shadcn-ui/taxonomy dependency check
An open source application built using the new router, server components and everything new in Next.js 13.
shadcn-ui/taxonomy: 6 critical findings, each with a fixed version. Plus 8 warnings.
Last checked against GitHub, OSV.dev, deps.dev, CISA KEV, FIRST EPSS, npm and endoflife.date.
14 things your coding agent doesn’t know about this repo
shadcn-ui/taxonomy on GitHub (opens in a new tab)
6 critical8 warnings47 low priority
One task with every fix, most urgent first, the file to change and why. Paste it into Claude Code, Cursor or Codex.
- CriticalVulnerabilitypackage.json
30 known vulnerabilities in next 13.3.2-canary.13
EPSS: top 1%12 rated high or critical. Most serious: CVE-2025-29927, Authorization Bypass in Next.js Middleware. Upgrading to 15.5.24 fixes all of them.
13.3.2-canary.1315.5.24View advisory, source: OSV.dev (opens in a new tab)Upgrade notes (opens in a new tab) - CriticalVulnerabilitypackage.json
15 known vulnerabilities in nodemailer 6.9.1
EPSS: top 20%5 rated high or critical. Most serious: CVE-2026-92596, Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address list. Upgrading to 10.0.6 fixes all of them.
- CriticalVulnerabilitypackage.json
5 known vulnerabilities in next-auth 4.22.1
EPSS: top 42%2 rated high or critical. Most serious: CVE-2026-73418, Auth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers. Upgrading to 4.24.15 fixes all of them.
- CriticalVulnerabilitypackage.json
4 known vulnerabilities in sharp 0.31.3
4 rated high or critical. Most serious: GHSA-54xq-cgqr-rpm3, sharp vulnerability in libwebp dependency CVE-2023-4863. Upgrading to 0.35.5 fixes all of them.
- CriticalEnd of life.nvmrc
Node.js 16 is end-of-life
Support ended 2023-09-11. No more security fixes — upgrade to Node.js 24 LTS (24.22.0).
- CriticalEnd of lifepackage.json
Next.js 13 is end-of-life
Support ended 2024-12-21. No more security fixes — upgrade to Next.js 16 LTS (16.4.1).
- WarningVulnerabilitypackage.json
5 known vulnerabilities in postcss 8.4.23
EPSS: top 39%Dev onlyMost serious: CVE-2026-45623, PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments. Upgrading to 8.5.23 fixes all of them.
- WarningVulnerabilitypackage.json
CVE-2023-4316 in zod 3.21.4
EPSS: top 41%Zod denial of service vulnerability. Fixed in 3.22.3.
- WarningOutdatedpackage.json
@hookform/resolvers 3.1.0 is 2 major versions behind
Latest release is 5.9.1.
- WarningOutdatedpackage.json
@prisma/client 4.13.0 is 3 major versions behind
Latest release is 7.10.0.
- WarningOutdatedpackage.json
@typescript-eslint/parser 5.59.0 is 3 major versions behind
Latest release is 8.71.2.
- WarningOutdatedpackage.json
concurrently 8.0.1 is 2 major versions behind
Latest release is 10.0.6.
- WarningOutdatedpackage.json
date-fns 2.29.3 is 2 major versions behind
Latest release is 4.4.0.
- WarningOutdatedpackage.json
postmark 3.0.15 is 2 major versions behind
Latest release is 5.1.0.
Checked 100 packages from package.json, pnpm-lock.yaml and .nvmrc against:
Add this badge to your README
It shows today’s result and links to this report, so anyone opening the repo sees what needs fixing.
[](https://stackprism.ai/check/github/shadcn-ui/taxonomy)What next
Want your agent to check before it adds a package? Connect Claude Code, Cursor or Codex to StackPrism. Setup steps
Ask Prism Agent about shadcn-ui/taxonomy
Map the repo (free) and ask what to fix first, whether an upgrade is safe, or what breaks if a service goes down. Prism Agent checks live sources before it answers.
How this report works
StackPrism read package.json, pnpm-lock.yaml and .nvmrc from the default branch of shadcn-ui/taxonomy and checked its 100 packages against GitHub, OSV.dev, deps.dev, CISA KEV, FIRST EPSS, npm and endoflife.date. Nothing was installed or run, and there’s no AI in the findings: each one comes from a source you can open.
Vulnerabilities come from OSV.dev, with known-exploited ones from CISA marked and listed first. Runtimes, frameworks and base images are checked against endoflife.date, and packages against their registry for deprecations and major versions you’ve fallen behind. The fix task above lists every change with the file to edit.
This page refreshes every few hours; after you push a fix, “Check again” runs it now. Only the repo’s root is read. For an app in a sub-folder, paste the folder’s link into the dependency check, and for a private repo, connect GitHub.