Services

Dependency Updates Applied Final

Dependency updates applied — final validation

Date: 2026-06-22

Scope#

This report validates the dependency update slices merged before this final pass. It records the dependency/security state after syncing the lockfile into node_modules, the targeted build/test/performance checks that were feasible from the changed surfaces, and the migration work intentionally deferred.

Updates applied by the merged slices#

Frontend / workspace#

  • Updated the default Next.js catalog line to next 15.5.19 / @next/env 15.5.19 for the public Next 15 apps.
  • Kept apps/academy on the Next 14 patch line at next 14.2.35 instead of forcing a framework migration.
  • Kept Studio isolated in the catalogs.studio catalog, with Studio-specific framework/tooling versions separate from the public-app catalog.
  • Updated routine frontend tooling and deployment dependencies, including turbo 2.9.18, wrangler 4.100.0, vitest 4.1.9, and @vitest/* 4.1.9.
  • Updated Cloudflare/OpenNext app dependency ranges to @opennextjs/cloudflare ^1.19.11.
  • Added/remediated pnpm overrides and patched dependencies for the targeted security paths, including @grpc/grpc-js, protobufjs, form-data, fast-uri, js-cookie, hono, undici, ws, lodash-es, and the updated wrangler@4.100.0 patch.

Backend Go#

  • Added managed Go vulnerability tooling via tool golang.org/x/vuln/cmd/govulncheck, make govulncheck, and the root mise run vuln:backend task.
  • Updated runtime/security-sensitive backend modules, including:
    • github.com/gin-gonic/gin v1.12.0
    • github.com/jackc/pgx/v5 v5.10.0
    • github.com/lib/pq v1.12.3
    • github.com/meilisearch/meilisearch-go v0.36.3
    • golang.org/x/crypto v0.53.0
    • golang.org/x/net v0.56.0
    • golang.org/x/sys v0.46.0
    • golang.org/x/text v0.38.0
    • golang.org/x/tools v0.46.0
    • google.golang.org/protobuf v1.36.11

Final dependency/security state#

Compared with the baseline audit, the production pnpm security state improved from critical=1, high=64 to critical=0, high=5.

The remaining production high advisories are all on apps__academy>next. Academy is intentionally still on next 14.2.35; the remaining patched versions reported by pnpm audit require a Next 15+ migration, so those advisories are deferred to an Academy framework migration rather than hidden by a broad dependency jump.

The full high-threshold audit still reports dev/build-tooling advisories outside production dependencies. The highest remaining clusters are:

  • handlebars critical/high via packages__generator>@redocly/cli>handlebars
  • minimist critical via root favicon tooling path .>to-ico>resize-img>jimp>mkdirp>minimist
  • shell-quote critical via apps__design-system>concurrently>shell-quote
  • tar high via packages__studio-ai-commands>libpg-query>@mapbox/node-pre-gyp>tar
  • next high via apps__academy>next
  • lodash.template, lodash, simple-git, url-regex, jpeg-js, and vite high advisories in non-production or build/development paths

Deferred major migrations#

These remain intentionally deferred because they affect framework/runtime compatibility, peer dependencies, generated artifacts, or deployment behavior across multiple apps:

  • Next 15 / Academy Next 14 -> Next 16 or at least Academy -> Next 15+
  • React 18 -> React 19
  • TypeScript 5.9 -> TypeScript 6
  • Vite 7 -> Vite 8
  • @vitejs/plugin-react 5 -> 6
  • AI SDK 5 -> 6 and @ai-sdk/openai 2 -> 3

The final pnpm outdated run still reports 243 outdated entries: 124 latest versions are major-version jumps and 119 are minor/patch latest versions. Deprecated entries remain 7.

Commands and results#

All commands below were run from the repository root unless noted.

CommandExitResult
mise exec -- pnpm install --frozen-lockfile0Lockfile up to date; synced installed packages (Packages: +129 -31), including turbo 2.9.18 and wrangler 4.100.0.
mise exec -- pnpm audit --audit-level high --json1low=15, moderate=79, high=25, critical=3, dependencies=3617.
mise exec -- pnpm audit --prod --json1low=12, moderate=55, high=5, critical=0, dependencies=2206; remaining production highs are apps__academy>next.
mise exec -- pnpm outdated -r --format json1outdated=243, deprecated=7, major_latest=124, minor_patch_latest=119.
mise run vuln:backend0mise exec -- go tool govulncheck ./...; No vulnerabilities found.
(cd backend && mise exec -- go test ./...)0Backend Go package tests passed.
mise run build:backend0Built academy-api, academy-seed, auth-api, billing-api, and saas-api.
mise exec -- pnpm --filter ui-patterns test013 test files passed; 130 tests passed. Existing Radix dialog accessibility warnings were printed by MobileSheetNav tests.
mise exec -- pnpm --filter studio-ui test07 test files passed, 3 skipped; 36 tests passed, 6 skipped.
mise run typecheck025 Turbo typecheck tasks successful; turbo 2.9.18.
mise exec -- pnpm --filter docs --filter academy --filter design-system --filter ui-library run build:cf0Cloudflare/OpenNext builds completed for all four apps; academy built on Next 14.2.35, the others on Next 15.5.19.
mise exec -- pnpm --filter blog build0Blog production build completed on Next 15.5.19; generated 391 static pages.
mise exec -- pnpm perf:cf-budgets -- --app docs --app academy --app design-system --app ui-library --allow-missing1Budget gate failed for existing limits: Academy javascriptGzip 6.20 MiB / 1.50 MiB, assetsRaw 41.6 MiB / 20.0 MiB, largestAssetRaw 36.1 MiB / 5.00 MiB; Design System javascriptGzip 1.93 MiB / 1.50 MiB; UI Library javascriptGzip 1.51 MiB / 1.50 MiB. Docs stayed within configured budgets.

Note: I initially tried the mise run build:cf:pick / mise run build:pick wrappers with positional arguments, but this harness did not pass those arguments into the task $1; I reran the equivalent pnpm --filter ... commands above and used those as the authoritative build results.

User-change protection#

The validation builds regenerated tracked local artifacts (apps/ui-library/public/llms.txt and apps/docs/next.config.mjs). Those generated diffs were reverted before this report was written. The final committed change from this pass is this audit report only; no apps/ui-library/public/llms.txt change is included.

Verification commands:

1
$ git diff --name-only -- apps/ui-library/public/llms.txt apps/docs/next.config.mjs
2
# no output
1
$ git log --oneline -5 -- apps/ui-library/public/llms.txt
2
3c1b08fd fix(docs): add managed infrastructure redirects
3
2c11013d fix(links): harden production link health checks
4
c170d026 fix(cloudflare): make cf build checks pass
5
7c098f61 www: robust deep-link anchors on service pages; add E2E coverage for anchors across services (gitops tools verified).
6
b05754bf sync: update repository