[antoinetoussaint-byte]

Fixes #1227.

The October 2026 production npm advisories require Next.js 16.4.1, matching eslint-config-next 16.4.1, @sentry/nextjs 10.75.2, and DOMPurify 3.4.17 through Swagger UI's existing range. This branch selected those first fixed versions and regenerated both locks with npm, without hand edits.

Before publication, #1027 landed the exact same dependency manifests and lockfiles on main (0004aee). Their diff against main is empty. This PR therefore completes the accompanying security-baseline documentation and retains the Next.js-generated AGENTS.md heading change. The dependency selections were verified locally as listed below.

Classification: fix. Reuses the existing dependency graph, npm lock generation, Codefly runtime, and production vulnerability gate. No alternate audit mechanism or advisory exception was added. Neither @codefly-dev/ui nor @codefly-dev/saas-ui declares the affected dependencies; the preview stylesheet regenerated byte-identically before and after, and the kit-version gate passes against v0.0.105, so their versions do not change. The Next.js-generated AGENTS.md heading change is retained.

Documentation updated: RELEASE_GATES.md records the security baseline; module/FEATURES.md and module/docs/adr/0001-frontend-plugin-packaging.md name the current framework version. docs/historical/TODO.md and docs/historical/ROADMAP.md point their historical version references to the current baseline without rewriting dated events.

Verified locally with Node 24.21.0, npm 11.19.0 and Codefly 0.1.202:

• First-party Go audits: codefly audit service accounts --outdated=false --fail-on-vuln and the same for auth-gateway both report no findings.
• Fresh npm ci installs of both generated lockfiles succeed.
• Exact CI commands npm --prefix module/services/frontend/code audit --omit=dev --audit-level=high and npm --prefix module/services/marketing/code audit --omit=dev --audit-level=high: each reports found 0 vulnerabilities.
• npm run build in frontend and marketing: passed. Frontend reports the expected missing deployment legal-content warning and Sentry's config-import deprecation warning.
• Frontend npm run test:pure: 345 files, 4,889 tests passed. Frontend lint: zero errors, 40 warnings. Marketing tests: 22 passed.
• codefly run service --fixture dev-admin --temporary-ports --output-env <owner-only-file> --output-env-service saas-starter/frontend: the graph starts. Browser sign-in with the development admin fixture reaches /, showing Welcome Back, Admin, admin navigation and the sign-in audit entry. The terms prompt is present; no terms were accepted. All endpoints came from Codefly.
• Preview stylesheet regeneration, kit-version gate, naming gate, boundary gate, diff whitespace check and all 111 release-gate contract tests: passed.

Not verified: external identity-provider login, the full browser/integration suites, production deployment, release/tag/package publication, and image publication. The browser smoke uses the Codefly development server; the production frontend build was checked separately.

Overlap: #1222 carries the same dependency bumps and will take these on rebase or drop that part.

The Dependency audit auto-remediation workflow and repository settings are unchanged. No release, tag, image push or new issue is part of this PR.

Hosted CI: the pull-request planner correctly selects no services because the dependency changes already exist on main, so its Codefly supply chain job is skipped. The full-graph workflow dispatch on commit 776c5e513 ran Codefly supply chain successfully, including the first-party vulnerability gate: https://github.com/codefly-dev/module-saas-starter/actions/runs/39981998420/job/120511953171 .

[antoinetoussaint-byte]

Closing: superseded, and it fixed this at the wrong owner.

The three criticals were resolved on main by #1232, which moved the nextjs agent to 0.0.167. That is the place that owns the framework version: the agent pins it exactly in its base and factory templates, and its own framework_version_test.go holds the lockfile's resolved version equal to the declared one, so no service the agent builds can resolve past that pin. A hand-bump of next in a module's package.json and lockfile, which is what this PR does, cannot hold against that and is a change at the consumer rather than at the owner.

Evidence that the problem is gone: the Codefly supply chain job on main (run 39993970349) reports found 0 vulnerabilities for both the frontend and the marketing service, covering all three advisories named in #1227 — the Next.js criticals, the Sentry middleware bypass and the DOMPurify bypasses.

Nothing here is needed. #1227 stays as the record of the diagnosis, including the separate finding that the dependency-audit workflow cannot open its own pull requests, which #1230 has since addressed.