Audit and remediate 9 npm vulnerability findings

[willwashburn]

Finding

npm audit --json reports 9 vulnerable packages: 1 low, 8 high against lockfile state at 008d3c6f3bd5ec915ad258b2dde348a3be4e57a9. This issue records the findings separately from the Agent Relay credential mitigation; no dependency or lockfile changes were made.

Advisory IDs and reachability

Deployed-runtime graph

Package	Installed	Advisory IDs	Assessment
next	16.2.10	GHSA-6gpp-xcg3-4w24, GHSA-m99w-x7hq-7vfj, GHSA-89xv-2m56-2m9x, GHSA-68g3-v927-f742, GHSA-4633-3j49-mh5q, GHSA-4c39-4ccg-62r3, GHSA-p9j2-gv94-2wf4, GHSA-q8wf-6r8g-63ch, GHSA-955p-x3mx-jcvp	Direct web dependency and part of the deployed OpenNext Worker. Potential runtime reach. Repo inspection found no "use server" directives and no middleware/proxy source file; configured rewrites have fixed local destinations. Those facts narrow several advisories but do not clear the package-level finding. Audit proposes 16.2.12.
sharp	0.34.5	GHSA-f88m-g3jw-g9cj	Optional dependency of deployed Next and dependency of development-only Miniflare. The repo has one next/image use, while an existing source comment records that the OpenNext/Cloudflare image endpoint is unavailable. Treat runtime reach as possible until the built Worker is inspected; development reach is confirmed.
dompurify	3.4.11	GHSA-c2j3-45gr-mqc4	In the browser dependency graph through posthog-js (used by the root layout) and Mermaid. Repo source does not call CUSTOM_ELEMENT_HANDLING or afterSanitizeElements; vulnerable API reach through dependencies is unconfirmed.

Build/development graph

Package	Installed	Advisory IDs	Assessment
postcss	8.5.15 plus Next-bundled 8.4.31	GHSA-qx2v-qp2m-jg93, GHSA-6g55-p6wh-862q, GHSA-r28c-9q8g-f849	CSS build pipeline. Repo source does not parse attacker-supplied CSS at request time.
@tailwindcss/postcss	4.3.1	inherited postcss advisories above	Build-time Tailwind/PostCSS plugin; no separate advisory object.
js-yaml	3.14.2	GHSA-h67p-54hq-rp68, GHSA-52cp-r559-cp3m	Reached through gray-matter while ingesting tracked docs/blog frontmatter. OpenNext config and source comments establish that content is embedded at build time because the Worker has no runtime filesystem.
brace-expansion	2.1.1 and 5.0.6	GHSA-3jxr-9vmj-r5cp, GHSA-mh99-v99m-4gvg	Reached through OpenNext/AWS glob tooling during build.
miniflare	4.20260617.1	inherited sharp advisory above	Development/build dependency through Wrangler; no separate advisory object.
wrangler	4.103.0	inherited miniflare/sharp advisory above	Development/deploy CLI. Not bundled as application runtime. Agent sessions are prohibited from production access independently of this issue.

Remediation shape

• Upgrade in a dedicated PR; do not run a blind npm audit fix.
• Prefer the smallest compatible direct-dependency changes, beginning with Next 16.2.12, then inspect the resulting transitive versions.
• Re-run npm audit --json, the 94-test suite, the production build, and router typecheck.
• Inspect the lockfile diff and built Worker before declaring sharp or dompurify runtime-unreachable.
• Record any advisory left open with an explicit applicability decision and owner.