[ehe9991]

Problem

npm audit reports 20 dev-only advisories (2 critical, 13 high). The published package has no dependencies, and npm audit --omit=dev is clean, so none reach n8n users. Dependabot shows only 3 of them (axios, stream-json, uuid).

Solution

Lockfile-only: brace-expansion 1.1.18 → 1.1.21 and 5.0.9 → 5.0.12, within existing ranges. This fixes GHSA-6j4f-fj2g-mc7p (high), GHSA-qhr7-859c-m2p7 (high) and GHSA-q2hr-2g5m-vwhr. Both versions were published at least 7 days ago by the same publisher (juliangruber), and their integrity hashes match the registry.

The rest is blocked upstream for now:

• axios 1.18.0 (12 advisories, incl. Dependabot #37): n8n-workflow pins it exactly. The first release pinning 1.20.0 is 2.43.4, published 2026-10-15. Bump n8n-workflow once it is at least 7 days old.
• handlebars 4.7.9 (2 critical) and qs 6.15.2: exact pins inside @n8n/node-cli (through 0.53.1) and @n8n/backend-network.
• stream-json 1.9.1 (Bump undici from 7.29.1 to 7.30.1 #33) and uuid 10.0.0 (Bump typescript from 5.9.3 to 7.0.2 #27): fixes need cross-major jumps inside @n8n/node-cli's AI-SDK chain.
• braces: no patched release exists.

overrides would fix most of these, but n8n-node lint rejects that field in community packages (@n8n/community-nodes/no-overrides-field).

Note: #29 adds npm audit --audit-level=high to validate. Until the upstream pins move, that gate fails on the axios and handlebars highs.

Testing

CI green on Node 22.22 and 24. Locally, npm ci and npm run validate pass: prettier, lint, typecheck, 21/21 tests, npm audit --omit=dev, check-package.

🤖 Generated with Claude Code