qwilr-altonius
**Describe the Bug** `@mendable/[email protected]` pins `[email protected]` (thanks for #4875). It also depends on `[email protected]`, which pins `[email protected]`, so every install of `@mendable/firecrawl-js` still includes a vulnerable axios. Dependabot and `npm audit` flag 12 axios advisories that are fixed in 1.20.0. The `firecrawl` package is the same SDK published under another name. `.github/workflows/publish-js-sdk.yml` deletes this line before it publishes the `firecrawl` name (`sed -i '/"firecrawl":/d' package.json`). We compared the 4.42.4 tarballs: the `dist/` files are identical, and `"firecrawl"` appears in the bundle only in the inlined `keywords` array. Nothing imports or requires it, so the dependency seems to have no runtime purpose. Your audit automation still bumps it, for example `4.16.0` → `4.30.1` in #4092. Why does `@mendable/firecrawl-js` depend on `firecrawl`? **To Reproduce** 1. Create an empty project: `mkdir repro && cd repro && npm init -y` 2. Run `npm install @mendable/[email protected]` 3. Run `npm ls axios` and `npm audit` 4. `[email protected]` is installed under `[email protected]`, and `npm audit` reports 3 high severity vulnerabilities (see Logs) **Expected Behavior** Installing `@mendable/[email protected]` installs only `[email protected]`. Either: - remove the `firecrawl` dependency from `apps/js-sdk/firecrawl/package.json` (preferred, if it is unused), or - bump it to `[email protected]`, which uses `[email protected]`, and release a new `@mendable/firecrawl-js`. **Screenshots** N/A (see Logs) **Environment (please complete the following information):** - OS: macOS 26.6.2 - Deployment Type: Cloud (firecrawl.dev) - Firecrawl Version: `@mendable/firecrawl-js` 4.42.4 - Node.js Version: v26.9.0 (npm 11.19.1) **Logs** ``` $ npm ls axios [email protected] └─┬ @mendable/[email protected] ├── [email protected] └─┬ [email protected] └── [email protected] ``` ``` $ npm audit # npm audit report axios 1.0.0 - 1.19.0 Severity: high (12 advisories: GHSA-vh66-26gq-q6x8, GHSA-9fr6-4gfg-395g, GHSA-c29m-xwm3-cm6r, GHSA-mghh-pgcx-3jjj, GHSA-x97p-jq2g-jp4f, GHSA-3pq3-5fj3-cg6v, GHSA-542g-h47m-68v8, GHSA-j8rh-479h-cp32, GHSA-4hqw-qxg8-jxx2, GHSA-m8m8-qj5v-23w3, GHSA-44g4-m2mj-wpvx, GHSA-r4gj-5m52-g5wh) fix available via `npm audit fix --force` Will install @mendable/[email protected], which is a breaking change node_modules/firecrawl/node_modules/axios firecrawl 4.22.0 - 4.42.1 Depends on vulnerable versions of axios node_modules/firecrawl @mendable/firecrawl-js >=4.31.0 Depends on vulnerable versions of firecrawl node_modules/@mendable/firecrawl-js 3 high severity vulnerabilities ``` **Additional Context** - `npm audit fix --force` suggests a downgrade to `@mendable/[email protected]`. Users who follow that advice end up on an older SDK. - The README tells users to `npm install firecrawl`. Is `firecrawl` now the recommended name, and will `@mendable/firecrawl-js` remain supported?