📦 Dependency Issues: Deprecated Packages & Security Vulnerabilities

[lzw-git-all]

Summary

Running npm install on a fresh clone reveals multiple deprecated packages and 4 security vulnerabilities (1 moderate, 3 high).

Deprecated Packages

The following dependencies are deprecated:

Package	Version	Note
rimraf	3.0.2	No longer supported, upgrade to v4+
npmlog	5.0.1	No longer supported
inflight	1.0.6	Memory leak, use lru-cache instead
tar	6.2.1	Security vulnerabilities, upgrade needed
glob	7.2.3	Security vulnerabilities, upgrade needed
are-we-there-yet	2.0.0	No longer supported
gauge	3.0.2	No longer supported

These appear to be transitive dependencies from bcrypt → @mapbox/node-pre-gyp.

Security Vulnerabilities

4 vulnerabilities (1 moderate, 3 high)

Package	Severity	Issue
brace-expansion < 1.1.13	Moderate	Zero-step sequence causes process hang and memory exhaustion
path-to-regexp < 0.1.13	High	ReDoS via multiple route parameters
tar <= 7.5.10	High	Multiple path traversal / arbitrary file overwrite vulnerabilities

All are fixable via npm audit fix.

Steps to Reproduce

git clone <repo>
cd nexus4cc
npm install
npm audit

Suggested Actions

1. Run npm audit fix to apply safe updates
2. Consider updating bcrypt to a newer version (currently ^5.1.1) that uses updated build dependencies
3. Review if path-to-regexp (from Express) can be updated separately

Environment

• Node.js: v24.14.1
• npm: 11.11.0
• OS: Linux

---

Thanks for this great project!