[antoinetoussaint-byte]

Summary

Codefly supply chain has been red on main since 2026-10-22, and it is a required
check in the repo's active ruleset ("main protection"). So this blocks every PR
here, not just one — #1209 and #1210 are both sitting behind it.

The gate's Enforce first-party vulnerability gate step runs
npm audit --omit=dev --audit-level=high over the frontend and marketing services,
and reported three critical advisories, all with patched releases on the
installed major line:

package	installed	advisories	patched
next	16.3.8	unauthenticated RCE in Image Optimization via SVG (GHSA-2464-fhr4-w9xw); DoS in App Router Server Actions (GHSA-p3m5-59mp-jv5r); RCE in use cache returning typed arrays (GHSA-673q-mjm6-r5xr)	16.4.1 (16.x line)
@sentry/nextjs	10.73.0	middleware bypass when using a tunnel route (GHSA-mchm-gjx6-7h55)	10.75.2 (10.x line)
dompurify	3.4.16	SAFE_FOR_TEMPLATES bypass (GHSA-cg2g-xh64-v4q7); IN_PLACE leaves a detached subtree's handlers armed (GHSA-mrv2-3pqr-j5jr); SMIL attributeName=href guard skipped under application/xhtml+xml (GHSA-c6gr-qvv4-5v3f)	3.4.17

Each patched version was read from the advisory's own vulnerabilities[] entry for
the installed major line, not from the first range the API returns — the first
entry for next is the 15.x line (patched 15.5.28), which would have been the wrong
target.

Resolved to next 16.4.3, @sentry/nextjs 10.76.2, dompurify 3.4.17.
marketing carries next directly and needed the same bump.

Why lockfiles only

Every existing range already admits its patched version — next: ^16.2.12,
@sentry/nextjs: ^10.50.0, and dompurify transitively through
swagger-ui-react: ^3.4.13 — so no manifest edit is needed, and a regenerated lock
can only resolve forward. Done with npm update <pkgs> --package-lock-only, so the
diff is two lockfiles and nothing else.

Verification

Both services, with the gate's exact command:

module/services/frontend/code   npm audit --omit=dev --audit-level=high -> found 0 vulnerabilities
module/services/marketing/code  npm audit --omit=dev --audit-level=high -> found 0 vulnerabilities

marketing was proven red first (1 critical severity vulnerability, GHSA-673q-mjm6-r5xr)
and green after, so the bump is doing the work rather than the audit being skipped.

The gate's Go half — codefly audit service accounts|auth-gateway --fail-on-vuln —
was already state: CLEAN ✓ no findings and is untouched.

Not verified locally: no npm ci, typecheck, or build was run — next 16.3.8 → 16.4.3 is a real minor bump within the existing range, and Codefly build /
Codefly quality are required checks that exercise it here. If either goes red, that
is this PR's problem to fix, not a flake.

Nothing was suppressed, allowlisted or marked reviewed; the gate fails closed and
stays that way.

Classification: fix, at the place that owns the dependency.

🤖 Generated with Claude Code

[antoinetoussaint-byte]

Closing as superseded, not merged.

While this was open, #1027 ("remove telemetry service and use the operations intake") landed on main carrying the same remediation in its own dependency changes. main now pins next: "16.4.1" and @sentry/nextjs: "10.75.2" in module/services/frontend/code/package.json, next: "16.4.1" in marketing, and its lockfiles resolve next 16.4.1, @sentry/nextjs 10.75.2, dompurify 3.4.17.

I rebuilt this branch on top of main — took main's lockfiles for the conflicted paths and re-derived npm update next @sentry/nextjs dompurify --package-lock-only on top, which is how a lockfile conflict should be resolved rather than hand-merged — and the result is byte-identical to main. git diff origin/main is empty, so there is nothing left for this PR to contribute.

Codefly supply chain is green on main again as of 16:02, so the required check that was blocking every PR in this repo is clear.

For the record, since the diagnosis outlived this PR: the gate was failing on three criticals in module/services/frontend/code — unauthenticated RCE in the Next.js Image Optimization API via SVG (GHSA-2464-fhr4-w9xw), DoS in App Router Server Actions (GHSA-p3m5-59mp-jv5r), RCE in use cache functions returning typed arrays (GHSA-673q-mjm6-r5xr), plus the @sentry/nextjs tunnel-route middleware bypass and three dompurify bypasses. Nothing was suppressed or allowlisted to clear it.