[bakirgdev]

What and why

Resolves the six open OpenSSF Scorecard code-scanning alerts.

• Fuzzing (deps-dev(deps-dev): bump typescript from 6.0.3 to 7.0.2 in /web/docs #2): Go native fuzz targets for relayPorts, validateThrottle, proxyURL, classify and splitPaths, seeded from the existing table tests. Writing them found an overflow in relayPorts: base+n > 65535 wrapped for huge values, so BasePort: math.MaxInt was accepted (ports past 65535) and Transfers: math.MaxInt panicked in make. The check is now base > 65535-n, and both extremes are seeds. Not reachable from the app, whose Advanced settings validate ports first (AdvancedSettingsValidation.portsError).
• Vulnerabilities (deps-dev: bump @types/react from 19.2.17 to 19.2.18 in /web/docs in the docs-site-deps group across 1 directory #3): neither advisory has a fixed release. crocmobile/osv-scanner.toml ignores GO-2026-5932 (x/crypto/openpgp, never imported; govulncheck: not called) and web/docs/osv-scanner.toml ignores GHSA-vfj7-8cjw-p6xm (braces, docs build only, already accepted). Scorecard's Vulnerabilities check reads that file next to each manifest.
• Branch-Protection (Clear the known-issues backlog before re-cutting v0.9.9 #1), Code-Review (Weekly Go checks failed #5), Maintained (ci: bump actions/attest-build-provenance from 4.1.1 to 4.2.2 in the actions group across 1 directory #4), CII-Best-Practices (ci: bump the actions group across 1 directory with 2 updates #6): cannot reach 10 with one maintainer; dismissed as won't fix after merge, recorded under Accepted in docs/known-issues.md.

AI assistance: substantial

Verification

• go vet ./... clean; env -u GOOS -u GOARCH go test -race ./... in crocmobile/: ok.
• Each fuzz target run 20-30 s with go test -run=^$ -fuzz=^<Name>$: no failures (0.3-1.3 M execs each).
• The two new FuzzRelayPorts seeds fail against the old check (seed#7, seed#8) and pass with the fix.
• osv-scanner scan source -r --no-call-analysis=go . (2.7.0): both IDs filtered, "No issues found".
• Matching scripts/verify-*.sh harness: not run, session.go unchanged.

Docs

• Defect fixed or accepted: its docs/known-issues.md line deleted or added