fix(deps): remediate security advisories and verify locked dependencies

[Cedarflake]

Summary

• Patch Next.js / eslint-config-next to 16.3.8, Nodemailer to 10.0.9, root parsers, sharp, source-map-js, fflate, and brace-expansion. Preserve the minimatch compatibility shim.
• Update NyaAI's committed lock to anyio 4.14.2 and werkzeug 3.1.9. Audit frozen Python locks in CI instead of silently resolving newer versions from manifests.
• Mitigate GHSA-vfj7-8cjw-p6xm in braces 3.0.3 with a documented local depth guard and a persistent installed-package regression suite wired into Shika's check.
• Preserve the blocked unrs-resolver postinstall policy using pnpm 11's explicit allowBuilds: false.
• Run browser workflows' raw audit steps last, without waiving failures, so functional coverage remains available while registry metadata still reports the locally mitigated braces advisory.

Audit results

• Node baseline: 23 advisories (1 critical, 8 high, 13 moderate, 1 low).
• Updated production audit: 0 advisories.
• Updated full raw audit: 1 high advisory, GHSA-vfj7-8cjw-p6xm, still reported because the locally patched package retains version 3.0.3. No ignore/waiver is configured. npm did not provide the advisory's named 3.0.4 release.
• Python: fixed four findings in two locked NyaAI packages. All seven manifest-resolution audits and all three complete lock inventories (44 registry package entries) are clean.

Compatibility and validation

• Frozen install passed with repository-pinned pnpm 11.7.0.
• Full production build passed across every workspace.
• Shika: 259 tests, lint/type checks, migration check, and the complete production HTML/RSC/privacy/locale/owner-auth smoke passed.
• Nodemailer: owning lint/type/build checks passed; all three actual sendEmail templates succeeded against an isolated local SMTP fixture using synthetic credentials, with no external delivery. The Node >=20 requirement of v10 is satisfied by the repository's Node 22–24 policy.
• Braces: 9,188 security/differential checks passed against the installed patched package; 188 persistent regression checks run in Shika's check. The intentional limit is 100 combined brace/parenthesis nesting levels. See patches/README.md for provenance and limitations.
• Repository contract: 15 tests and all repository invariants passed. Workflow formatting passed.
• Landing: 12 tests and validation passed. Extension: 67 unit tests passed. Userscript: 62 unit tests and build drift checks passed.
• Focus Orb package/demo checks passed, including the five pack-contract tests.
• NyaAI: 9 tests passed on Python 3.13.5. Workbench Ruff lint/format passed (115 files).
• Other workspace static checks passed. Local tsx CLI IPC was blocked by the executor, so equivalent tests used the documented node --import tsx loader path. Local browser suites could not run: the pinned download was truncated, and installed Chromium was blocked by sandbox socket permissions. GitHub CI subsequently passed all browser coverage for this exact commit: extension 12/12, userscript 9/9, and Liminal Drift canvas/interaction smoke.

The remote Git tree was verified byte-for-byte against the locally staged tree. Existing Dependabot PR #29 remains a separate verified Actions-only update.

Final CI review

All install, build, test and deployment checks passed for f4f66c2. The three final full-audit steps report only the documented, locally mitigated braces advisory; no audit exception was added. Python, CodeQL, Repository Contract, Apps & Packages and Shika workflows succeeded, as did all four Vercel deployments. Merged through GitHub's normal merge API after this review; no required checks or protection settings were disabled.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
cedarflake-lab-landing	Ready	Preview	Oct 8, 2026 6:31am UTC
coilpot-task	Ready	Preview	Oct 8, 2026 6:31am UTC
liminal-drift	Ready	Preview	Oct 8, 2026 6:31am UTC
maimai-transition	Ready	Preview	Oct 8, 2026 6:31am UTC