Build: refresh documentation dependencies

[ihsraham]

Deliverables

• Refresh the direct documentation dependencies to Next.js 16.3.0, Mermaid 11.16.1, and PostCSS 8.5.26.
• Regenerate the npm 10 lockfile with Sharp 0.35.3, DOMPurify 3.4.13, fast-uri 3.1.5, and Nano ID 3.3.18.
• Preserve the required nested @inkeep/cxkit-primitives/node_modules/zod@3.25.76 entry.
• Declare npm@10.9.7 in packageManager so automated lockfile updates use the same known-good npm line.

Dependabot PRs superseded

This combines and supersedes #225, #226, #227, #231, #232, and #234.

PR #227 already subsumes #225. The individual bot lockfiles all remove the nested Zod entry and fail during npm ci; this rollup is regenerated from current develop with Node 22.22.2 and npm 10.9.7.

Validation

• npm ci — passed; 827 packages installed.
• Exact lock/dependency assertions — passed for all selected versions and nested Zod 3.25.76.
• npm ls next postcss sharp mermaid dompurify fast-uri nanoid zod --all — passed.
• npm run build — passed; 334 static pages, 328 per-page Markdown files, current All Modules feed, and 0 built-output broken links.
• LINK_CHECK_EXTERNAL=true npm run quality — passed; 20 LLM/feed tests, 2 link-routing tests, 329 source files, 2,726 links, and 0 broken links. External checks reported 81 warning-only responses and 44 redirects.
• Served-output smoke — the P2P Address Book Mermaid flowchart rendered in light and dark mode with no console warnings or errors.
• git diff --check — passed.
• npm audit — improved from 13 vulnerable packages on the base lockfile to 6 (5 low, 1 high). The remaining AI SDK and js-yaml findings are unrelated to this rollup and require separate dependency work.

The local build was run on macOS; hosted Linux Docs Quality Gates are still required before merge.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	next@​16.2.12 ⏵ 16.3.0	-2		+1
	postcss@​8.5.18 ⏵ 8.5.26	+1	+2	+1	+1
	katex@​0.16.27 ⏵ 0.16.47	+1		+1	+5
	mermaid@​11.15.0 ⏵ 11.16.1	+1	+6	+1	-1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Dynamic code execution: npm @img/sharp-wasm32 Eval Type: Function Location: Package overview From: package-lock.json → npm/next@16.3.0 → npm/@img/sharp-wasm32@0.35.3 ℹ Read more on: This package | This alert | What is dynamic code execution? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-wasm32@0.35.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[kinsta]

Preview deployments for wdk-docs prod ⚡️

Status	Branch preview	Commit preview
✅ Ready	Visit preview	Visit preview

Commit: 1014a194c62cfd124046088f04b17c7f09f9f5ca

Deployment ID: 783e4828-57b4-461d-8831-253a8f810b94

Static site name: wdk-docs-prod-pbpbt

[kinsta]

Preview deployments for wdk-docs staging ⚡️

Status	Branch preview	Commit preview
✅ Ready	Visit preview	Visit preview

Commit: 1014a194c62cfd124046088f04b17c7f09f9f5ca

Deployment ID: d214f907-c54a-4221-870b-dfe4039d93b4

Static site name: wdk-docs-ve3eh