fix dependency vulns: bump next 16.3.8 (RCE), override brace-expansion, vendor patched braces 3.0.4

agents.md

@@ -34,7 +34,7 @@ When in doubt, prefer updating. A stale README **or** agents.md is treated as a
 ## Bump the version on EVERY prompt — also do this every time
 
 Another standing requirement: increment the **patch** version (`x.x.+1`, so
-`2.2.5` → `2.2.6` → …) as part of every task, even the small ones. Keep all of
+`2.2.6` → `2.2.7` → …) as part of every task, even the small ones. Keep all of
 these in sync:
 
 - `package.json` → `"version"`
@@ -56,7 +56,7 @@ frosted-glass **web** site, and an alternate KDE/Plasma **desktop simulation**
   utilities in the components (Tailwind is present via PostCSS but the look is
   hand-written CSS).
 - Path alias: `@/*` → `src/*`.
-- Version: `2.2.6` (see `package.json`).
+- Version: `2.2.7` (see `package.json`).
 
 ### Scripts
 ```bash
@@ -345,6 +345,22 @@ knows about icon ids, via `APP_BY_ID`.
   `59` is duplicated in `skeuo.css` (`.win-window.maximized` height,
   `.win-window.centered` bottom / max-height) — keep them in sync. Note
   `useDesktopIcons.ts` has its **own** `TASKBAR_HEIGHT = 48` for the icon grid.
+- **Dependency security — keep `npm audit` at 0.** `next` must stay at a patched
+  release (`>=16.3.6`; the `next/og` ImageResponse RCE is `>=16.2.0 <16.3.6`).
+  `brace-expansion` is force-upgraded in `package.json` → `overrides`
+  (`minimatch@^3` → `1.1.21`, `minimatch@^10` → `5.0.12`). `braces` has **no
+  upstream fix** — advisory GHSA-vfj7-8cjw-p6xm (CVE-2026-93687) marks every
+  published version, including the latest `3.0.3`, as affected — so a locally
+  patched copy lives at `vendor/braces`: its `version` is bumped to `3.0.4` (out of
+  the advisory's `<=3.0.3` range) and depth guards were added to the recursive AST
+  walkers in `lib/compile.js` / `lib/expand.js` (mirrors micromatch/braces PR #75).
+  It is wired in with `"braces": "file:vendor/braces"` in `overrides`. Because npm
+  **symlinks** a `file:` directory override instead of installing it, braces' only
+  runtime dep `fill-range` is declared directly in `devDependencies` so the
+  symlinked copy can still resolve it. `eslint.config.mjs` ignores `vendor/**` (the
+  vendored CommonJS uses `require()` and would otherwise fail
+  `@typescript-eslint/no-require-imports`). Don't run `npm audit fix --force` here
+  — its "fix" is a bogus downgrade to `eslint-config-next@14`.
 - **Serving the dev server through the tunnel: read this.** `npm run dev` does
   **not** run `next dev` directly — it runs `node scripts/dev-server.mjs`, a
   custom server that wraps Next's request handler. It keeps the live-update