[AUTO] Bug Check: npm audit reports 5 vulnerabilities (2 critical, 3 high)

[faizalmy]

Summary

Automated QA scan on main (June 16, 2026) found 5 known vulnerabilities in dependencies via npm audit. All are fixable via npm audit fix.

Status of other checks

Check	Result
Tests (vitest)	✅ 36 files, 712/712 passed
TypeScript (tsc --noEmit)	✅ No type errors
ESLint	✅ 0 errors (118 warnings, all in test files)
Build	✅ Compiled successfully
TODO/FIXME/HACK/XXX	✅ None found
console.log in production	✅ None active (only commented-out)
Export integrity	✅ All 29 exported components have source files

Vulnerabilities

Package	Severity	Advisory	Range
shell-quote	Critical	GHSA-w7jw-789q-3m8p — quote() does not escape newlines in object .op values	1.1.0 – 1.8.3
form-data	High	GHSA-hmw2-7cc7-3qxx — CRLF injection via unescaped multipart field names	4.0.0 – 4.0.5
vite	High	GHSA-v6wh-96g9-6wx3 / GHSA-fx2h-pf6j-xcff — NTLM hash disclosure + fs.deny bypass on Windows	8.0.0 – 8.0.15
ws	High	GHSA-58qx-3vcg-4xpx / GHSA-96hv-2xvq-fx4p — Memory disclosure + DoS from tiny fragments	8.0.0 – 8.20.1

Dependency chain

• shell-quote is pulled in by concurrently (devDependency)
• vite, ws are devDependencies (vitest)
• form-data is a devDependency

All are dev dependencies only and do not affect end-users consuming the published @keenthemes/ktui package. However, they do affect development environments and CI.

Suggested fix

npm audit fix

If automatic resolution does not bump all packages, manually update:

npm update concurrently vite ws form-data

[faizalmy]

QA Re-check — June 19, 2026

The 5 vulnerabilities reported on June 16 still persist unchanged:

Package	Severity	Status
shell-quote (via concurrently)	Critical	Still vulnerable
form-data	High	Still vulnerable
vite	High	Still vulnerable
ws	High	Still vulnerable

Running npm audit fix should resolve all of these. All other QA checks remain clean:

• ✅ Tests: 712/712 passing (36 files)
• ✅ TypeScript: 0 errors
• ✅ ESLint: 0 errors (118 warnings, all in test files)
• ✅ Build: compiles successfully
• ✅ No TODO/FIXME/HACK/XXX comments
• ✅ No active console.log in source
• ✅ All exports verified