fix(deps): take the fix for next GHSA-vcvr-r3jv-pc5j (critical) and dompurify GHSA-p98j-92pf-mc4p

[objectstack-fleet]

Fixes #21055

Clause-②: no

Summary

Validate Package Dependencies runs OSV-Scanner against pnpm-lock.yaml. On main it flags two rows, so the scheduled scan is red, and so is every PR that touches a package.json:

Advisory	CVSS	Package	Locked on main	Fixed in
GHSA-vcvr-r3jv-pc5j	9.5	next	16.3.3	16.3.6
GHSA-p98j-92pf-mc4p	2.3	dompurify	3.4.13	3.4.16

Both advisories name a fixed version, so this PR takes the fix. osv-scanner.toml is untouched and still holds zero exemptions.

Change

• apps/docs/package.json: the direct next pin moves from 16.3.3 to 16.3.6. The pin stays exact, as it was. 16.3.6 is the advisory's fixed version and the same target as Dependabot's grouped chore(deps)(deps): bump the production-dependencies group with 27 updates #21029, so after this lands, that PR's next line is already satisfied rather than in conflict. The newer patches (16.3.7, 16.3.8) are left to the Dependabot group. No workspace manifest declares eslint-config-next or any @next/* package. The nine @next/* packages in the lockfile are next's own dependencies and move with it.
• pnpm-workspace.yaml: the existing dompurify override's target goes from ^3.4.13 to ^3.4.16. Its selector is unchanged, still bounded at the 4.0.0 major. The OSV comment above it is extended in place, in the style of its neighbours. This PR adds no second override and does not touch the root package.json.
• pnpm-lock.yaml: regenerated, not hand-edited (see below).

Correction to the issue body. The issue says the root pnpm.overrides has no floor for dompurify. On main, the workspace's overrides live in pnpm-workspace.yaml, because pnpm 10 ignores pnpm.overrides in package.json. A dompurify entry was already there at ^3.4.13, added for an earlier advisory (#6407). The new advisory's range is introduced 3.4.13, fixed 3.4.16, so the old floor was itself the first affected version. The existing comment had predicted this: it explains that the selector is bounded at the major so that a target-only lift is all a case like this needs. mermaid@11.16.1 declares dompurify ^3.3.3, which admits 3.4.16, so this is a dedupe onto the patched line and does not force an upgrade past what mermaid supports.

Reach. apps/docs/app/og/docs/[...slug]/route.tsx imports ImageResponse from next/og. That is the surface GHSA-vcvr-r3jv-pc5j names ("Remote Code Execution in next/og ImageResponse").

Lockfile

Regenerated with pnpm install --lockfile-only under pnpm 10.31.0, the packageManager version.

• Size: 69 lines changed on each side, 138 in total.
• Locked package set: 11 entries removed and 11 added, and the count stays at 1369. The entries are next, @next/env, the eight @next/swc-* binaries, and dompurify.
• Everything else: the other changed lines are peer-suffixed snapshot keys that embed the next version. They belong to better-auth, its three @better-auth/* plugins, and fumadocs-core / fumadocs-mdx / fumadocs-ui. None of those packages changes version.
• Frozen install: pnpm install --frozen-lockfile passes on the result.

OSV-Scanner, before and after

I ran OSV-Scanner v2.3.8, the version the workflow's action pins. The binary's SHA-256 (bc98e153…) matches the release's checksum file. The command was scan --offline-vulnerabilities --lockfile=pnpm-lock.yaml. The container's egress proxy refuses api.osv.dev, so the scan reads the offline npm database the scanner downloads, the same method as #20774.

Tree	Exit	Result
main at 5dbeb7d7b7	1	exactly the two rows above (1 Critical, 1 Low)
this branch at 68c26aa189	0	No issues found (1369 packages)

Changeset decision

No changeset; this PR should carry the skip-changeset label. Nothing it touches is published:

• apps/docs is "private": true.
• pnpm-workspace.yaml overrides and pnpm-lock.yaml are in no package's files[], and no published manifest changes.

check:override-consistency still reports its 9 published-manifest declarations covered, and check:published-files is green.

What I ran

The final head is 68c26aa189: my commit, then a merge of main at 0c5a71b094. Every row below was measured on that head. The build and the docs checks were also green on 3714ec8cef, before the merge.

Check	Result
node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands	41 commands
All 41, run on 68c26aa189 after a rebuild, codes recorded with the --ran idiom	41 exit 0
dispatch-gates --ran	41 derived, 41 run, 0 NOT-MEASURED, 0 UNRUN
pnpm build under the shared verify lock, --concurrency=2	72/72, both at 3714ec8cef and at 68c26aa189
pnpm --filter @objectstack/docs typecheck (fumadocs-mdx && next typegen && tsc --noEmit)	exit 0
Docs production build command (apps/docs/vercel.json): pnpm turbo run build --filter=@objectstack/docs	exit 0, Next.js 16.3.6, .next/BUILD_ID written, and the docs task was a cache miss, so it really executed
check:override-consistency, check:vendor-export-contract-resolve, check-osv-exemptions, check:nul-bytes, check:workspace-manifest-cycles	all exit 0 (within the 41)

One deliberate difference from CI: the docs build ran without CI's TURBO_FORCE, which would also re-execute the spec build. The docs task itself missed the cache and ran. No package test suite applies, because no package source changes. CI's shard, dogfood and workspace type-check lanes are left to CI.

Acceptance notes

• The premise correction above, about where the dompurify override lives, applies to the issue body only. It does not affect the remedy.
• Dependabot's grouped chore(deps)(deps): bump the production-dependencies group with 27 updates #21029 stays open. Once this lands, its next line is already satisfied, and Dependabot will rebase its lockfile.

---

Generated by Claude Code

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 68c26aa189b4bef26e832045e8bd27ae1459abc3
Local-runs: none

Inputs: card #21055 (body, triage 5924465236, claim 5924776234, os-dev-report 5925128805, ACCEPT 5925147796), PR #21083 (body, file list, no comments or reviews), the net diff origin/main (2821e9f15b) ... 68c26aa189 (merge-base 0c5a71b094), the head's check-runs, AGENTS.md, .claude/skills/pm-dispatch/references/contract-review.md, pnpm-workspace.yaml, osv-scanner.toml, .github/workflows/validate-deps.yml, .github/workflows/ci.yml (Build Docs, Type Check lanes), .github/workflows/pr-automation.yml (Check Changeset), .changeset/config.json, apps/docs/package.json, apps/docs/vercel.json, apps/docs/next.config.mjs, apps/docs/app/og/docs/[...slug]/route.tsx, scripts/check-override-consistency.mjs, and npm view on next, dompurify, mermaid@11.16.1. Not read: the dispatch order, the dispatching seat's conclusions. Not reachable from this session: api.osv.dev and the GitHub advisory endpoint (both refused), so the two advisories' ranges are judged from the card's scanner table, the dev's offline-database read and the head's green scanner, as stated below.

① Derived judgments

Diff: 3 files, +80 −71 — apps/docs/package.json +1 −1, pnpm-workspace.yaml +10 −1, pnpm-lock.yaml +69 −69. Two commits: the fix 3714ec8cef and a merge of main at 0c5a71b094.

1. next 16.3.3 → 16.3.6, exact pin kept (apps/docs/package.json:21) — RIGHT. 16.3.6 is the release both the card's scanner table ("Fixed in 16.3.6") and the dev's offline OSV-database read name as GHSA-vcvr-r3jv-pc5j's fixed version, and Validate Package Dependencies on this head is success (its OSV step pins the same scanner, v2.3.8, and matched nothing). Registry: 16.3.6 published 2026-09-22; latest is 16.3.8 (16.3.7 on 09-29, 16.3.8 on 09-30). The triage direction is "≥ 16.3.6", satisfied. next is declared by apps/docs and by no other workspace manifest (no eslint-config-next, no @next/* declared anywhere; measured with a grep over every package.json at the head).
2. The docs app's use of next stays inside the 16.3.x patch promise — RIGHT. next@16.3.6's manifest against 16.3.3: dependencies identical except the self-versioned @next/env; optionalDependencies identical except the eight self-versioned @next/swc-* and sharp ^0.35.3 → ^0.35.4 (the lockfile already held sharp 0.35.4, an unchanged context line); peerDependencies, postcss 8.5.23, styled-jsx 5.1.6 and engines node ≥ 20.9.0 unchanged. The app's own surfaces are untouched by the diff: App Router pages, apps/docs/app/og/docs/[...slug]/route.tsx importing ImageResponse from next/og (the surface the advisory names, so the fix reaches the one caller), next.config.mjs (agentRules: false, experimental.cpus, turbopackSourceMaps, the turbopack alias, headers / rewrites / redirects). CI's Build Docs evaluates apps/docs/vercel.json's buildCommand verbatim under TURBO_FORCE and is success. What ships to docs-site users changes by the two library patches and nothing else.
3. dompurify override target ^3.4.13 → ^3.4.16, selector unchanged (the existing dompurify@ entry with its exclusive bound at the 4.0.0 major) — RIGHT, and consistent with the overrides header. The header's SELECTOR SHAPE rule: an OSV pin is a floor, the selector covers the whole major, the target floats inside it, and "ONLY the target moves from now on"; dompurify is not a surface this repo compiles against, so the caret target (not the better-auth-style exact) is the correct arm. This is precisely the target-only lift the Validate Package Dependencies 在所有 PR 上红:dompurify@3.4.12 新公告 GHSA-55q2-fjhq-7xh7(已有 fix 3.4.13,经 mermaid 传递引入) #6407 note pre-announced. The floor binds this workspace alone: no workspace manifest declares dompurify (its only consumer in the lockfile is mermaid@11.16.1, declared by apps/docs only, which is private: true); pnpm-workspace.yaml is named in no package's files[]; no published manifest changes; check:override-consistency ran inside the green Validate Package Dependencies. Registry: dompurify@3.4.16 exists (2026-09-23, latest, no dependencies); mermaid@11.16.1 declares dompurify ^3.3.3, which admits 3.4.16 — a dedupe inside mermaid's own range. The root package.json pnpm field holds only ignoredBuiltDependencies, so the issue body's "root pnpm.overrides has no floor" was wrong about where the override lives; the PR's correction is right and matches the workspace file's own header ("pnpm v10 reads overrides from THIS file").
4. Lockfile moves only next, its @next/* closure and dompurify — RIGHT. Census of all 138 changed lines: the overrides echo (2 lines); 11 package entries out and 11 in — next, @next/env, the eight @next/swc-*, dompurify — each as a resolution/integrity pair plus its snapshot stub, with the apps/docs importer's specifier/version lines; every remaining changed line is a peer-suffixed snapshot key or dependency line that embeds next@16.3.3 → 16.3.6 (fumadocs-core, fumadocs-mdx, fumadocs-ui, better-auth, @better-auth/oauth-provider, @better-auth/scim, @better-auth/sso) or mermaid's dompurify: 3.4.13 → 3.4.16 dependency line. No other package changes version; the lockfile header and settings are unchanged. Shape is a regeneration, not a hand edit.
5. No exemption, no changeset file — RIGHT. osv-scanner.toml is byte-identical between origin/main and the head (zero exemptions, as its header requires); nothing under .changeset/ is in the diff.
6. The new pnpm-workspace.yaml comment — RIGHT, with one provenance note. Date 2026-10-01 and card #21055: correct. GHSA-p98j-92pf-mc4p (2.3 low): the id and 2.3 are the card's scanner table, and 2.3 is CVSS Low. fixed: 3.4.16: the scanner table. introduced: 3.4.13 and the hook description ("IN_PLACE node-removing afterSanitize hook leaves the detached subtree's event handlers armed"): the dev's reading of the offline OSV database, which the comment itself attributes; it is consistent with the Validate Package Dependencies 在所有 PR 上红:dompurify@3.4.12 新公告 GHSA-55q2-fjhq-7xh7(已有 fix 3.4.13,经 mermaid 传递引入) #6407 note above it (3.4.13 was the previous advisory's fix on the same IN_PLACE-hook class) and with the old floor ^3.4.13 being the one version the scanner flagged, and it is not independently re-fetched from here. mermaid@11.16.1's ^3.3.3 admits 3.4.16: registry-confirmed. "The floor binds this workspace's resolution only; overrides do not reach downstream installs": the same sentence validate-deps.yml and check-override-consistency.mjs carry. Style matches its neighbours (dated OSV note, card number, no new claim about the gate's output).
7. Check-runs on 68c26aa189, 41 runs, read 2026-10-01T05:13:58Z. success: Validate Package Dependencies, Build Docs, Build Core, Check Changeset, Governed Surface Queue Guard, Dogfood Regression Gate (and shards 1/3, 2/3, 3/3), Dogfood Verify CLI, Temporal Conformance (live PG + MySQL), Test Core 2/6 and 4/6, Type Check · source gates, Type Check · consumer gates, Type Check · debt ledger, Check PR Size, Auto Label, Check Documentation Links, Stable release watch for prerelease pins, The card this PR closes must claim this branch, No other open PR may claim the same issue, No other open PR may claim the same single-writer path, Part-of PR must not also close its card, filter. Still in_progress at read: Lint & Repo Gates, Type Check · workspace (it runs turbo run typecheck over ./apps/*, so it carries the docs typecheck), Test Core 1/6, 3/6, 5/6, 6/6. skipped: label-event re-runs of Auto Label, Check PR Size, Check Changeset, Packed-tarball smoke (opt-in), Console Pin Gate. No run has failed. "Every check green" before landing is the dispatching seat's re-read, not this record's claim.

② Semver level

Nothing published moves. next is declared only by @objectstack/docs (private: true, no files[], absent from .changeset/config.json's fixed group); dompurify is declared by no workspace manifest; pnpm-workspace.yaml overrides and pnpm-lock.yaml are in no package's files[] and ship in no tarball; no published package's dependency range changes. AGENTS.md Post-Task Checklist step 3's skip-changeset arm — "a diff that publishes nothing from any released package" — therefore holds; the label is on the PR and Check Changeset is success. origin/main precedent agrees in both directions: #20774 (override floors plus lockfile only) landed with no changeset, while #20719 carried one because it moved packages/metadata's declared range. @objectstack/docs's own CHANGELOG (versioned through privatePackages.version: true) records content fixes to the shipped pages; a dependency patch that changes no page is not owed one. Clause-②: no on line 3 of the PR body is correct — no accept-set or public-surface change, no arm. Level: none (skip-changeset), matching the diff.

③ Boundary flags

os-dev-report 5925128805: open_questions is empty. Its three deviations and one out_of_scope_findings entry:

1. next 16.3.6 rather than the newest 16.3.8 — ANSWERED, accepted. The triage direction is "≥ 16.3.6"; osv-scanner.toml's header rule is "when an advisory HAS a fixed version, you take the fix"; the scanner on this head matches nothing at 16.3.6; and 16.3.6 is Dependabot chore(deps)(deps): bump the production-dependencies group with 27 updates #21029's target, so the grouped PR's next line is satisfied rather than in conflict. 16.3.7 and 16.3.8 stay in Dependabot's lane. No input names an advisory on 16.3.6.
2. Local docs build ran without CI's TURBO_FORCE — ANSWERED, superseded. CI's Build Docs ran vercel.json's command under TURBO_FORCE on this head and is success.
3. main moved 4 commits after the merged 0c5a71b094 — ANSWERED, verified. git log 0c5a71b094..origin/main -- pnpm-lock.yaml pnpm-workspace.yaml apps/docs/package.json package.json is empty (the four commits are feat(cli)!: os validate and os build refuse a picklistExtensions entry whose extend names no declared picklist #21049, feat(objectql,metadata-protocol): validate and insertMany answer which row lost which field #21041, fix(core,driver-sql,service-analytics): the analytics native-SQL path answers measures declared number as numbers (#20889) #21040, fix(objectql)!: engine aggregate asks the field-type table for every row — min / max / avg over a refused type answer INVALID_FIELD / 400 on every driver #21037); the PR is mergeable: true. No second merge was owed.
4. Out of scope: the pre-existing Validate Package Dependencies 在所有 PR 上红:dompurify@3.4.12 新公告 GHSA-55q2-fjhq-7xh7(已有 fix 3.4.13,经 mermaid 传递引入) #6407 note says check-override-consistency.mjs "will list this as an override it cannot cross-check" — ANSWERED, confirmed stale, no carrier needed. The script (identical on main and the head) prints only its Consumer census and Self-expiring selectors reports; the sentence predates this diff, and the diff's new lines do not repeat it. Under Prime Directive chore: version packages #10 a stale comment is an acceptance note, not a card; it is recorded in the report and in the card's ACCEPT comment. The PR body's Acceptance notes do not carry it — a note, not a defect; no escalation.

No flag is left open. The PR is a draft on an apps/docs/** face carrying needs:contract-review; removing that label on a PASS is the writing seat's act, not this record's.

Implemented-by: claude/issue-21055-osv-next-dompurify
Reviewed-by: session_01JAhu8u8QfBvRjVZDox7CP9

VERDICT: PASS