fix(deps): patch framework and tooling vulnerabilities

apps/web/package.json

@@ -20,7 +20,7 @@
     "d3-geo": "^3.1.1",
     "drizzle-orm": "^0.45.1",
     "leaflet": "^1.9.4",
-    "next": "^16.2.1",
+    "next": "^16.3.4",
     "next-auth": "^4.24.13",
     "rcon-client": "^4.2.5",
     "react": "^19.2.3",
@@ -38,7 +38,7 @@
     "@types/react-dom": "^19.2.3",
     "@types/topojson-client": "^3.1.5",
     "eslint": "^9.39.4",
-    "eslint-config-next": "^16.2.1",
+    "eslint-config-next": "^16.3.4",
     "jsdom": "^30.0.1",
     "tailwindcss": "^4.2.1",
     "typescript": "^5.9.3",

docs/security-review.md

@@ -1,6 +1,6 @@
 # Security review
 
-Review date: 2026-08-02
+Review timestamp: 2026-09-10T12:00:10Z
 
 ## Scope
 
@@ -8,10 +8,11 @@ Next.js portal and APIs, Discord bot, PostgreSQL persistence, Keycloak admin aut
 
 ## Automated checks
 
-- Semgrep `auto`: 0 findings
-- `npm audit`: 0 known vulnerabilities after dependency overrides
-- TypeScript, ESLint, unit tests, Next.js production build: passing
-- Velocity Java tests and shaded plugin build: passing
+- Full source Semgrep `auto`: 0 findings across 169 scanned files (331 rules; 13 files excluded by ignore patterns).
+- `npm audit` and `npm audit --omit=dev`: 0 known vulnerabilities after remediation. Baseline had six affected entries (two moderate, two high, two critical), covering Next.js/Sharp, the NextAuth dependency path, Vitest/mocker, and js-yaml.
+- Resolved patched versions: Next.js and eslint-config-next 16.3.4, Sharp 0.35.4, Vitest/mocker 4.1.11, js-yaml 4.3.2. Retained Next.js's PostCSS override at 8.5.25. No forced major dependency upgrades or database changes.
+- TypeScript, 181 workspace tests, Next.js production build, and Velocity Java tests/shaded plugin build pass with patched dependencies. ESLint exits successfully with two new framework-rule warnings about existing `window.location.assign()` calls in `map-view-toggle.tsx`; those unrelated navigation behaviors were not changed.
+- Verification is local source evidence, not a claim that patched artifacts have been deployed. API CI run 1979 passed for the preceding API source `1a01c0ed641f4eda83f81c855c38651aa116933e`.
 
 ## Implemented controls
 
@@ -19,6 +20,7 @@ Next.js portal and APIs, Discord bot, PostgreSQL persistence, Keycloak admin aut
 - Login links expire after ten minutes, are single use, and are rate limited per Discord user with a PostgreSQL advisory lock.
 - Session cookies are `httpOnly`, `sameSite=lax`, path-scoped, and secure in production.
 - Admin access uses Keycloak OIDC and a required role.
+- Every suggestions API route independently requires that admin session/role before reading cached or live Discord data. The configured forum is guild/type-checked and requested threads are parent/type-checked before message access. Discord credentials remain server-side; fixed-host, validated-ID requests have bounded caching, concurrency, timeouts, and rate-limit backoff. Responses are uncached and errors use safe RFC 9457 problems. See [suggestions API](admin-suggestions-api.md) for live Discord permission/intent requirements.
 - User mutations verify ownership server-side.
 - Mojang lookup is server-side and targets a fixed host, avoiding client-forged validation and SSRF.
 - Velocity credentials are high-entropy bearer tokens stored only as hashes.

package.json

@@ -18,9 +18,9 @@
   },
   "overrides": {
     "esbuild": "0.25.12",
-    "next@16.2.12": {
+    "next@16.3.4": {
       "postcss": "8.5.25",
-      "sharp": "0.35.3"
+      "sharp": "0.35.4"
     }
   },
   "engines": {