Atlas

Appearance

Dependencies Audit ​

Last updated: February 2, 2026

This document provides a comprehensive audit of all dependencies in the Atlas monorepo, covering licenses, versions, security vulnerabilities, and single points of failure (SPOF).

Executive Summary ​

MetricValueStatus
Total dependencies1391-
Direct dependencies~60-
Security vulnerabilities6 (2 low, 4 moderate)⚠️
Outdated packages16🟡
License compliance100%✅
SPOF identified4 critical⚠️

Security Vulnerabilities ​

Current Vulnerabilities (6 total) ​

PackageSeverityCVEIssueFix Available
esbuildModerateGHSA-67mhCORS vulnerability in dev server✅ >=0.25.0
cookieLowCVE-2024-47764Cookie name injection✅ >=0.7.0
@eslint/plugin-kitLowGHSA-xffmReDoS in ConfigCommentParser✅ >=0.3.4
lodash-esModerateCVE-2025-13465Prototype pollution in _.unset/_.omit✅ >=4.17.23
lodashModerateCVE-2025-13465Prototype pollution in _.unset/_.omit✅ >=4.17.23
js-yamlModerateCVE-2025-64718Prototype pollution in merge✅ >=4.1.1

Vulnerability Details ​

esbuild (via vitepress > vite) ​

  • Path: .>vitepress>vite>esbuild
  • Impact: Development-only. Malicious websites could read dev server content.
  • Mitigation: Update vite or wait for upstream fix.

lodash/lodash-es (via mermaid, @stoplight/prism-cli) ​

  • Path: .>mermaid>@mermaid-js/parser>langium>chevrotain>lodash-es
  • Path: packages__crf>@stoplight/prism-cli>...>lodash
  • Impact: Prototype pollution via crafted input.
  • Mitigation: Override in pnpm or wait for upstream fix.

js-yaml (via @modyfi/vite-plugin-yaml) ​

  • Path: .>@modyfi/vite-plugin-yaml>js-yaml
  • Impact: Prototype pollution when parsing untrusted YAML.
  • Mitigation: Use node --disable-proto=delete or update plugin.
json
{
  "pnpm": {
    "overrides": {
      "fast-xml-parser": ">=5.3.4",
      "lodash": ">=4.17.23",
      "lodash-es": ">=4.17.23",
      "js-yaml": ">=4.1.1"
    }
  }
}

License Compliance ​

Allowed Licenses ​

All dependencies use licenses compatible with MIT:

LicenseCountCompatible
MIT~95%✅
Apache-2.0~3%✅
BSD-3-Clause~1%✅
BSD-2-Clause<1%✅
ISC<1%✅
0BSD<1%✅

Notable Licenses ​

PackageLicenseNote
TypeScriptApache-2.0Microsoft
typedocApache-2.0TypeStrong
eslint-plugin-securityApache-2.0ESLint community
knipISCPermissive

Verification Command ​

bash
pnpm audit:licenses
# Uses: license-checker --onlyAllow "MIT;Apache-2.0;BSD-2-Clause;BSD-3-Clause;ISC;0BSD;Unlicense"

Outdated Dependencies ​

Minor/Patch Updates Available ​

PackageCurrentLatestAgePackage
@commitlint/cli^20.3.1^20.4.0~25droot
@commitlint/config-conventional^20.3.1^20.4.0~25droot
turbo^2.7.6^2.8.1~8droot
@types/node^25.0.10^25.2.0~11dmultiple
svelte^5.48.5^5.49.1~5dapps
svelte-check^4.3.5^4.3.6~1moapps
@scalar/hono-api-reference^0.9.37^0.9.39~8dcrf
eslint-plugin-turbo^2.7.6^2.8.1~8dshared-config

Update Commands ​

bash
# Check outdated dependencies
pnpm audit:versions

# Update all (writes to package.json)
pnpm taze -r -w

# Install and verify
pnpm install && pnpm ci:checks

Single Points of Failure (SPOF) ​

Critical Dependencies ​

These dependencies are fundamental to the project with no easy alternatives:

DependencyUsed ByRisk LevelMitigation
Effectcrf, net, redcap-core🔴 HighCore architecture choice. No alternative.
SvelteKitfind-an-expert, amarre, ecrin🔴 HighFramework choice. Well-maintained by Svelte team.
node-appwriteAll SvelteKit apps🟠 MediumBackend dependency. Appwrite is open-source.
Honocrf server🟡 LowLightweight. Easy to replace with Express/Fastify.

Dependency Analysis ​

Effect Ecosystem (Critical SPOF) ​

  • Packages: effect, @effect/cli, @effect/platform, @effect/platform-node
  • Version: 3.19.15 (synchronized)
  • Risk: All REDCap packages depend on Effect
  • Mitigation: Effect is actively maintained with strong community support
  • Bus factor: Core team at Effect-TS

SvelteKit Ecosystem (Critical SPOF) ​

  • Packages: @sveltejs/kit, svelte, @sveltejs/vite-plugin-svelte
  • Version: 2.50.1 / 5.48.5 / 6.2.4
  • Risk: 3 production applications depend on SvelteKit
  • Mitigation: Backed by Vercel, large community
  • Bus factor: Svelte team + Rich Harris (Vercel)

Appwrite (Medium SPOF) ​

  • Packages: node-appwrite, appwrite (client)
  • Version: 21.1.0 / 21.5.0
  • Risk: Authentication and database for all apps
  • Mitigation: Open-source, self-hosted option available
  • Bus factor: Appwrite Inc.

Dependency Graph ​

Packages Overview ​

Monorepo Structure (14 packages) ​

PackageTypeVersionKey Dependencies
atlas (root)Monorepo-turbo, vitest, vitepress
find-an-expertSvelteKit app0.5.1svelte, zod, simple-git
amarreSvelteKit app2.0.0svelte, luxon, zod
ecrinSvelteKit app2.0.0svelte, sigma, graphology
@univ-lehavre/crfREDCap client/server1.3.0effect, hono
@univ-lehavre/atlas-redcap-openapiOpenAPI extraction1.3.0yaml, @clack/prompts
@univ-lehavre/atlas-redcap-coreDomain logic1.1.0effect
@univ-lehavre/atlas-netNetwork utilities0.7.0effect, @effect/*
@univ-lehavre/atlas-shared-configConfig0.3.0typescript-eslint, eslint-plugin-*
@univ-lehavre/atlas-appwriteAppwrite utils0.2.0node-appwrite
@univ-lehavre/atlas-authAuth service0.2.0node-appwrite
@univ-lehavre/atlas-errorsError classes0.2.0-
@univ-lehavre/atlas-validatorsValidation0.2.0-
@univ-lehavre/atlas-logosAssets1.1.0-
redcap-sandboxTesting1.0.1-

Standardized Versions ​

Target versions for consistency across the monorepo:

Core Stack ​

DependencyVersionStatus
Node.js>=24.0.0✅
pnpm10.28.2✅
TypeScript^5.9.3✅
ESLint^9.39.2✅
Prettier^3.8.1✅
Vitest^4.0.18✅

SvelteKit Stack ​

DependencyVersionStatus
@sveltejs/kit^2.50.1✅
@sveltejs/adapter-node^5.5.2✅
svelte^5.48.5✅
vite^7.3.1✅

Effect Stack ​

DependencyVersionStatus
effect^3.19.15✅
@effect/cli^0.73.1✅
@effect/platform^0.94.2✅
@effect/platform-node^0.104.1✅

Hono Stack ​

DependencyVersionStatus
hono^4.11.7✅
hono-openapi^1.2.0✅
@hono/node-server^1.19.9✅

Recommendations ​

Immediate Actions (Priority 1) ​

ActionImpactEffort
Add pnpm overrides for lodash/js-yamlSecurityLow
Update @commitlint packagesMaintenanceLow
Update turbo to 2.8.xPerformanceLow

Short-term Actions (Priority 2) ​

ActionImpactEffort
Migrate tsup → tsc for utility packagesConsistencyMedium
Add tests for appwrite/auth packagesQualityMedium
Document node-appwrite 21.x migrationDocsLow

Long-term Actions (Priority 3) ​

ActionImpactEffort
Evaluate Bun as alternative runtimePerformanceHigh
Automate dependency audits (Renovate)MaintenanceMedium
Consider Effect alternatives for smaller packagesFlexibilityHigh

Audit Commands ​

bash
# Full audit suite
pnpm ci:audit

# Individual audits
pnpm audit:security    # Security vulnerabilities
pnpm audit:licenses    # License compliance
pnpm audit:versions    # Outdated packages
pnpm audit:unused      # Unused dependencies (knip)
pnpm audit:duplicates  # Code duplication (jscpd)
pnpm audit:size        # Bundle size check

History ​

DateAction
February 2, 2026Complete audit with SPOF analysis
January 28, 2026Full update via taze -r -w
January 28, 2026Align node-appwrite 21.1.0 + API migration
January 28, 2026Initial audit