dependencies

Most recent npm/PyPI compromises were detected and yanked within hours: debug+chalk (~2h live, 2025-09), litellm (~40min, 2026-03), axios (~3h, 2026-04), lottie-player (~2h, 2024-10), ua-parser-js (~4...

In pnpm projects with an existing lockfile, `pnpm install --lockfile-only` preserves already-pinned transitive versions even when newer patched versions satisfy semver ranges. To remediate advisories ...