[roomote-roomote]

​Created by Roomote. View the session or mention @roomote-roomote for follow-up asks.

Related issue

Addresses the 31 open Dependabot records #248–#278, including Next.js alert #263, DOMPurify alert #261, and Sentry alert #270. Rechecked current alerts and open PR coverage before editing. These alerts remain open on the default branch pending merge and GitHub rescan; no alert was dismissed or claimed closed.

Why this PR exists

• A maintainer explicitly invited this PR in the linked issue or discussion
• I am a maintainer / this is internal Roomote work

Patch the aligned web, sanitization, parser and test-tooling security bundle across the workspace and standalone API dependency graphs. The verified records comprise 10 critical, 13 high, three medium and five low alerts.

What changed

Dependency	Version transition	Dependabot records
Next.js	16.3.8 → 16.4.1	#262–#264, #268–#269, #278
DOMPurify	3.4.16 → 3.4.17	#250–#255, #259–#261, #265–#267, #272–#274
toml	4.2.0 → 5.0.1	#256–#258, #275–#277
ip-address	10.7.1 → 10.7.4	#271
@sentry/nextjs	10.56.0 → 10.75.2	#270
Vitest and aligned 4.x internals	4.1.11 → 4.1.12	#248–#249

Use the first patched releases, update direct affected declarations and existing overrides, and regenerate both lockfiles with pnpm. Sentry's web dependency graph moves together; independently pinned backend Sentry packages stay on their existing versions. The requested toml security update crosses a major version and retains Node ≥20 compatibility with the repository's Node 22/24 targets.

Replace the session-renewal integration test's incomplete Next WorkStore cast with Next's real work-store factory, required by the updated internal types. Real Next cookies, Better Auth and PostgreSQL coverage remains intact; no production authentication logic changes.

The 10080-minute minimum release age and all exclusions are unchanged. Every newly introduced package resolution, including optional Next/SWC binaries and Sentry transitive dependencies, was checked against registry publication timestamps and is over seven days old. No matching local Dependabot/Renovate reviewer or assignee configuration exists.

Upstream evidence: Next 16.4.1 security fixes, DOMPurify 3.4.17 sanitization fixes, Sentry 10.75.2 tunnel matching correction, and Vitest 4.1.12 mock hardening. Dedicated toml release notes were unavailable; its patched version/ranges were verified from the current alerts. No exploit reproduction was performed.

How it was tested

• Forced frozen reinstall for all 31 workspace projects; independent production-only frozen installation of the standalone API graph with the existing seven-day gate. Parsed both lockfiles and confirmed every targeted resolution is patched, with no vulnerable duplicate for any targeted package.
• Full API suite: 290 files / 3,429 tests passed. Full web server suite: 248 files / 2,250 tests passed. Full web client suite: 352 files / 3,247 tests passed. Updated real session-renewal integration fixture: 7 tests passed. Fast native tool bridge including widget sanitization: 36 tests passed.
• API bundle build and optimized Next 16.4.1/Sentry production build passed, including production TypeScript checking. Production web process returned HTTP 200 for health, sign-in and robots routes. The production-mode smoke used the sandbox development database/configuration and its local development encryption default, not production credentials or a deployed instance.
• DOMPurify safe-HTML rendering, Snowflake SDK loading and normal TOML configuration parsing passed against both workspace and standalone runtime dependencies. Started an isolated API production bundle using only the packaged external node_modules; liveness returned HTTP 200. Restarted the ordinary local API against the updated graph; liveness returned HTTP 200.
• Authenticated home rendered through genuine dev-login with the updated Next/Sentry dependencies; screenshot below. No UI or network mocks. Final committed diff matches the proof snapshot exactly. Temporary production processes were removed and ordinary development services restored.
• Normal pre-commit formatting and pre-push oxlint, residual ESLint, all 27 fast package typechecks and Knip passed without bypassing hooks; whitespace checks passed.

Coverage boundaries: no external Sentry delivery, live Snowflake account query, Windows-specific mock execution, full container image or multiarchitecture runtime build was exercised. The production build reports dynamic-filesystem tracing warnings and a Sentry v11 import deprecation; existing Dayton/AWS peer mismatch remains. An initial test run hit the command's two-minute outer timeout; the complete API rerun passed. The initial production smoke lacked the local encryption default; explicitly supplying the existing sandbox default made the production-mode smoke pass. No dependency-age exceptions were added.

Checklist

• The PR title follows the repo convention: [Fix], [Feat], [Improve], [Refactor], [Docs], or [Chore] followed by a user-facing description
• This PR is small and scoped to one change
• pnpm lint and pnpm check-types pass locally — normal fast equivalents, production TypeScript checking and pre-push gates passed; formatting-inclusive aliases were not separately run
• I added tests or included a clear manual validation note above
• I removed secrets, tokens, private keys, and customer data from code, logs, and screenshots
• If this change should appear in the changelog, I ran pnpm changeset — dependency security maintenance; no changeset added

Screenshots

Genuine authenticated local home after dev-login with the updated dependencies. Proves development-runtime rendering only; not exploit prevention, production deployment, external telemetry delivery or task inference.

[roomote-community]

No code issues found. See session

Reviewed all eight changed files, dependency consumers, workspace/standalone API lockfile consistency, and the Next session-renewal fixture against the updated work-store factory. Both lockfile graphs have complete dependency snapshot references and contain only the intended updated versions of the targeted packages. Current-head lint, type checking, Knip, CodeQL, and deployment/upgrade checks have passed; tests and the app Docker build are still running. Repository validation suites were left to CI.

_{Reviewed cbddc58}