fix(deps): update vulnerable workspace dependencies

[Cedarflake]

Summary

• Upgrade Next.js and its ESLint config to 16.3.8; upgrade sharp to 0.35.5 and regenerate the tracked favicon artifacts using the owning asset script.
• Refresh vulnerable transitive packages and existing security overrides, preserving workspace structure and package-manager version.
• Use Vite 6.4.3 with stable VitePress 1.6.4. The installed plugin-vue 5.2.1 supports Vite 5/6, migration-sensitive configuration is absent, and the bilingual client/server documentation build passes. See https://v6.vite.dev/guide/migration and https://github.com/vitejs/vite-plugin-vue/blob/plugin-vue%405.2.1/packages/plugin-vue/package.json.

Audit

• Full audit: 61 advisories (4 critical, 28 high, 23 moderate, 6 low) → 1 high.
• Production audit: 0 advisories.
• Remaining advisory: dev-only braces 3.0.3 through ESLint/fast-glob/micromatch, GHSA-vfj7-8cjw-p6xm. The audit feed currently mentions 3.0.4, but the npm registry returns 404 for that version. A documented local recursion-depth mitigation is now applied with pnpm patchedDependencies; its mandatory regression guard verifies 188 checks against the actual installed package. This is not an upstream release/backport, and patterns deeper than 100 combined braces/parentheses now throw SyntaxError. No alert suppression was added. GHSA-vfj7-8cjw-p6xm

Local validation

• Frozen install with repository-pinned pnpm 11.17.0 passed.

• Asset drift validation, config and script checks, plugin checks/tests, runtime checks/tests and Cloudflare/Vercel/Netlify builds passed.

• 348 tests passed, including 111 WebUI tests. WebUI lint passed with one non-blocking new Next.js rule warning in existing setup navigation.

• Documentation localization validation and VitePress client/server build passed (19 bilingual routes).

• The sandbox blocks tsx CLI IPC sockets; local checks used the supported equivalent Node --import tsx launcher without tracked script changes. Canonical CI must verify the exact pushed commit.

• Next.js 16.3.8 production build and external-runtime fixture build also passed.

Deployment compatibility fixes

• Preserve the existing repository-root pnpm build:cf integration through the canonical Runtime build.
• Generate Wrangler's documented deployment-config redirect to apps/runtime/wrangler.toml, preserving the authoritative Worker configuration. Root Wrangler dry-run passes without uploading.
• Route every nested pnpm call in Docs/WebUI builds through Corepack. This prevents the provider's global pnpm11.22 from replacing the unchanged workspace pin11.17.0.
• Add command-contract tests, a root Wrangler dry-run in Runtime CI, and real app-cwd builds with a deliberately failing global-pnpm shim. Documentation is synchronized in English and Chinese.

Final pre-merge validation

Verified head c099ee3fbd93978a60d20bde429b8bfc0dbfac13.

• All five canonical workflows passed: Config, Docs, Runtime, WebUI, Plugin.
• Cloudflare Workers automatic build/upload passed.
• All three Vercel previews (Docs, WebUI, Runtime) passed.
• Netlify Runtime preview passed.
• The prior deployment errors are resolved. No manual deployment, security-check suppression, or permission change was performed.

[netlify]

✅ Deploy Preview for nami-runtime ready!

Name	Link
🔨 Latest commit	c099ee3
🔍 Latest deploy log	https://app.netlify.com/projects/nami-runtime/deploys/6ac776adc98c7d0009eb1f3f
😎 Deploy Preview	https://deploy-preview-55--nami-runtime.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
cedarflake-nami-docs	Ready	Preview	Oct 8, 2026 10:58am UTC
cedarflake-nami-runtime	Ready	Preview	Oct 8, 2026 10:58am UTC
cedarflake-nami-webui	Ready	Preview	Oct 8, 2026 10:58am UTC

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	nami	c099ee3	Commit Preview URL Branch Preview URL	Oct 08 2026, 10:56 AM