Published package ships unpinned "latest" runtime deps (react-doctor, react-grab)

Summary

packages/scan/package.json:221-222 declares runtime dependencies pinned to latest:

"react-doctor": "latest",
"react-grab": "latest"

This ships to every consumer of the published npm package. Because these ranges are resolved at install time, a compromised upstream release flows to all users automatically on next install — bypassing downstream lockfiles, since the range itself is mutable. This defeats the entire lockfile-based supply-chain model for the highest-trust dependencies in the graph.

Suggested fix

Pin both to concrete semver ranges (e.g. "^1.x.y") and update via changesets/renovate like other deps.

Related

The CLI's init also runs execSync('npx -y react-doctor@latest install --yes') (src/cli.mts:64-78) — same "latest" trust pattern, though gated behind an interactive prompt.