chore(deps): dependency audit 2026-08 — in-range updates, remove unused openai, dev majors

[chriskehayias]

Full dependency audit for August 2026. Report at .claude/reports/deps-audit-2026-08-21.md.

Security outcome

No exploitable vulnerabilities. npm audit reports 0 findings across 585 packages, and OSV returns no advisories for any installed version of the 17 packages queried individually, including every runtime-critical one (next, react/react-dom, better-auth, zod, dotenv).

Two prior known-issues entries cleared on re-verification:

• postcss bundled inside next — the 2 moderate findings are gone as of next@16.3.1. The npm audit fix --force ban stands regardless; it still resolves such findings by downgrading next to 9.3.3.
• better-auth 2026 CVE cluster (CVE-2026-53513 SSRF/CVSS 9.6 in @better-auth/sso, CVE-2026-53516 OAuth auto-link ATO, CVE-2026-45337 deviceAuthorization, CVE-2026-67336 oidcProvider/mcp crypto defaults) — not applicable for two independent reasons: all are fixed in 1.6.11+ and we run 1.7.1, and src/lib/auth.ts registers only genericOAuth, customSession, nextCookies.

⚠️ Pending upstream — no action available in this PR

Next.js pre-announced a critical severity vulnerability on 2026-08-20, with patches 16.3.2 / 15.5.24 scheduled for 2026-08-26. This branch is on 16.3.1, the current latest — there is nothing to upgrade to yet. Re-run /audit-deps on or after Aug 26.

Changes

Commit	What
1c0b7b0	32 direct deps updated within existing ^ ranges (no package.json edits)
e5c9aa0	Remove openai — declared runtime dep with zero usage anywhere
61d158d	jsdom 30, chalk 6, jest-dom 7; realign @types/node to ^24
09aa3c9	Audit report + updated known-issues state

Notable in the in-range pass

• eslint-config-next 16.2.6 → 16.3.1, closing a minor-line mismatch with next@16.3.1 and pulling typescript-eslint 8.59.3 → 8.67.0
• lucide-react 1.16.0 → 1.33.0 (largest in-range jump)
• react / react-dom 19.2.6 → 19.2.8, 13 @radix-ui primitives, tailwindcss 4.3.3, vitest 4.1.11

openai removed

Declared in dependencies at ^6.32.0 with zero references repo-wide — no import/require in src/ or scripts/, no OPENAI* env var, no config reference. It was also the only remaining runtime major (6.49.0 → 7.5.0), so removal makes that moot. Dropped exactly 1 package. If AI features land later, install fresh at ^7.

@types/node moved down a major

^25.5.0 → ^24.13.3. The @types/node major tracks the Node major and this runtime is Node 24.18.0, so ^25 was letting tsc accept APIs the runtime may not have. Type-check is clean, confirming nothing depended on a Node 25-only API.

Not included: ESLint 10 (attempted, reverted)

ESLint 9.39.5 is deprecated upstream ("no longer supported"), so this is a hold we're stuck with rather than a preference.

eslint-config-next@16.3.1 declares eslint: >=9.0.0 and typescript-eslint@8.67.0 accepts ^10.0.0 — but eslint-config-next vendors eslint-plugin-react, eslint-plugin-import, and eslint-plugin-jsx-a11y under its own node_modules, and all three cap eslint at ^9. Installing v10 produced ERESOLVE overriding peer dependency ×3 and npm error invalid: eslint@10.8.1, then eslint . failed outright:

TypeError: Error while loading rule 'react/display-name':
  contextOrFilename.getFilename is not a function
  at eslint-config-next/node_modules/eslint-plugin-react/lib/util/version.js:31

eslint-plugin-react still calls the context.getFilename() API v10 removed — zero files lintable. Reverted; recorded as blocked in .claude/references/deps-known-issues.md with the re-check trigger so it is not retried blindly.

Verification

Run after the in-range pass, after each individual major, and once more on the final tree:

• build pass — next build (Turbopack), TypeScript check clean, 8 routes
• lint pass — eslint ., 0 errors / 0 warnings
• tests pass — 279/279 in 21 files
• audit 0 vulnerabilities · npm ls no invalid: peers

chalk 6 was additionally verified by running its only consumer, npm run setup:check — colored output renders and all 8 checks complete.

The lockfile in 61d158d is a clean re-resolution from package.json rather than the residue of the reverted ESLint 10 install, which had left those plugins nested instead of hoisted. Same versions either way; this is what a fresh clone resolves to.

Follow-ups flagged, out of scope here

• pkce: false on the genericOAuth provider in src/lib/auth.ts. MP discovery advertises S256 and the existing code comment already anticipates enabling it — wants its own change plus a test.
• Pre-existing Vite 8 warning that vitest.config.ts uses ESM syntax while loaded as CommonJS. Fix is renaming to vitest.config.mts.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!