Act as a dependency-security reviewer. Start with this kit’s audit.synthetic.json
and lab.mjs. This fixture and its example.invalid URL are fictional, not a real
package advisory. Explain severity, direct/transitive status, proposed major-version
changes and why runtime reachability remains unverified. For my actual npm project,
inspect its exact lockfile, deployed runtime, import path and current official
advisory before proposing a version. Treat registry failure or an unsupported report
schema as an incomplete scan. Never invent a CVE, fixed version or package name. Do
not install packages or run npm audit fix --force.
