Review npm audit findings

Author: marcomartinomarch2005

SECURITY_REVIEW_NOTES.md

@@ -1,46 +1,50 @@
 # Security Review Notes
 
-These notes summarize the current dependency audit status for the OSS readiness PR.
+These notes summarize the current dependency audit status after the OSS readiness merge and the `security/npm-audit-review` follow-up.
 
 ## Audit Status
 
-`npm audit` currently reports unresolved findings:
+`npm audit fix` was run without `--force`.
 
-- 3 moderate severity findings
-- 1 high severity finding
+The non-forced audit fix updated safe transitive dependencies in `package-lock.json`:
+
+- `brace-expansion` from `5.0.5` to `5.0.6`
+- `ws` from `8.20.0` to `8.21.0`
 
-The findings are in the dependency tree, not in newly added documentation.
+After those safe fixes, `npm audit` still reports unresolved findings:
 
-## Affected Dependency Category
+- 1 moderate severity finding
+- 1 high severity finding
 
-The current audit output includes advisories in these categories:
+## Remaining Affected Dependency Categories
+
+The remaining audit output includes advisories in these categories:
 
 - Next.js framework dependency advisories
-- PostCSS transitive dependency advisories
-- `brace-expansion` transitive dependency advisory
-- `ws` transitive dependency advisory
+- PostCSS transitive dependency advisory through Next.js
 
 ## Safe Fix Availability
 
-The audit output indicates:
+The audit output indicates that the remaining Next.js/PostCSS findings require:
+
+```bash
+npm audit fix --force
+```
 
-- `brace-expansion` has a fix available through `npm audit fix`.
-- `ws` has a fix available through `npm audit fix`.
-- Next.js/PostCSS findings require `npm audit fix --force`, which would install `next@16.2.7` outside the currently stated dependency range.
+That command would install `next@16.2.7`, which is outside the currently stated dependency range.
 
-## Why Risky Fixes Were Not Forced
+## Why Forced Upgrades Were Not Applied
 
-This PR is scoped to OSS readiness documentation and small validation-safe fixes. Forced dependency updates can change framework behavior, generated lockfile contents, and build/runtime compatibility.
+Forced dependency updates were intentionally not applied in this branch.
 
-Because this repository uses Next.js 16 and the project-specific instructions warn that this version has breaking changes and requires care, forced framework upgrades should be reviewed in a dedicated dependency PR.
+This repository uses Next.js 16, and the project instructions note that this version can have breaking API, convention, and file-structure changes. A framework update should be reviewed separately with release notes, local usage checks, and focused runtime validation.
 
 ## Recommended Next Action
 
-Open a separate dependency/security PR to:
+Open a dedicated Next.js security update PR to:
 
-- run `npm audit` again;
-- try `npm audit fix` without force;
-- evaluate the required Next.js update separately;
-- run lint and build after dependency changes;
-- test the auth, dashboard, brainstorming, preview, and export flows;
+- review the relevant Next.js release notes and advisories;
+- update Next.js within an intentional version range;
+- run lint and build after the framework update;
+- smoke test authentication, dashboard, project creation, brainstorming, preview, export, and protected-route behavior;
 - document any remaining advisories or accepted risk.