# Dependency health: acme-shop-api

**Score 15/100 (At risk)** · checked 19 Oct 2026, 13:30 UTC · [full report](https://deps.noticely.dev/r/sample)

12 known vulnerabilities (1 critical), 4 deprecated packages, 7 packages with maintenance risk and 6 packages at least one major version behind. Working through the upgrade plan takes an estimated 4.7–7.7 days.

| Package | In use | Latest | Risk | Notes |
|---|---|---|---|---|
| mongoose | 6.12.0 | 9.11.2 | Critical | 4 known vulnerabilities · 3 major versions behind |
| left-pad | 1.3.0 | 1.3.0 | High | Deprecated by its authors · No release for 8 years |
| lodash | 4.17.15 | 4.18.1 | High | 6 known vulnerabilities · Single maintainer |
| node-uuid | 1.4.8 | 1.4.8 | High | Deprecated by its authors · No release for 9 years |
| request | 2.88.2 | 2.88.2 | High | 1 known vulnerability · Deprecated by its authors · No release for 6 years |
| eslint | 8.57.0 | 10.13.0 | Medium | Version 8.57.0 is deprecated · 2 major versions behind |
| moment | 2.29.4 | 2.31.0 | Medium | 1 known vulnerability |
| dotenv | 16.4.5 | 18.0.8 | Low | 2 major versions behind |
| jest | 29.7.0 | 30.5.2 | Low | 1 major version behind |
| jsonwebtoken | 9.0.2 | 9.0.3 | Low | Single maintainer |
| nodemon | 3.1.0 | 3.1.14 | Low | Single maintainer |
| typescript | 5.4.5 | 7.0.2 | Low | 2 major versions behind |
| zod | 3.23.8 | 4.6.7 | Low | Single maintainer · 1 major version behind |
| cors | 2.8.5 | 2.8.6 | Healthy | No known issues |
| express | 5.1.0 | 5.3.0 | Healthy | No known issues |
| helmet | 8.0.0 | 8.3.0 | Healthy | No known issues |

## Upgrade order

1. **mongoose**: Upgrade to 6.13.10 (15 min)
2. **left-pad**: Replace with String.prototype.padStart (15 min)
3. **lodash**: Upgrade to 4.18.0 (15 min)
4. **node-uuid**: Replace with uuid (30 min)
5. **moment**: Upgrade to 2.31.0 (15 min)
6. **request**: Replace with native fetch or undici (0.5–1 day)
7. **eslint**: Upgrade to 10.13.0 (1–1.5 days)
8. **zod**: Upgrade to 4.6.7 (0.5–1 day)
9. **dotenv**: Upgrade to 18.0.8 (1–1.5 days)
10. **jest**: Upgrade to 30.5.2 (0.5–1 day)
11. **typescript**: Upgrade to 7.0.2 (1–1.5 days)
12. **jsonwebtoken**: Keep an eye on it (single maintainer) (monitor)
13. **nodemon**: Keep an eye on it (single maintainer) (monitor)

Total estimate: 4.7–7.7 days

_Generated by [noticely/deps](https://deps.noticely.dev). Data: npm registry, OSV.dev, deps.dev._