[Kinfe123]

The site lockfile includes known vulnerable versions of Vite, Sharp/libvips, nanoid, TOML, YAML, and ts-deepmerge. Pin patched transitive versions and use Vite 7.3.7, which remains within the installed React/Tailwind plugins’ peer ranges. Keep the existing Farm and agent/transport versions.

Validation on Node 24:

• Clean npm install, TypeScript, and production build passed.
• All 45 host tests passed with PostgreSQL enabled and no skips.
• Production browser/terminal synchronization, session isolation/restart, managed boot, diagnostics, and connected-file read/edit/readback passed, including plain attach, terminal UI, and whole-filesystem access.
• Development-server checks passed in both memory and local workspace modes.
• Vercel build and isolated function artifact checks passed for the app, docs, and raw Markdown routes. GitHub native/WASM/host CI and the Vercel preview deployment passed.

npm audit --omit=dev drops from 42 affected-package entries (22 high) to 20 (6 high); this is not an audit-clean claim. Remaining reports originate in braces, sprintf-js, Unhead 1, and uuid and propagate to their parents. Braces/sprintf-js have no patched release in the registry at review time. Tress does not use Unhead or uuid APIs directly; those are inherited framework/Scalar/ORM dependencies. The actual just-bash runtime rejects oversized printf widths and awk precision before allocation (verified locally). Do not force incompatible upstream majors solely to hide audit entries. Remaining advisories need upstream follow-up.

No production deployment or package release is included.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
tress	Ready	Preview	Oct 16, 2026 6:57pm UTC