diff --git a/CURRENT_STATE.md b/CURRENT_STATE.md index cadd6f6..830f0ae 100644 --- a/CURRENT_STATE.md +++ b/CURRENT_STATE.md @@ -729,3 +729,23 @@ account or production data was changed to manufacture a green browser result. `git diff --check` passes and Gitleaks found no secret across 207 commits. Final Node 24, PostgreSQL, security and audit authority remains the managed Gitea run for the final candidate commit. + +## Publication maintenance — 2026-10-01 + +- Scope: refined the English canonical/public README and patched Next.js + 16.3.3 to 16.3.6 after the protected publication audit reported + GHSA-vcvr-r3jv-pc5j. The manifest and lockfile changes are limited to Next.js + and its matching environment/compiler packages and peer references. +- Local evidence: Windows with Node 24.18.1 and pnpm 10.33.0 passed frozen + installation, runtime preflight, `pnpm verify`, all 681 executed tests, + 14 workspace builds, 11 security tests and both Python specification checks. + All 28 golden prompts remain unchanged. The production audit has zero high + and zero critical findings; three existing moderate findings remain. +- Limits: 32 database integration tests were skipped by the ordinary local + unit invocation. Fresh PostgreSQL integration validation remains mandatory + in exact-head Linux CI before protected merge. No browser interaction, + production deployment, schema, migration or configuration was changed. +- Detailed finding, applicability and evidence: + [dependency patch record](docs/SECURITY_DEPENDENCY_PATCH_20261001.md). +- Product milestone state is unchanged. Publication must continue through + protected merge, automatic curated export and manifest verification. diff --git a/PUBLIC-SOURCE-MANIFEST.sha256 b/PUBLIC-SOURCE-MANIFEST.sha256 index 4dca3c3..4a9b622 100644 --- a/PUBLIC-SOURCE-MANIFEST.sha256 +++ b/PUBLIC-SOURCE-MANIFEST.sha256 @@ -16,7 +16,7 @@ dc40bcfabcf8a38eae1a5abfff558c18443534604f8b9739fae3b47d3bf67568 BUILD_PACK.jso 73c53eb65109d3b49bf00cf47231fc87e1bcab42df583e50c73fe91b78fafb75 CODEX_EXECUTION_PROTOCOL.md 2a8e8ac0be23381257c53ab47b4059ba9bed8adb9200b55dcc9c3b86d1e8df36 CODEX_MASTER_PROMPT.md 0ded5168bf6b3b664756d05d7210272af4f28f422597a5519ad8793f13aa9896 CONTRIBUTING.md -7c1bcc375441f8548bad672516ba10424f4e224f9b112e9ebdf97e9c4d1ab6a9 CURRENT_STATE.md +3ac472c87bbc7a18b0ee7172a18e40c70c97da75b6f3a4294b2065e9d97b348c CURRENT_STATE.md 591939dde953361d5b64641ce4eb215a3afac5c98600148778d148e949bd2d7a DECISIONS.md f274162f7540f3fd2c93637ac34f1ca6c11a6b562e5ffcf61ac1ed330ea2e054 Dockerfile 0a60fdc763f33df8c066e69c9a4a024eb587f1528e8fefb530001fd759f34485 FILE_INDEX.txt @@ -25,7 +25,7 @@ f038f971c5f2866e7710486f15a236d05770eea76ba36d6bfcf8739ed6fd3331 FINAL_HANDOFF. 638b400d8d3aed60e672875df8a4a2ed749203a7f1c3fc336a295da2824edebd LICENSE b796ec54788d1295f85223e5917a49ca04eff8c0b9fadc9e4d6b43945c650bb6 PACK_MANIFEST.sha256 ca5ad9d9127b9e1fec448fbed19a400c399463b952b6c03945e91746e355d672 PACK_REVIEW.md -67c16eb3da6ffc94685d5f104ec708854dc65fce1d9f6be439f62bf0d337f825 README.md +51f5628b63bcc7ac7f3cd51d5b3861b9ff32a1b2d4288282015bdfeca69aa26f README.md 03fa606416d402f5430483dd1447f701bb9923b443d5b02e85c5855c10aa0125 SECURITY.md a40b0c5b5560eca6248ee900f7e004cfd5f1849ab8659fc5ca8d8acbf6c43f89 START_HERE_CODEX.md 56d37c6cfe1c24eb4050bdac449821bedf9d13263948e1f833b5b0e0bf787114 adr/ADR-001-git-first-content.md @@ -37,7 +37,7 @@ b628d2c48be924b25572dac7252e248d6fec3128ff0137c967b32294ce0669df adr/ADR-006-be 3dc46224d399a7a09e833b3284b18597504d9c967615b933d781dfb3b4ea675c api/openapi.yaml 1862ac4bbbc5192d4bf562161df66ea547ed3e67173100656ab606ae9797db2b apps/web/next-env.d.ts 5cb4cf40fdb110a121ff9a451d845287894237f4be50fccfdf9356704c5c29ee apps/web/next.config.ts -64a0f6bc765aacc4508d40967b897eb5c373efffd37fce6cc78fe4223eec839c apps/web/package.json +a72629084e6207b209e4eb868d0a0caacbaab1dde22c4b030c655055c1b38fbc apps/web/package.json 3fc8d1c13ad963bbf7da04d59024d38cc2ad14563b36afd71bc8b43c7148dd25 apps/web/postcss.config.mjs 14105408b2deaad0971d252f99af8b9e897a4a4fbbc42642317ac77d97bba65c apps/web/src/app/_authenticated/authenticated-app-layout.tsx 179b1911a82fa2ace7251ba819737fd91104b3d924f0c2b2f75f80d55f7dfc79 apps/web/src/app/_authenticated/authenticated-app-presentation.test.ts @@ -562,6 +562,7 @@ c16970cadcb0fcb3836c1f27fb2420b4365a1e336474f642909aaf79b5cc0696 docs/52-gitea- b46c0f8e29dc5fd2e75105cd6a0ac66c82a0345b0a47d6f0b36534b911bcfe8b docs/ASSET_PROVENANCE.md 6d62a07c756bfec0f8bb677b843dd7f9f7359d854d2e1075c7871abc9bd5a0b5 docs/PUBLICATION_READINESS.md a36db9d8120714af90ba467645345904f8d187684d20c87f5be52d93e5fa5039 docs/REPOSITORY_SANITATION.md +0c5a2e76e3c1ca33991a951ceb9ef26f1c2057cd6fbffc1e10d908769085d36a docs/SECURITY_DEPENDENCY_PATCH_20261001.md 566c9e1753c9042bd1b08123a341d78b32fc148ef0ed83a428e4410f066dc139 docs/operator-guide.md 2531c632929e72815f0a8e83a5c4b5211c44a659f799e80063c97c2e4f2aa3c3 docs/screenshots/README.md cd363d96fe0649f210506a69de1bc66a6d76a3f706dbfeea76302b656f04a7c2 docs/screenshots/workflow-concept.png @@ -868,7 +869,7 @@ fcef0f6944a0c822c3c817de0d0c5cc1cddb87e9e89372804f0b27f12194f12f packages/ui/sr 2bbc1d21f92ce062e08bdcb8ad3324bd66c8433e7556a41d1cacdad013d6c6b8 packages/ui/src/status/state-panel.tsx d308feb27bb9b7ea5ea17fe139fab6b7c24a704fd52b3601e3629be8c8797f90 packages/ui/tsconfig.json 9d715dfbd77f972f821b3557415e410e2b19d1b57917022076b2a8a058784396 playwright.config.ts -d0528c2875d92cfb4a3d7f61c6cefbc4c16732c92ffd1f0607711f2c1437ea6f pnpm-lock.yaml +52e83fe485140c02cc290aaaad38e655366c5c19064ad224784868b4486af928 pnpm-lock.yaml 253208fa7c1b64372c219b9e19cef15ed70ca93b66a4d5c4c4d2297a5aff8880 pnpm-workspace.yaml b43fe240547fa9ed6f235155a8c79a777daef73221e982dbe49aea609f9d982d release-evidence.json 37b161d2e975584f6ff2fc1629075dd4b9c85fde08d671e0c2cfea12b719fa82 schemas/condition.schema.json diff --git a/README.md b/README.md index 7914319..242163d 100644 --- a/README.md +++ b/README.md @@ -86,6 +86,12 @@ mount the Docker socket or weaken the default Gitea network policy. The reference stack binds its HTTP port to host loopback; terminate public HTTPS at a maintained reverse proxy on the same host or adjust the binding deliberately. +## Create your first RunPack + +After creating the owner account, select a built-in playbook, provide the repository profile and describe one bounded task. Review the composed prompt, assumptions and guardrails before exporting the RunPack. Start with a local profile if you do not need the optional Gitea connector. + +DevRunbook produces an instruction package for a human or coding agent. Exporting a package does not execute its commands, modify a repository or establish that the requested work passed validation. Keep the exported package with the evidence produced by the actual execution. + ## Local development DevRunbook requires Node.js 24, pnpm 10.33.0 and Python 3 for the specification diff --git a/apps/web/package.json b/apps/web/package.json index c2674a6..88687da 100644 --- a/apps/web/package.json +++ b/apps/web/package.json @@ -22,7 +22,7 @@ "@devrunbook/ui": "workspace:*", "better-auth": "1.6.25", "lucide-react": "1.27.0", - "next": "16.3.3", + "next": "16.3.6", "react": "19.2.8", "react-dom": "19.2.8", "yaml": "2.9.0", diff --git a/docs/SECURITY_DEPENDENCY_PATCH_20261001.md b/docs/SECURITY_DEPENDENCY_PATCH_20261001.md new file mode 100644 index 0000000..d055bfd --- /dev/null +++ b/docs/SECURITY_DEPENDENCY_PATCH_20261001.md @@ -0,0 +1,41 @@ +# Publication dependency patch — 1 October 2026 + +## Finding and scope + +The protected README-publication PR failed its production dependency audit on +Next.js 16.3.3, reported as critical advisory +[GHSA-vcvr-r3jv-pc5j](https://github.com/vercel/next.js/security/advisories/GHSA-vcvr-r3jv-pc5j). +The maintainer advisory identifies 16.3.6 as the patched version. Its affected +path is attacker-controlled SVG input passed to Node.js `next/og` ImageResponse. +An inspection of `apps` and `packages` found no ImageResponse, `next/og` or +`@vercel/og` usage; this patch removes the vulnerable framework dependency +without claiming an observed exploitable application route. + +The owner authorized fixing security blockers in this documentation round. +The web manifest now pins Next.js 16.3.6. The pnpm 10.33.0 lockfile changes only +the matching Next.js, environment and platform compiler packages, their +integrities and dependent peer references. Authentication, application code, +schemas, migrations, deployment configuration and audit thresholds are unchanged. + +## Verification + +Local environment: Windows, Node.js 24.18.1, pnpm 10.33.0 and Python 3.13. + +- Frozen workspace installation and the runtime preflight passed. +- Both Python contract checks passed: 28 P0 packages, six normative examples, + 72 catalog entries, nine schemas and 28 unchanged golden prompts. +- `pnpm test:security` passed both files and all 11 tests, including hostile + inputs and authorization/origin/dependency boundaries. +- `pnpm audit --prod --audit-level high` passed. The critical Next.js finding + is gone; the audit reports zero high and zero critical findings. Its three + pre-existing moderate findings remain below the unchanged release threshold. +- `pnpm verify` passed: formatting, all 14 workspace lint/typecheck/build tasks, + 681 tests and both specification checks. The web suite passed 55 files and + 247 tests. The ordinary unit invocation skipped 32 database integration tests + because no disposable PostgreSQL instance was configured locally; this is + not evidence for the separate mandatory integration gate. + +Fresh PostgreSQL integration validation is provided by the existing exact-head +Linux CI gate. No application instance or production data is changed by the +local checks. Public source export must follow the protected merge and retain +the existing sanitation and manifest verification. diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index d2ef7b2..aa0f9a7 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -93,13 +93,13 @@ importers: version: link:../../packages/ui better-auth: specifier: 1.6.25 - version: 1.6.25(drizzle-kit@0.31.10)(drizzle-orm@0.45.2(kysely@0.29.4)(postgres@3.4.9))(next@16.3.3(@babel/core@7.29.7)(@playwright/test@1.62.0)(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(vitest@4.1.10(@types/node@24.13.3)(vite@8.1.5(@types/node@24.13.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.23.1)(yaml@2.9.0))) + version: 1.6.25(drizzle-kit@0.31.10)(drizzle-orm@0.45.2(kysely@0.29.4)(postgres@3.4.9))(next@16.3.6(@babel/core@7.29.7)(@playwright/test@1.62.0)(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(vitest@4.1.10(@types/node@24.13.3)(vite@8.1.5(@types/node@24.13.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.23.1)(yaml@2.9.0))) lucide-react: specifier: 1.27.0 version: 1.27.0(react@19.2.8) next: - specifier: 16.3.3 - version: 16.3.3(@babel/core@7.29.7)(@playwright/test@1.62.0)(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8) + specifier: 16.3.6 + version: 16.3.6(@babel/core@7.29.7)(@playwright/test@1.62.0)(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8) react: specifier: 19.2.8 version: 19.2.8 @@ -1142,60 +1142,60 @@ packages: '@emnapi/core': ^1.7.1 '@emnapi/runtime': ^1.7.1 - '@next/env@16.3.3': - resolution: {integrity: sha512-U2eYQRwXj+dsqxV79zFqExDdatnNY/ZWc2nsJU1p/OgT7fd3dXwlF6OjYaFQCfMoeTA19PWq+wVmYgimVA+V+g==} + '@next/env@16.3.6': + resolution: {integrity: sha512-x9Vblze1EbtltQYnNH38xCPWU3TVfBd1eXqA3+w9+BTpedkkdNpAaltXlGQ/nsc1+E0mVTNrtcbX3GoO09zeLQ==} '@next/eslint-plugin-next@16.2.12': resolution: {integrity: sha512-uF2z/qAK2q7B5/6CpnFcBRX6jOq5iCO+Uqh1UkJhXljX1JwLarLYhhoJadO6dPb6moTprOKewMXheBcbIoSbug==} - '@next/swc-darwin-arm64@16.3.3': - resolution: {integrity: sha512-8Hiv32QJPwdV6KYJ8meR9SBA061tQqnIKTJDocvOXlEQqib0xMFpzArosuffFUUc0sslbh7QQ8a3Yey1QV8EIw==} + '@next/swc-darwin-arm64@16.3.6': + resolution: {integrity: sha512-E/7GEqaUkt8mk/T8v9lAnrhzR06kdq1ZBkC12F8tAMkdIadwNp3H1KqHynDHrpcTlGCUdq/qu6vUL2aYVyYBdw==} engines: {node: '>= 10'} cpu: [arm64] os: [darwin] - '@next/swc-darwin-x64@16.3.3': - resolution: {integrity: sha512-A1lgKgwVchRYmSe467zdwhxT9040dd8lH+o65sL5Jet8fjB4kegw/rDyPIpYVRb6jAqwXFOJpjIXJLxQKLiE3A==} + '@next/swc-darwin-x64@16.3.6': + resolution: {integrity: sha512-yBE893/nDWTlaiBD1p+qgt7NUen4U5R6FXyH0s67Npq1S3E0cVSef1WIXC2xBRgQvwAvJq6DnS6Y6PrY0cy4Ew==} engines: {node: '>= 10'} cpu: [x64] os: [darwin] - '@next/swc-linux-arm64-gnu@16.3.3': - resolution: {integrity: sha512-bf0FIssMFueU2dm7vQEWWxk0c8UjKTdW0yzuh0sQsD8pf1+KCLDdaqhYZNMYGmXwEOiHAUzgBKudovIlcvvBjg==} + '@next/swc-linux-arm64-gnu@16.3.6': + resolution: {integrity: sha512-KJDpjBqBPYlvkivmyrp+Qys6k/7ksbqGQvRVc6ZEGfR+cjQxx+nUkJaWmNZJsmoOrqYNbaXByF8wa0lBwDhB3Q==} engines: {node: '>= 10'} cpu: [arm64] os: [linux] libc: [glibc] - '@next/swc-linux-arm64-musl@16.3.3': - resolution: {integrity: sha512-W7viwCk9JY/cAkdz/A273rd5bb3RgT/IHwR7Upv90tunjBWNtAAhGhoecHh+teRNRSinuAFmE+l7fwZ4YKkrXg==} + '@next/swc-linux-arm64-musl@16.3.6': + resolution: {integrity: sha512-mqNg2K+hvWskSRb/QM+Ix412DvBsuSF0XV+frTSw5vmoucNnIlynFwKYew8D01bfATErMOM7Bujrf0BA5DRKFA==} engines: {node: '>= 10'} cpu: [arm64] os: [linux] libc: [musl] - '@next/swc-linux-x64-gnu@16.3.3': - resolution: {integrity: sha512-0W46zw1N3ODpI6n0GeivHvvob1pooozgZVqy65k0mh4/7vr+FbY9+WpHzNVXjHipJf/A3FDheBG19H1s5A25rA==} + '@next/swc-linux-x64-gnu@16.3.6': + resolution: {integrity: sha512-nFncBNGAYouRHjRVaITs9beZRfhX4ssVwpnvPIAbkZVH6LtGoAVlH4bJ8Cnf9SOo9bsXgPFer/GdHtEE3JNOkw==} engines: {node: '>= 10'} cpu: [x64] os: [linux] libc: [glibc] - '@next/swc-linux-x64-musl@16.3.3': - resolution: {integrity: sha512-H4mBso8ZTMBPtdT0PN0pBx2ayTvQuTuvS6qT13d77yVFJXAPCxkyIhLTmdMaGTJs0krQYI/qpzdHijCeihXhbg==} + '@next/swc-linux-x64-musl@16.3.6': + resolution: {integrity: sha512-5Mf3cHDGR/Iz0ng2Bj3zUR3p5QS9YK3Hn2QiAfavFmyF48zwThAjpFoiTKNIcOHLYS4zEk+gzyJ/9deQ2ZB8yQ==} engines: {node: '>= 10'} cpu: [x64] os: [linux] libc: [musl] - '@next/swc-win32-arm64-msvc@16.3.3': - resolution: {integrity: sha512-cTMUJpcEGmeywofCUfhR+rSsoE33+rVPnPEYNTNdLNlsOeEg/vktOsKUSTb28vUGqD2jkm4Zaskcwn7OCI6FQg==} + '@next/swc-win32-arm64-msvc@16.3.6': + resolution: {integrity: sha512-0jkJy0C2kbrJWTk4YLa3xk80pVBpx8FCHJym7CnUfDAXe/FWv5qT7SQJbR0KuemyxaEDlEx5WT4VQJoTW+/9Qw==} engines: {node: '>= 10'} cpu: [arm64] os: [win32] - '@next/swc-win32-x64-msvc@16.3.3': - resolution: {integrity: sha512-2VR4cTBzHXaBjnGsuH6GyJjENzQOmHeAh11uY1iUhjm3j5dEUrVJuUj+VL78jaGi/Dik8xS76zEj18BsFhlVZQ==} + '@next/swc-win32-x64-msvc@16.3.6': + resolution: {integrity: sha512-/YXjI1e5OXcZ7YpxRwgP/1jAV/SBKTzeVKqN2mk7mLpcICsyn3Gl5+dIfDTJp70M0ccMhyMMRso4v6mPDCGepg==} engines: {node: '>= 10'} cpu: [x64] os: [win32] @@ -2949,8 +2949,8 @@ packages: neo-async@2.6.2: resolution: {integrity: sha512-Yd3UES5mWCSqR+qNT93S3UoYUkqAZ9lLg8a7g9rimsWmYGK8cVToA4/sF3RrshdyV3sAGMXVUmpMYOw+dLpOuw==} - next@16.3.3: - resolution: {integrity: sha512-tuRTx1nQ/yVw83cwJBo9F+njGUgMn3UHQycreWHB8XsStvvAh1AthbI8/4IpKnFaF58F+iSiHejYOlMQ/eq83g==} + next@16.3.6: + resolution: {integrity: sha512-L+otWM/aQbYTx98aZhgEoMb4bZAXx1YVW4UMA/vuCyCoWG5HJyZUili8QAkqzrcC+5///tsz3s0M+SlyB5bLMw==} engines: {node: '>=20.9.0'} hasBin: true peerDependencies: @@ -4159,34 +4159,34 @@ snapshots: '@tybys/wasm-util': 0.10.3 optional: true - '@next/env@16.3.3': {} + '@next/env@16.3.6': {} '@next/eslint-plugin-next@16.2.12': dependencies: fast-glob: 3.3.1 - '@next/swc-darwin-arm64@16.3.3': + '@next/swc-darwin-arm64@16.3.6': optional: true - '@next/swc-darwin-x64@16.3.3': + '@next/swc-darwin-x64@16.3.6': optional: true - '@next/swc-linux-arm64-gnu@16.3.3': + '@next/swc-linux-arm64-gnu@16.3.6': optional: true - '@next/swc-linux-arm64-musl@16.3.3': + '@next/swc-linux-arm64-musl@16.3.6': optional: true - '@next/swc-linux-x64-gnu@16.3.3': + '@next/swc-linux-x64-gnu@16.3.6': optional: true - '@next/swc-linux-x64-musl@16.3.3': + '@next/swc-linux-x64-musl@16.3.6': optional: true - '@next/swc-win32-arm64-msvc@16.3.3': + '@next/swc-win32-arm64-msvc@16.3.6': optional: true - '@next/swc-win32-x64-msvc@16.3.3': + '@next/swc-win32-x64-msvc@16.3.6': optional: true '@noble/ciphers@2.2.0': {} @@ -4821,7 +4821,7 @@ snapshots: baseline-browser-mapping@2.11.4: {} - better-auth@1.6.25(drizzle-kit@0.31.10)(drizzle-orm@0.45.2(kysely@0.29.4)(postgres@3.4.9))(next@16.3.3(@babel/core@7.29.7)(@playwright/test@1.62.0)(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(vitest@4.1.10(@types/node@24.13.3)(vite@8.1.5(@types/node@24.13.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.23.1)(yaml@2.9.0))): + better-auth@1.6.25(drizzle-kit@0.31.10)(drizzle-orm@0.45.2(kysely@0.29.4)(postgres@3.4.9))(next@16.3.6(@babel/core@7.29.7)(@playwright/test@1.62.0)(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(vitest@4.1.10(@types/node@24.13.3)(vite@8.1.5(@types/node@24.13.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.23.1)(yaml@2.9.0))): dependencies: '@better-auth/core': 1.6.25(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-call@1.3.7(zod@4.4.3))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1) '@better-auth/drizzle-adapter': 1.6.25(@better-auth/core@1.6.25(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-call@1.3.7(zod@4.4.3))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.4.2)(drizzle-orm@0.45.2(kysely@0.29.4)(postgres@3.4.9)) @@ -4843,7 +4843,7 @@ snapshots: optionalDependencies: drizzle-kit: 0.31.10 drizzle-orm: 0.45.2(kysely@0.29.4)(postgres@3.4.9) - next: 16.3.3(@babel/core@7.29.7)(@playwright/test@1.62.0)(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8) + next: 16.3.6(@babel/core@7.29.7)(@playwright/test@1.62.0)(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8) react: 19.2.8 react-dom: 19.2.8(react@19.2.8) vitest: 4.1.10(@types/node@24.13.3)(vite@8.1.5(@types/node@24.13.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.23.1)(yaml@2.9.0)) @@ -5911,9 +5911,9 @@ snapshots: neo-async@2.6.2: {} - next@16.3.3(@babel/core@7.29.7)(@playwright/test@1.62.0)(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8): + next@16.3.6(@babel/core@7.29.7)(@playwright/test@1.62.0)(@types/node@24.13.3)(react-dom@19.2.8(react@19.2.8))(react@19.2.8): dependencies: - '@next/env': 16.3.3 + '@next/env': 16.3.6 '@swc/helpers': 0.5.23 baseline-browser-mapping: 2.11.4 caniuse-lite: 1.0.30001806 @@ -5922,14 +5922,14 @@ snapshots: react-dom: 19.2.8(react@19.2.8) styled-jsx: 5.1.6(@babel/core@7.29.7)(react@19.2.8) optionalDependencies: - '@next/swc-darwin-arm64': 16.3.3 - '@next/swc-darwin-x64': 16.3.3 - '@next/swc-linux-arm64-gnu': 16.3.3 - '@next/swc-linux-arm64-musl': 16.3.3 - '@next/swc-linux-x64-gnu': 16.3.3 - '@next/swc-linux-x64-musl': 16.3.3 - '@next/swc-win32-arm64-msvc': 16.3.3 - '@next/swc-win32-x64-msvc': 16.3.3 + '@next/swc-darwin-arm64': 16.3.6 + '@next/swc-darwin-x64': 16.3.6 + '@next/swc-linux-arm64-gnu': 16.3.6 + '@next/swc-linux-arm64-musl': 16.3.6 + '@next/swc-linux-x64-gnu': 16.3.6 + '@next/swc-linux-x64-musl': 16.3.6 + '@next/swc-win32-arm64-msvc': 16.3.6 + '@next/swc-win32-x64-msvc': 16.3.6 '@playwright/test': 1.62.0 sharp: 0.35.4(@types/node@24.13.3) transitivePeerDependencies: