fix dependency vulns: bump next 16.3.8 (RCE), override brace-expansion, vendor patched braces 3.0.4

README.md

@@ -72,7 +72,12 @@ more.
 - **Fonts:** the web theme uses the system sans stack; Monocraft (self-hosted in `public/`) is
   used by the desktop theme's SMP menu and the in-desktop terminal.
 - **Images:** `next/image`
-- **Version:** `2.2.6` (see `package.json`)
+- **Version:** `2.2.7` (see `package.json`)
+- **Dependencies:** `npm audit` reports **0 vulnerabilities**. `next` is kept at a patched
+  release (`>=16.3.6`) for the `next/og` RCE, and `brace-expansion` is force-upgraded via
+  `overrides`. `braces` (a transitive ESLint/`fast-glob` dependency) has **no upstream fix**,
+  so a locally patched copy is vendored at `vendor/braces` (version bumped to `3.0.4` with
+  depth guards added) and wired in with an `overrides` entry.
 
 ## 🚀 Running Locally
 
@@ -203,6 +208,8 @@ deploy/
     dvorakmortonxd-dev.system.service → systemd unit (system-wide) so the dev server starts at boot
     dvorakmortonxd-dev.service        → equivalent per-user unit (no root; needs linger)
     install-system-service.sh         → installs the system unit (run with sudo/doas)
+vendor/
+    braces/                  → locally patched braces@3.0.4 (depth guards for CVE-2026-93687; no upstream fix)
 public/                     → fonts, wallpapers, icons, /revival-inc game, llms.txt, robots.txt, sitemap.xml
 ```