chore(deps): clear high-severity CVEs from production audit

[saquibreja7-hash]

Why

The Dependency audit CI check went red on recently-disclosed CVEs in pre-existing dependencies (unrelated to any feature work). This brings npm run security:audit (npm audit --audit-level=high --omit=dev) back to zero high-severity findings so PRs can merge again.

Changes

• next 16.2.6 → 16.2.12 — patches middleware/proxy bypass, Server Action DoS + SSRF, cache confusion, and internal endpoint disclosure advisories. eslint-config-next bumped to match.
• override postcss ^8.5.25 (path traversal) and sharp ^0.35.3 (libvips CVEs) — both bundled under next; overrides force the patched builds.
• prisma / @prisma/client / @prisma/adapter-pg 7.8.0 → 7.9.1 — the newer @prisma/dev drops hono/@hono/node-server and vendors a patched valibot, clearing the remaining (dev-only) tooling advisories.

Verification

• npm run security:audit: found 0 vulnerabilities
• type-check clean, production build succeeds, all 293 tests pass, prisma schema valid.

Merge this first; then PR #11 (AI image checker) can go green on the same audit.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
meri-asmita	Ready	Preview	Aug 2, 2026 1:15pm

[claude]

WARNING: New sharp override (^0.35.3) pinned here. Confirmed this is only pulled in transitively as Next.js's optional dependency for its built-in image-optimization pipeline (next/image), and is not imported anywhere in src/. Per the "No media, ever" principle, worth double-checking that no route uses next/image (or any future image-optimization API) against survivor-submitted URLs/content — sharp must never touch NCII media server-side. No action needed for this PR itself, just flagging for future vigilance.

[claude]

Review summary

This PR (asmita/package.json + asmita/package-lock.json only, no application source touched) bumps next (16.2.6→16.2.12), @prisma/client/@prisma/adapter-pg/prisma (7.8.0→7.9.1), the postcss override (8.5.15→8.5.25), and adds a new sharp override (^0.35.3), per the commit message clearing high-severity CVEs from the production audit.

Verification performed:

• Confirmed only package.json/package-lock.json changed — zero lines of application code, no changes to URL handling, notice dispatch, hash submission, auth, or Prisma query code.
• Scanned the full lockfile diff: every resolved URL points to the official registry.npmjs.org, no unexpected new top-level packages, no new postinstall/preinstall scripts introduced (napi-postinstall etc. are just version bumps in place).
• sharp is not a new capability — it was already present pre-PR as Next.js's own optional dependency for its built-in image-optimization pipeline. Grepped src/ and confirmed sharp is never imported/used directly by app code, so this doesn't create a new path for the server to process survivor-submitted media. Left an inline WARNING as a forward-looking reminder that next/image (or any future image API) must never be pointed at NCII content, per the "No media, ever" principle — no change needed for this PR.
• Since these are patch/minor bumps with no adapting code changes, would recommend confirming CI (build/type-check/test/e2e) is green before merge — I wasn't able to run npm ci/npm run build in this sandbox to independently verify.

No CRITICAL findings. No safety-invariant, security, business-logic, or data-integrity issues identified — the diff has no code paths to introduce them.