SECURITY_REVIEW_NOTES.md

Security Review Notes

These notes summarize the current dependency audit status after the OSS readiness merge and the security/npm-audit-review follow-up.

Audit Status

npm audit fix was run without --force.

The non-forced audit fix updated safe transitive dependencies in package-lock.json:

• brace-expansion from 5.0.5 to 5.0.6
• ws from 8.20.0 to 8.21.0

After those safe fixes, npm audit still reports unresolved findings:

• 1 moderate severity finding
• 1 high severity finding

Remaining Affected Dependency Categories

The remaining audit output includes advisories in these categories:

• Next.js framework dependency advisories
• PostCSS transitive dependency advisory through Next.js

Safe Fix Availability

The audit output indicates that the remaining Next.js/PostCSS findings require:

npm audit fix --force

That command would install next@16.2.7, which is outside the currently stated dependency range.

Why Forced Upgrades Were Not Applied

Forced dependency updates were intentionally not applied in this branch.

This repository uses Next.js 16, and the project instructions note that this version can have breaking API, convention, and file-structure changes. A framework update should be reviewed separately with release notes, local usage checks, and focused runtime validation.

Recommended Next Action

See docs/NEXT_POSTCSS_AUDIT_REVIEW.md for the dedicated investigation notes.

Open a dedicated Next.js security update PR to:

• review the relevant Next.js release notes and advisories;
• update Next.js within an intentional version range;
• run lint and build after the framework update;
• smoke test authentication, dashboard, project creation, brainstorming, preview, export, and protected-route behavior;
• document any remaining advisories or accepted risk.