fix(deps): patch framework and tooling vulnerabilities

docs/security-review.md

@@ -1,6 +1,6 @@
 # Security review
 
-Review date: 2026-08-02
+Review timestamp: 2026-09-10T12:00:10Z
 
 ## Scope
 
@@ -8,10 +8,11 @@ Next.js portal and APIs, Discord bot, PostgreSQL persistence, Keycloak admin aut
 
 ## Automated checks
 
-- Semgrep `auto`: 0 findings
-- `npm audit`: 0 known vulnerabilities after dependency overrides
-- TypeScript, ESLint, unit tests, Next.js production build: passing
-- Velocity Java tests and shaded plugin build: passing
+- Full source Semgrep `auto`: 0 findings across 169 scanned files (331 rules; 13 files excluded by ignore patterns).
+- `npm audit` and `npm audit --omit=dev`: 0 known vulnerabilities after remediation. Baseline had six affected entries (two moderate, two high, two critical), covering Next.js/Sharp, the NextAuth dependency path, Vitest/mocker, and js-yaml.
+- Resolved patched versions: Next.js and eslint-config-next 16.3.4, Sharp 0.35.4, Vitest/mocker 4.1.11, js-yaml 4.3.2. Retained Next.js's PostCSS override at 8.5.25. No forced major dependency upgrades or database changes.
+- TypeScript, 181 workspace tests, Next.js production build, and Velocity Java tests/shaded plugin build pass with patched dependencies. ESLint exits successfully with two new framework-rule warnings about existing `window.location.assign()` calls in `map-view-toggle.tsx`; those unrelated navigation behaviors were not changed.
+- Verification is local source evidence, not a claim that patched artifacts have been deployed. API CI run 1979 passed for the preceding API source `1a01c0ed641f4eda83f81c855c38651aa116933e`.
 
 ## Implemented controls
 
@@ -19,6 +20,7 @@ Next.js portal and APIs, Discord bot, PostgreSQL persistence, Keycloak admin aut
 - Login links expire after ten minutes, are single use, and are rate limited per Discord user with a PostgreSQL advisory lock.
 - Session cookies are `httpOnly`, `sameSite=lax`, path-scoped, and secure in production.
 - Admin access uses Keycloak OIDC and a required role.
+- Every suggestions API route independently requires that admin session/role before reading cached or live Discord data. The configured forum is guild/type-checked and requested threads are parent/type-checked before message access. Discord credentials remain server-side; fixed-host, validated-ID requests have bounded caching, concurrency, timeouts, and rate-limit backoff. Responses are uncached and errors use safe RFC 9457 problems. See [suggestions API](admin-suggestions-api.md) for live Discord permission/intent requirements.
 - User mutations verify ownership server-side.
 - Mojang lookup is server-side and targets a fixed host, avoiding client-forged validation and SSRF.
 - Velocity credentials are high-entropy bearer tokens stored only as hashes.