DevRunbook-Public/docs/SECURITY_DEPENDENCY_PATCH_20261001.md

Publication dependency patch — 1 October 2026

Finding and scope

The protected README-publication PR failed its production dependency audit on Next.js 16.3.3, reported as critical advisory GHSA-vcvr-r3jv-pc5j. The maintainer advisory identifies 16.3.6 as the patched version. Its affected path is attacker-controlled SVG input passed to Node.js next/og ImageResponse. An inspection of apps and packages found no ImageResponse, next/og or @vercel/og usage; this patch removes the vulnerable framework dependency without claiming an observed exploitable application route.

The owner authorized fixing security blockers in this documentation round. The web manifest now pins Next.js 16.3.6. The pnpm 10.33.0 lockfile changes only the matching Next.js, environment and platform compiler packages, their integrities and dependent peer references. Authentication, application code, schemas, migrations, deployment configuration and audit thresholds are unchanged.

Verification

Local environment: Windows, Node.js 24.18.1, pnpm 10.33.0 and Python 3.13.

• Frozen workspace installation and the runtime preflight passed.
• Both Python contract checks passed: 28 P0 packages, six normative examples, 72 catalog entries, nine schemas and 28 unchanged golden prompts.
• pnpm test:security passed both files and all 11 tests, including hostile inputs and authorization/origin/dependency boundaries.
• pnpm audit --prod --audit-level high passed. The critical Next.js finding is gone; the audit reports zero high and zero critical findings. Its three pre-existing moderate findings remain below the unchanged release threshold.
• pnpm verify passed: formatting, all 14 workspace lint/typecheck/build tasks, 681 tests and both specification checks. The web suite passed 55 files and 247 tests. The ordinary unit invocation skipped 32 database integration tests because no disposable PostgreSQL instance was configured locally; this is not evidence for the separate mandatory integration gate.

Fresh PostgreSQL integration validation is provided by the existing exact-head Linux CI gate. No application instance or production data is changed by the local checks. Public source export must follow the protected merge and retain the existing sanitation and manifest verification.