fix(deps): Next.js security refresh with repaired npm lockfile

[writingdeveloper]

Scope

• Refresh Next.js to 16.4.0 (past Dependabot chore(deps): bump next from 16.3.3 to 16.3.8 #32's 16.3.8 target).
• Regenerate and validate package-lock.json to resolve the npm ci failure in chore(deps): bump next from 16.3.3 to 16.3.8 #32 (missing yaml@2.9.1).
• Apply non-breaking transitive dependency security patches (including sharp, source-map-js, and brace-expansion).
• Keep existing source and content out of this branch; based on 2026-09-27 GitHub main, with the ongoing 4080 local worktree preserved.

Verified on 2026-10-11 PT (4080 / Windows)

• npm ci successful on fresh worktree, followed by npm ci --dry-run after final lockfile changes.
• TypeScript, ESLint, Prettier, bilingual post parity: pass.
• 197 Vitest tests / 21 files: pass.
• next build: pass.
• git diff --check: pass.
• Original 4080 WIP branch (not changed by this PR) separately passed 224 tests and evidence checks.

Security exception: DO NOT AUTO-MERGE

npm audit --omit=dev --audit-level=high still reports 3 High advisories from braces dependency trees, including @keystatic/next -> chokidar and Next ESLint tooling. npm audit fix --force proposes a breaking @keystatic/next downgrade (0.0.6); that was deliberately NOT applied. Full audit reported 7 High after safe fixes. Review reachability/patch strategy and rerun CI before merging.

Release gates

1. Review remaining audit findings and GitHub security alerts.
2. GitHub Actions clean install/build passes on this PR, not just local Windows.
3. Merge only following review; deployment, bilingual browser QA, portfolio résumé/evidence publication, and public rollback check remain separate FOLIO items.
4. Reconcile the currently open Dependabot chore(deps): bump next from 16.3.3 to 16.3.8 #32 only after this PR's outcome is established.

This is a security maintenance candidate, not a production deployment. Plane workspace: soursea / Portfolio (FOLIO); issue synchronization pending.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
portfolio	Ready	Preview	Oct 14, 2026 2:22am UTC

[writingdeveloper]

CI read-back (2026-10-11 PT): Linux run 38195978378 completed FAIL. The dependency lockfile problem from #32 is resolved: npm ci PASS, and typecheck, ESLint, Prettier, 197 unit tests, translations, hero image verification and production build all PASS. The only failing step is npm audit --audit-level=high, which reports seven High findings from unresolved braces advisory/dependency paths. A nonbreaking npm audit fix has already been applied; npm audit fix --force would introduce breaking changes in @keystatic/next. Keeping this draft PR unmerged until a compatible security fix or explicitly reviewed risk disposition is available. No CI audit bypass or production deployment.

[writingdeveloper]

Follow-up to the strict audit exception review (2026-10-11 PT): the Next.js 16.4.0 stacked candidate (draft #34) also passed a full GitHub Linux CI pipeline up to and including production-preview Chromium QA, with only the same braces audit failure remaining (run 38205649337). In the candidate production preview, both /keystatic and /api/keystatic/example return 404 under the local-storage guard. These 404s reduce the exposed CMS surface but do not establish that vulnerable brace expansion is universally unreachable. No patched upstream braces version or CI-compliant remediation has been verified. Keep both PRs draft while determining either an upstream-compatible fix or explicit, scoped, time-limited exception; do not globally suppress audit or deploy by treating QA as security approval.

[writingdeveloper]

Oct 13 PT / security dependency isolation update, commit 2a4973eb91b784b9b146922e9ed27fd977218fd1:

• The only production dependency path to braces was @keystatic/next@5.0.5 → chokidar@3.6.0. A scoped npm override swaps that watcher to chokidar@4.0.3; this removes braces from the production lock graph. npm audit --omit=dev --audit-level=high now returns 0 vulnerabilities. This is a real dependency replacement, NOT an audit filter.
• Since Keystatic declares chokidar ^3.5.3, the major-version override received compatibility review: fresh Windows npm ci; TypeScript/ESLint/Prettier; 201/201 tests, Next.js 16.4.0 build; actual local Keystatic dashboard in development returned HTTP 200 with both language collections/no browser errors; the exact watch(directories,{ignored:[/node_modules/]}) call emitted ready+add on a temporary file; production Keystatic page and API returned HTTP 404 without configured GitHub OAuth. Did NOT mutate content or test GitHub OAuth mode.
• Strict full audit remains RED: eslint-config-next → @next/eslint-plugin-next → fast-glob → micromatch → braces@3.0.3 is a dev-tool-only chain. Full npm audit --audit-level=high reported five High paths. CI now runs both production and full scans, retaining the existing full gate without suppression.
• Linux CI run 38500626360 confirmed clean install/type/lint/test/build and Audit production dependencies PASS. The only failure was the unchanged Audit dependencies step. Do not merge without an approved solution/risk disposition.
• Scoped source and QA notes. Related release pipeline: FOLIO-45 security, FOLIO-36 production; draft feat(portfolio): reconcile source evidence and refresh 2026 projects and UX #34 is being revalidated after merging this base. Draft PR fix(hire): restore résumé PDFs and verify bilingual download links #37 is an editorial-review-only, isolated résumé repair on the old main and must NOT be independently deployed over Next.js 16.3.3's Critical advisory.

[writingdeveloper]

Security follow-up (2026-10-13 PT): Keystatic 5.0.5 with scoped Chokidar 4.0.3 now has additional real CMS write-path QA, beyond the already green unit/build/lockfile checks. In an isolated MAIN worktree with local Next dev mode, Chromium created a synthetic English post, confirmed the generated index.mdx content, edited its summary via the real Save action, verified the on-disk change, and deleted the temporary post. No real posts or production data were touched. This does not test OAuth/GitHub-backed storage or vendor support for a declared-major override. Linux CI run 38500626360 passed clean install, test/build, and production dependency audit with zero reported vulnerabilities. The unmodified full dependency audit still fails on 5 High dev-only braces alerts from ESLint. Keeping PR draft/unmerged; no audit suppression or exception authorized. Source docs: docs/reviews/2026-10-13-keystatic-chokidar-runtime-isolation.md, FOLIO-45.