data@2.5.5 (lines 2120, 5350) pulled in transitively by @types/request@2.48.13 (lockfile line 4748). form-data@4.0.4 (lines 2124, 5359) pulled in transitively by @types/node-fetch@2.6.13 (lockfile line 4714). Fix: form-data@2.5.5 needs >= 2.5.6; form-data@4.0.4 needs >= 4.0.6.

🔴 (09:36) Vulnerability #3 — vite (root pnpm-lock.yaml): vite@7.3.2 present at lines 2871 and 6103. Pulled in by vitest@4.1.8 (line 6116→6136) which depends on vite: 7.3.2(@types/node@22.19.1)(tsx@4.21.0). vite@7.3.2 in turn depends