calcom/cal.diy dependency check
Scheduling infrastructure for absolutely everyone.
calcom/cal.diy: 2 critical findings, fixed by upgrading next to 16.3.8 and node:20 to node:24. Plus 4 warnings.
Last checked against GitHub, OSV.dev, deps.dev, CISA KEV, FIRST EPSS, endoflife.date, Docker Hub and npm.
6 things your coding agent doesn’t know about this repo
calcom/cal.diy on GitHub (opens in a new tab)
2 critical4 warnings36 low priority
One task with every fix, most urgent first, the file to change and why. Paste it into Claude Code, Cursor or Codex.
Folders matching apps/*, apps/api/*, packages/* weren't read (that needs a full listing of the repo). To check one, paste its folder link (github.com/owner/repo/tree/main/packages/name) or drop its files here.
- CriticalVulnerabilitypackages/platform/examples/base/package.json
30 known vulnerabilities in next 16.2.3
EPSS: top 19%15 rated high or critical. Most serious: CVE-2026-75604, Next.js: Unauthenticated Remote Code Execution on windows-hosted servers. Upgrading to 16.3.8 fixes all of them.
- CriticalEnd of lifeDockerfile:1
Base image node:20 is end-of-life
Dockerfile line 1 builds on Node.js 20, which stopped getting security fixes on 2026-04-30. Move to node:24.
- WarningVulnerabilitypackages/platform/examples/base/package.json
4 known vulnerabilities in postcss 8.5.6
EPSS: top 53%Dev onlyMost serious: CVE-2026-45623, PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments. Upgrading to 8.5.23 fixes all of them.
- WarningVulnerabilitypackage.json
CVE-2026-73231 in @faker-js/faker 9.2.0
EPSS: top 90%Dev onlyFaker: helpers.fake exploitable into arbritary code execution. Fixed in 10.5.0.
- WarningOutdatedpackages/app-store/package.json
react-i18next 12.3.1 is 5 major versions behind
Latest release is 17.0.21.
- WarningOutdatedpackages/platform/examples/base/package.json
prisma 6.16.1 is 2 major versions behind
Latest release is 8.0.0-rc.23.
Checked 48 packages and 4 base images from package.json, yarn.lock, docker-compose.yml, Dockerfile and 2 more against:
Add this badge to your README
It shows today’s result and links to this report, so anyone opening the repo sees what needs fixing.
[](https://stackprism.ai/check/github/calcom/cal.diy)What next
Want your agent to check before it adds a package? Connect Claude Code, Cursor or Codex to StackPrism. Setup steps
Ask Prism Agent about calcom/cal.diy
Map the repo (free) and ask what to fix first, whether an upgrade is safe, or what breaks if a service goes down. Prism Agent checks live sources before it answers.
How this report works
StackPrism read package.json, yarn.lock, docker-compose.yml, Dockerfile and 2 more from the default branch of calcom/cal.diy and checked its 48 packages and 4 base images against GitHub, OSV.dev, deps.dev, CISA KEV, FIRST EPSS, endoflife.date, Docker Hub and npm. Nothing was installed or run, and there’s no AI in the findings: each one comes from a source you can open.
Vulnerabilities come from OSV.dev, with known-exploited ones from CISA marked and listed first. Runtimes, frameworks and base images are checked against endoflife.date, and packages against their registry for deprecations and major versions you’ve fallen behind. The fix task above lists every change with the file to edit.
This page refreshes every few hours; after you push a fix, “Check again” runs it now. Only the repo’s root is read. For an app in a sub-folder, paste the folder’s link into the dependency check, and for a private repo, connect GitHub.