[SaulBuilds]

Summary

security: bump next 16.3.8 → 16.4.2 for the public advisories GHSA-673q-mjm6-r5xr (critical), GHSA-2464-fhr4-w9xw (critical) and GHSA-p3m5-59mp-jv5r (high). All 16.x up to and including 16.4.0 are affected.

• package.json: next ^16.3.8 → ^16.4.2. The repo has no direct eslint-config-next or @next/* deps.
• package-lock.json: only the next, @next/env and @next/swc-* entries change. I regenerated it with npm 11 so the existing libc fields stay. npm ls next shows a single next@16.4.2.

Gates (run locally, DGX, node 22)

Gate	main	this branch
npm audit --audit-level=high (CI blocking gate)	red: 2 critical (next, dompurify) + 1 high (vite)	green at 8a1dafe (next, dompurify, vite cleared)
npm run typecheck	—	pass
vitest run (--maxWorkers=2)	—	124 passed, 4 skipped
npm run build (prebuild + postbuild, Next.js 16.4.2)	—	pass
npm run verify:bundle	—	pass
npm run content-lint -- --strict	—	pass

Additional bumps (audit gate, commit 8a1dafe)

The audit gate also blocked on two advisories outside the next tree. I fixed both with overrides in package.json:

• dompurify: ^3.4.17, so 3.4.16 → 3.4.17 (critical; GHSA-cg2g-xh64-v4q7, GHSA-mrv2-3pqr-j5jr, GHSA-c6gr-qvv4-5v3f). It is transitive via mermaid@11.17.2, whose range is ^3.3.3, so the override stays inside the range mermaid declares.
• vite: ^8.3.3, so 8.3.1 → 8.3.5 (high; GHSA-698v-4r3x-3vcv, GHSA-r825-w8mm-5pxw, GHSA-587h-7wmj-h5pm, GHSA-9jrq-w75r-8gcw, GHSA-rq7h-c2jc-7f22, GHSA-vfpm-58rq-9qcg). This is dev-only, via vitest. The lockfile also picks up vite 8.3.5's own dependencies: rolldown 1.2.11 → 1.2.15, @oxc-project/types, postcss 8.5.28 → 8.5.31 and nanoid 3.3.19 → 3.3.20. This makes dependabot chore(deps-dev): bump vite from 8.3.1 to 8.3.4 #38 redundant.

After these bumps, npm audit --audit-level=high exits 0 on 8a1dafe. Only moderate/low findings remain, and the gate does not block on those. I re-ran typecheck, tests (124 passed / 4 skipped), build, verify:bundle, content-lint --strict and sbom on 8a1dafe, and all pass.

Exposure (read-only review)

• GHSA-2464-fhr4-w9xw (Image Optimization / SVG): likely not exposed. There is no next/image import in app/, components/ or lib/, and no images config, so dangerouslyAllowSVG is off. The default optimizer route still exists, so this is low rather than zero.
• GHSA-673q-mjm6-r5xr (use cache): not exposed. No use cache directive.
• GHSA-p3m5-59mp-jv5r (Server Actions DoS): likely not exposed. No "use server" actions. The App Router is in use, so it stays unknown-to-low.
• Deploy: Vercel project citrate-atlas (docs.citrate.ai, .vercelignore). GitHub has no Vercel deployment records for this repo, so I found no evidence that merging main auto-deploys. Treat it as unknown and check the Vercel project's Git settings.

Conflicts

git merge-tree against every open PR: #37 and #39 are clean. #38 (dependabot, lockfile) also merges cleanly with this branch.

Standard: met

• Tripwire: the existing blocking npm audit --audit-level=high gate flags next on main and no longer does on this branch. With the dompurify/vite overrides it is green.
• This is a dependency bump only, with no production code change.

Not merging, not deploying.

🤖 Generated with Claude Code

https://claude.ai/code/session_01KGMeatV8UjtCB4CTbWuAv4

[SaulBuilds]

I added these bumps (commit 8a1dafe), so the audit gate now passes locally:
The audit gate also blocked on two advisories outside the next tree. I fixed both with overrides in package.json:

• dompurify: ^3.4.17, so 3.4.16 → 3.4.17 (critical; GHSA-cg2g-xh64-v4q7, GHSA-mrv2-3pqr-j5jr, GHSA-c6gr-qvv4-5v3f). It is transitive via mermaid@11.17.2, whose range is ^3.3.3, so the override stays inside the range mermaid declares.
• vite: ^8.3.3, so 8.3.1 → 8.3.5 (high; GHSA-698v-4r3x-3vcv, GHSA-r825-w8mm-5pxw, GHSA-587h-7wmj-h5pm, GHSA-9jrq-w75r-8gcw, GHSA-rq7h-c2jc-7f22, GHSA-vfpm-58rq-9qcg). This is dev-only, via vitest. The lockfile also picks up vite 8.3.5's own dependencies: rolldown 1.2.11 → 1.2.15, @oxc-project/types, postcss 8.5.28 → 8.5.31 and nanoid 3.3.19 → 3.3.20. This makes dependabot chore(deps-dev): bump vite from 8.3.1 to 8.3.4 #38 redundant.

After these bumps, npm audit --audit-level=high exits 0 on 8a1dafe. Only moderate/low findings remain, and the gate does not block on those. I re-ran typecheck, tests (124 passed / 4 skipped), build, verify:bundle, content-lint --strict and sbom on 8a1dafe, and all pass.

Not merging.