Source: npx @rafinery/cli audit --json (rafa.audit/v1, run 2026-07-26), dependency tier.
Machine-sourced from the envelope.
All three are transitive under @copilotkit/runtime@1.63.2 (chain.direct: false), the
package imported at src/app/api/copilotkit/route.ts:7. None are dev:true. Priority is the
mechanical map on the highest severity present: moderate -> P2. Grouped into one row
because they share one parent and one fix action.
Chain for the last one is @copilotkit/runtime@1.63.2 -> @ai-sdk/google-vertex@3.0.158 -> @ai-sdk/provider-utils@3.0.30.
Reachability — brain-grounded annotation (priority-neutral)
None of these downgrade the mapped priority; they explain why the row sits behind the two
next rows in the queue despite being on the exposed path.
Note on the fix
@copilotkit/runtime is declared as "^1.63.2" (package.json:19), so a plain lockfile
refresh can move the transitives without any manifest edit — try that first and let the audit
confirm the delta. Reach for pnpm.overrides only if the refresh leaves them pinned, and
check the runtime still boots afterwards: uuid 10 -> 13 is three majors, and forcing it under
a parent that expects v10 is exactly the kind of override that breaks at request time rather
than at install time.