docs: record fixed frontend production dependency baseline

RELEASE_GATES.md

@@ -487,6 +487,13 @@ deliberately different policies.
    `--outdated=false` keeps this step about vulnerabilities, not staleness. The
    two npm audits are production-dependency-only at high severity.
 
+The October 2026 frontend security baseline is Next.js 16.4.1 (also used by
+marketing), `@sentry/nextjs` 10.75.2 and transitive DOMPurify 3.4.17. The
+frontend's ESLint Next.js preset follows the framework version. DOMPurify is
+resolved through Swagger UI's existing dependency range; neither published UI
+kit package declares these dependencies. Regenerate locks with npm and rerun
+both production audits when moving this baseline.
+
 So `--fail-on-vuln=false` narrows *what blocks*, never *what is looked at*: the
 evidence report is the wider of the two, and the enforcement step is the
 narrower. A finding in a first-party dependency is un-mergeable; a finding in a

docs/historical/ROADMAP.md

@@ -1,5 +1,9 @@
 > **Historical.** Retired on 2026-09-17; kept for the record and not maintained. The one plan is [docs/PLAN.md](../PLAN.md).
 
+Framework versions below describe their dated changes, not the current security
+baseline. The starter now uses Next.js 16.4.1; see
+[Release gates](../../RELEASE_GATES.md#vulnerability-policy-and-its-one-exemption).
+
 # SaaS Starter implementation roadmap
 
 Status: active

docs/historical/TODO.md

@@ -1,5 +1,9 @@
 > **Historical.** Retired on 2026-09-17; kept for the record and not maintained. The one plan is [docs/PLAN.md](../PLAN.md).
 
+Framework versions below describe their dated changes, not the current security
+baseline. The starter now uses Next.js 16.4.1; see
+[Release gates](../../RELEASE_GATES.md#vulnerability-policy-and-its-one-exemption).
+
 # SaaS Starter master TODO
 
 Detailed design and sequencing: [ROADMAP.md](ROADMAP.md)

module/FEATURES.md

@@ -36,8 +36,8 @@ the auth-gateway in front so this code path isn't reached.
 | Layer        | Choice                                               |
 |--------------|------------------------------------------------------|
 | Backend      | Go, Connect-RPC + gRPC + grpc-gateway REST (one impl)|
-| Frontend     | Next.js 16 (App Router) + Connect-ES + TanStack Query|
-| Public site  | Separate Next.js 16 service + repository Markdown     |
+| Frontend     | Next.js 16.4.1 (App Router) + Connect-ES + TanStack Query|
+| Public site  | Separate Next.js 16.4.1 service + repository Markdown     |
 | Auth tokens  | Ed25519 JWT, OWASP refresh-token rotation            |
 | Identity     | WorkOS / Auth0 / Google / generic OIDC (prod), fixture (dev) |
 | Database     | Postgres                                             |

module/docs/adr/0001-frontend-plugin-packaging.md

@@ -112,9 +112,10 @@ cannot diverge or fight during synchronization.
 
 ### Framework compatibility
 
-The initial supported line is Next.js `>=16.2 <17`, React `>=19.2 <20`, and
+The supported line is Next.js `>=16.4.1 <17`, React `>=19.2 <20`, and
 React DOM `>=19.2 <20`. CI pins the starter's tested versions (currently Next
-16.2.10 and React/React DOM 19.2.4). The contract package has no React runtime,
+16.4.1 and React/React DOM 19.2.8). The Next.js minimum includes the October 2026
+security fixes. The contract package has no React runtime,
 type, or peer dependency. The React package enforces its React peer range;
 framework-bearing UI packages will enforce corresponding Next.js and React DOM
 ranges if they are activated.

module/services/frontend/code/AGENTS.md

@@ -1,6 +1,6 @@
 <!-- BEGIN:nextjs-agent-rules -->
 
-# This is NOT the Next.js you know
+## This is NOT the Next.js you know
 
 This version has breaking changes — APIs, conventions, and file structure may all differ from your training data. Read the relevant guide in `node_modules/next/dist/docs/` (resolved from this file's directory; in monorepos the `next` package may not be visible from the repo root) before writing any code. Heed deprecation notices.