Publish curated DevRunbook source from 6c816f19fca10d6aed986e1e2c2ae8df9b1654b7

docs/SECURITY_DEPENDENCY_PATCH_20261001.md

@@ -0,0 +1,41 @@
+# Publication dependency patch — 1 October 2026
+
+## Finding and scope
+
+The protected README-publication PR failed its production dependency audit on
+Next.js 16.3.3, reported as critical advisory
+[GHSA-vcvr-r3jv-pc5j](https://github.com/vercel/next.js/security/advisories/GHSA-vcvr-r3jv-pc5j).
+The maintainer advisory identifies 16.3.6 as the patched version. Its affected
+path is attacker-controlled SVG input passed to Node.js `next/og` ImageResponse.
+An inspection of `apps` and `packages` found no ImageResponse, `next/og` or
+`@vercel/og` usage; this patch removes the vulnerable framework dependency
+without claiming an observed exploitable application route.
+
+The owner authorized fixing security blockers in this documentation round.
+The web manifest now pins Next.js 16.3.6. The pnpm 10.33.0 lockfile changes only
+the matching Next.js, environment and platform compiler packages, their
+integrities and dependent peer references. Authentication, application code,
+schemas, migrations, deployment configuration and audit thresholds are unchanged.
+
+## Verification
+
+Local environment: Windows, Node.js 24.18.1, pnpm 10.33.0 and Python 3.13.
+
+- Frozen workspace installation and the runtime preflight passed.
+- Both Python contract checks passed: 28 P0 packages, six normative examples,
+  72 catalog entries, nine schemas and 28 unchanged golden prompts.
+- `pnpm test:security` passed both files and all 11 tests, including hostile
+  inputs and authorization/origin/dependency boundaries.
+- `pnpm audit --prod --audit-level high` passed. The critical Next.js finding
+  is gone; the audit reports zero high and zero critical findings. Its three
+  pre-existing moderate findings remain below the unchanged release threshold.
+- `pnpm verify` passed: formatting, all 14 workspace lint/typecheck/build tasks,
+  681 tests and both specification checks. The web suite passed 55 files and
+  247 tests. The ordinary unit invocation skipped 32 database integration tests
+  because no disposable PostgreSQL instance was configured locally; this is
+  not evidence for the separate mandatory integration gate.
+
+Fresh PostgreSQL integration validation is provided by the existing exact-head
+Linux CI gate. No application instance or production data is changed by the
+local checks. Public source export must follow the protected merge and retain
+the existing sanitation and manifest verification.