chore: reduce critical dependency audit baseline

docs/dependency-risk-register.md

@@ -19,25 +19,28 @@ Use `pnpm --silent audit:security:json` when another script needs machine-readab
 
 ## Current Snapshot
 
-`pnpm audit --registry=https://registry.npmjs.org --audit-level high --json` currently reports:
+`pnpm --silent audit:security:json` currently reports:
 
-- Critical: 2 advisories.
-- High: about 30 advisories.
-- Moderate/low advisories also exist but are lower priority for the first remediation pass.
+- Critical: 0 advisories.
+- High: 2 advisories.
+- Moderate: 44 advisories.
+- Low: 1 advisory.
+
+The previous local baseline was Critical: 2 / High: 31. The first remediation batch upgraded direct dependencies and patched transitive packages via `pnpm.overrides`.
 
 ## Priority Remediation Buckets
 
-- `next`: multiple high advisories affecting the currently resolved Next.js version. Upgrade Next.js in a dedicated framework update branch and run the full quality gate, route smoke tests, and focused homepage/settings/canvas checks.
-- `fast-xml-parser`: critical/high advisories through AWS SDK XML parsing. Prefer upgrading AWS SDK packages or adding a targeted override only after confirming the lockfile resolves to patched `fast-xml-parser`.
-- `protobufjs`: critical/high advisories through `@xenova/transformers -> onnxruntime-web -> onnx-proto`. Treat as high priority because code generation and parser dependencies are sensitive.
-- `drizzle-orm`: high advisory affecting SQL identifier escaping. Upgrade in a dedicated data-access branch and run route/helper tests plus migration checks.
-- `xlsx`: high advisories with no patched version reported by npm audit. Plan a replacement or isolation strategy rather than pretending a patch exists.
-- `@vercel/blob` / `undici`: high advisories through the Blob client dependency chain. Upgrade storage dependencies and verify upload/download flows.
-- `ultracite` transitive dev tooling chain: advisories in Vite/Rollup/Picomatch/tRPC via lint/test tooling. Keep pinned execution, then upgrade tooling in a separate CI-focused branch.
+- `xlsx`: two high advisories remain, and npm audit reports no patched version. Plan a replacement or isolation strategy rather than pretending a patch exists.
+- `next`: remediated by resolving Next.js to `16.2.6`; keep route smoke tests in the verification path.
+- `fast-xml-parser`: remediated through a transitive override resolving to `5.8.0`.
+- `protobufjs`: remediated through a transitive override resolving to `7.5.6`.
+- `drizzle-orm`: remediated by upgrading to `0.45.2`; keep migration and route checks in future data-access changes.
+- `@vercel/blob` / `undici`: remediated through a transitive override resolving `undici` to a patched 6.x line.
+- `ultracite` transitive dev tooling chain: remediated through targeted transitive overrides for Vite/Rollup/Picomatch/tRPC/Lodash.
 
 ## Release Policy
 
-- Do not add `pnpm audit:security` to `pnpm check:quality` until the critical/high baseline is remediated or a documented exception policy exists.
+- Do not add `pnpm audit:security` to `pnpm check:quality` until the remaining `xlsx` advisories are removed or explicitly accepted with compensating controls.
 - New direct dependencies should be checked with `pnpm audit:security` before merging.
 - Critical advisories in runtime dependencies should block production release unless they are proven unreachable and documented here.
 - High advisories should have either a remediation PR or an explicit risk acceptance note before commercial deployment.

package.json

@@ -100,7 +100,7 @@
     "date-fns": "^4.1.0",
     "diff-match-patch": "^1.0.5",
     "dotenv": "^16.4.5",
-    "drizzle-orm": "^0.34.0",
+    "drizzle-orm": "^0.45.2",
     "embla-carousel-react": "^8.6.0",
     "exceljs": "^4.4.0",
     "fast-deep-equal": "^3.1.3",
@@ -116,7 +116,7 @@
     "mssql": "^12.2.1",
     "mysql2": "^3.22.3",
     "nanoid": "^5.0.8",
-    "next": "^16.0.9",
+    "next": "^16.2.6",
     "next-auth": "^5.0.0-beta.30",
     "next-themes": "^0.3.0",
     "orderedmap": "^2.1.1",
@@ -187,7 +187,18 @@
   "packageManager": "pnpm@9.12.3",
   "pnpm": {
     "overrides": {
-      "sharp": "^0.34.5"
+      "sharp": "^0.34.5",
+      "fast-xml-parser": "^5.5.6",
+      "protobufjs": "^7.5.6",
+      "undici": "^6.24.0",
+      "tmp": "^0.2.6",
+      "js-cookie": "^3.0.7",
+      "rollup": "^4.59.0",
+      "vite": "^7.3.2",
+      "picomatch": "^4.0.4",
+      "@trpc/server": "^11.8.0",
+      "lodash-es": "^4.18.1",
+      "langsmith": "^0.6.0"
     }
   }
 }