chore(deps): bump the frontend-npm group across 1 directory with 14 updates

[dependabot]

Current authority — 2026-09-09

• exact head: 65b60df44a224ba817af1bc8def34db93ae4b614
• protected base adopted by ordinary ancestry repair: develop@042b0c70531b229af3acbd0421a2f23098d848b3
• lifecycle: Draft / stale-base ancestry repaired / frontend security RED source-fixed / one-shot repair workflow self-removed / PR-triggered hosted workflows require action / fix(deps): patch frontend audit security floors #1623 narrow protected-base prerequisite source+security GREEN but shared required gates non-passing / not merge-authorized

Non-force ancestry repair

The Dependabot lane was originally based on 81c105645ca6e680f5f8c15ba9c33b67eb63c48b, 65 protected commits behind live develop. Ordinary two-parent commit 628528e470aa742eacf714a1381f120a14add84a preserves prior #1459 provenance and adopts protected develop@042b0c70531b229af3acbd0421a2f23098d848b3 without force-push or destructive rebase.

Security RED and repair

Trivy evidence from #1621 run 34300562474, job 102306568194, identified two CRITICAL Next.js findings (CVE-2026-75604, GHSA-2xp9-vwfh-vxw4) and one HIGH sharp finding (GHSA-rgj7-g3m4-5g8c) in this group when it still held Next.js 16.3.1 and sharp 0.35.0.

Test-first commit c8a95f54ad3d277a74768aba33ed14d729bc258d added the first security-floor regression. The one-shot source-fix workflow initially failed because actions/setup-node requested pnpm caching before pnpm existed. Exact child 2565ea931abd84d1c0f42df9a88ca1c27a88ef04 repaired that causal ordering issue. The next source-fix execution succeeded and produced ordinary child 65b60df44a224ba817af1bc8def34db93ae4b614 (fix(deps): patch Next.js and sharp security floors). That commit:

• updates Next.js + eslint-config-next to 16.3.4,
• updates the sharp override and generated lock to 0.35.4,
• preserves the broader dependency-group updates,
• removes .github/workflows/repair-frontend-security-lock.yml in the same commit after its purpose completed.

The resulting tree is 57c446c61e2c52bed1e148f850a8dab605704a19; the temporary source-fix workflow is absent from the current head.

Hosted verification boundary

The current head's PR-triggered Application CI, Bandit, Semgrep, Security, CodeQL PR and Docker workflow runs terminated as action_required without jobs. This is not GREEN evidence and must not be treated as a source failure or silently bypassed. Until the required action is satisfied and the unchanged exact head gets an executable hosted matrix, this broad group is not merge-authorized.

#1623 has since advanced by ordinary RED→GREEN repair to exact e8a54fc5156ac3ffbb79bc8418c5125d7dcdea60. Its predecessor security regression had two valid Codex P2 gaps: it did not structurally bind the root importer/override/snapshot graph, and it did not reject every below-floor next@/sharp@ lock entry. RED a5abe047d318477b64c62cdbee5b737aad8054f0 reproduced both false-negative classes; GREEN e8a54fc... now parses the pnpm lock structurally and enforces all Next.js entries >=16.3.3, all sharp entries >=0.35.4, exact Next.js/eslint-config-next importer identity, referenced snapshots and the reviewed sharp override.

On that exact #1623 head, Application CI 34308232588, Bandit 34308232672, Semgrep 34308232582, Security Scan 34308232578, Docker 34308232872, coverage evidence/source-tree and direct GitHub Advanced Security CodeQL analyses are terminal GREEN. Formal CodeRabbit review PRR_kwDOSNjZ2s8AAAABMvBEOg is APPROVED on exact e8a54fc...; its two original Codex P2 threads are resolved/outdated.

#1623 is still not merge-authorized because shared required OpenCode and CodeQL compatibility contexts failed, Noema run 34308231412 / job 102329519489 failed after a ready orchestrator/free preflight with HTTP 429 after 214.0s, and Strix remains non-terminal. The Noema owner reproduction is on contextual-orchestrator#1106 comment 5595655747 and consumer cleanup on .github#2042 comment 5595656784.

Succession rule

Treat #1623 as the canonical narrow protected-base prerequisite and this PR as its broader successor. Once #1623 normally integrates, #1459 must ordinary-adopt #1623's exact structural security lineage or the resulting protected integration before the remaining group dependency updates are evaluated. This branch must never downgrade Next.js/sharp below the reviewed floors and must not revert the stricter structural regression back to the older literal-only test. Do not close either lane merely because their dependency deltas overlap.

Primary references:

• GHSA-p293-qw3h-jr36
• GHSA-2xp9-vwfh-vxw4
• GHSA-rgj7-g3m4-5g8c
• https://www.npmjs.com/package/next

Merge boundary

Keep Draft until #1623's prerequisite normally integrates or this branch ordinary-adopts the same exact structural security lineage, this broad group receives a full executable product/build/security matrix GREEN on one unchanged exact head, all then-live required contexts are terminal-success, and qualifying independent approval is post-last-push.

No manifest-only stale-lock edit, hand-written integrity/platform records, force-push, destructive rebase, self-approval, failure-as-flake waiver, dummy/no-op requeue, synthetic status, admin bypass, or gate weakening.

[github-actions]

PR governance metadata gate is not ready for 3edb8320b0288f2bba54ce7e28083164e0d51966:

• Branch is BEHIND the base branch; update the branch and re-run checks.
• Required check strix is FAILURE on the current head.

[seonghobae]

Exact-head remediation for 3edb8320b0288f2bba54ce7e28083164e0d51966:

Root cause of the hosted failures was the unupdated frontend/pnpm-workspace.yaml override: package.json and the lockfile requested PostCSS 8.5.26, while pnpm applied workspace override 8.5.24, so frozen installs failed before build. The workspace override and two lock/security contract tests now use 8.5.26.

Validation: pnpm@11.5.3 install --frozen-lockfile --ignore-scripts; frontend 435 passed, lint, typecheck, and production build; backend 1786 passed, 32 skipped; targeted dependency/security contracts 2 passed; ruff check backend; and git diff --check. The earlier hosted Strix failure remains provider-side NVIDIA 429/direct-provider evidence and is not treated as a source pass.

[seonghobae]

Disposition for the two current informational review threads on 3edb8320b0288f2bba54ce7e28083164e0d51966: the vis-network note is cosmetic and the resolved lock is 10.1.2; the .pnpmfile.cjs exception is intentionally pinned to the reviewed PostCSS 8.5.26 contract so a future security-floor change must update the hook and lock together. The actual frozen-install defect was the workspace override, now fixed and covered by the passing install/build evidence.

[seonghobae]

Exact-head Checks RCA: strix failed on provider infrastructure, not a source finding. The run records NVIDIA NIM HTTP 429 rate-limit responses, then a configured openai-direct/gpt-5.6-luna fallback HTTP 404; the gate correctly failed closed with no structured vulnerability report. This requires central provider/fallback remediation and a fresh exact-head scan; no source patch was applied to this dependency-only PR.

[seonghobae]

Strix failure triage for current head 3edb8320b0288f2bba54ce7e28083164e0d51966: the job log shows NVIDIA NIM 429 Too Many Requests, then fallback openai-direct/gpt-5.6-luna 404 page not found; the gate explicitly classified this as provider infrastructure unavailable with no authoritative report artifact. No source finding was emitted. Re-ran failed jobs through the Actions API; merge remains blocked until an exact-head authoritative Strix result and required review are available.

[seonghobae]

Fresh security-owner handoff from exact Naruon PR validation on 2026-09-09.

Security Scan run 34300562474, Trivy job 102306568194, checked out exact 12d8cac36562b27c9f23e10eb4e75fbf6535e9be and failed closed on three frontend lockfile findings inherited from the shared dependency tree:

• next: CVE-2026-75604 — CRITICAL
• next: GHSA-2xp9-vwfh-vxw4 — CRITICAL
• sharp: GHSA-rgj7-g3m4-5g8c — HIGH

This frontend dependency lane currently proposes next / eslint-config-next only through 16.3.1, which is no longer an adequate security target. Current upstream advisories patch both critical Next.js issues at 16.3.3; sharp's reviewed advisory patches <0.35.4 at 0.35.4 and was updated 2026-09-08.

Primary advisories:

• GHSA-p293-qw3h-jr36
• GHSA-2xp9-vwfh-vxw4
• GHSA-rgj7-g3m4-5g8c

Please treat the next ordinary source successor here (or a clearly designated security-only dependency successor) as requiring at least next + eslint-config-next 16.3.3 and a lock resolution with sharp >=0.35.4, then re-run the full frontend build/tests plus current Trivy against the exact head. Do not represent 16.3.1 as closing these findings. The Docker-concurrency descendant that exposed this fresh scan will not absorb frontend dependency ownership into its two-file CI delta.

[seonghobae]

#1623 prerequisite advanced by ordinary RED→GREEN repair after two valid Codex P2 findings. Current exact prerequisite head is e8a54fc5156ac3ffbb79bc8418c5125d7dcdea60 (RED a5abe047d318477b64c62cdbee5b737aad8054f0). The new structural regression parses pnpm-lock.yaml, binds root Next.js / eslint-config-next importer specifier+resolved version to the reviewed manifests and exact snapshot keys, binds lock overrides.sharp to the workspace override, and rejects every next@ / sharp@ key below 16.3.3 / 0.35.4 across both packages and snapshots. Both predecessor review threads are source-addressed and resolved.

Do not treat #1459's overlapping 16.3.4/0.35.4 manifest/lock values as full succession of this new test contract. Keep #1459 as the broader successor; after #1623 normally integrates, ordinary-adopt e8a54fc... or the protected integration before evaluating the remaining dependency-group delta. Fresh #1623 exact-head workflows are executing, so this is a source-lineage handoff, not merge evidence.