fix(deps): Next.js 16.3.8 and patched transitive packages; dated braces exception (#115)

CHANGELOG.md

@@ -5,6 +5,11 @@ This file records what changes **in the product** – process and session state
 
 ## [Unreleased]
 
+### Security
+- Next.js 16.3.8 (SSRF in image optimization and five moderate/low advisories), `sharp` 0.35.5 and
+  `source-map-js` 1.2.2; the unfixed `braces` advisory of the lint tooling is a dated exception in the
+  architecture map (#115).
+
 ### Added
 - Evidence page `docs/product/evidence.md`: eval accuracy per key field (reproducible with `pnpm evals`), the
   measured state of both sample requests, three key decisions and the limits; handling time marked as not yet

docs/technical/architecture.md

@@ -55,6 +55,7 @@ Deliberately accepted risks – without an entry here a deviation counts as a de
 | `.msg` uploads checked by OLE signature only | Structure check of Outlook messages needs a CFB parser; files are served only as attachments with `nosniff` and parsed later by the stateless AI service | Fluory | with #23 (MSG parsing) |
 | Gemini API free-tier key on the showcase (#67) | Orchestrator decision 2026-09-26 (ADR-0001 D11 amendment): no GCP for now. Google's terms require paid services for API clients offered to users in the EEA and allow human review of free-tier content, so the showcase stays invite-only for the orchestrator, synthetic data only, demo banner on | Fluory | before anyone else gets a demo account, at the latest 2026-10-31 – then paid tier (same key with billing) or Vertex `eu` |
 | Gemini API free tier for local development | Synthetic data only; never showcase (except the #67 row above until its expiry) or customer data (D8) | Fluory | when a Vertex development budget exists |
+| Audit ignore for `braces` GHSA-vfj7-8cjw-p6xm (`package.json` → `pnpm.auditConfig.ignoreGhsas`, #115) | No patched version exists (2026-10-09). Reached only through lint tooling (`eslint-config-next` → `fast-glob` → `micromatch`), not in the production tree (`pnpm why braces --prod` is empty); the risk is a stack-exhaustion DoS of a local lint run on crafted glob patterns | Fluory | as soon as a patched `braces` or a `fast-glob`/`micromatch` without it is released, at the latest 2026-12-31 |
 
 ## Data flow
 

package.json

@@ -37,7 +37,7 @@
     "@fontsource/ibm-plex-sans": "5.3.0",
     "better-auth": "1.7.5",
     "drizzle-orm": "0.45.3",
-    "next": "16.3.6",
+    "next": "16.3.8",
     "pg": "8.23.0",
     "pg-boss": "12.33.6",
     "pino": "10.3.1",
@@ -55,9 +55,16 @@
     "dependency-cruiser": "18.4.0",
     "drizzle-kit": "0.31.11",
     "eslint": "9.39.5",
-    "eslint-config-next": "16.3.6",
+    "eslint-config-next": "16.3.8",
     "openapi-typescript": "7.13.0",
     "typescript": "6.0.3",
     "vitest": "5.0.1"
+  },
+  "pnpm": {
+    "auditConfig": {
+      "ignoreGhsas": [
+        "GHSA-vfj7-8cjw-p6xm"
+      ]
+    }
   }
 }