fix(security): npm security fixes (2026-08-03)

[github-actions]

Batch npm dependency security updates for Dependabot alerts (minimum severity: moderate).

Included fixes:

• CVE-2026-14257 (high): brace-expansion DoS via unbounded expansion — brace-expansion 1.1.16/2.1.2 → 1.1.18/2.1.4 (floor: 1.1.17/2.1.3)
• ALERT-1105 (high): React Router RSC mode CSRF bypass — react-router 7.18.1 → 8.3.0
• ALERT-1104 (high): PostCSS path traversal in source map auto-loading — postcss 8.5.10 → 8.5.25 (floor: 8.5.18)
• CVE-2026-45623 (high): PostCSS arbitrary file read via sourceMappingURL — postcss 8.5.10 → 8.5.25 (floor: 8.5.12)
• CVE-2026-64641 (high): Next.js App Router Server Actions DoS — next 16.2.6 → 16.2.12 (floor: 16.2.11)
• CVE-2026-64642 (high): Next.js middleware/proxy bypass with Turbopack single locale — next 16.2.6 → 16.2.12 (floor: 16.2.11)
• CVE-2026-64643 (medium): Next.js internal Server Function endpoint disclosure — next 16.2.6 → 16.2.12 (floor: 16.2.11)
• CVE-2026-64644 (medium): Next.js image optimization SVG DoS — next 16.2.6 → 16.2.12 (floor: 16.2.11)
• CVE-2026-64645 (high): Next.js rewrite destination hostname SSRF — next 16.2.6 → 16.2.12 (floor: 16.2.11)
• CVE-2026-64646 (medium): Next.js unbounded Server Action payload (Edge runtime) — next 16.2.6 → 16.2.12 (floor: 16.2.11)
• CVE-2026-64647 (medium): Next.js cache confusion with invalid UTF-8 request bodies — next 16.2.6 → 16.2.12 (floor: 16.2.11)
• CVE-2026-64648 (medium): Next.js cache confusion with request bodies — next 16.2.6 → 16.2.12 (floor: 16.2.11)
• CVE-2026-64649 (high): Next.js Server Actions SSRF on custom servers — next 16.2.6 → 16.2.12 (floor: 16.2.11)

Skipped (already satisfied / would downgrade):

• None

Risks:

• react-router was forced from v7 to v8 (transitive). This is a major-version bump and may have runtime compatibility impact for packages expecting v7.

Verification:

• pnpm install --no-frozen-lockfile

[jitsu-code-review]

Reviewed the dependency/security update across package.json, webapps/console/package.json, and pnpm-lock.yaml. I found one compatibility risk worth addressing (left inline) around the react-router override forcing a major version jump.

[jitsu-code-review]

This looks like a potential regression: the override now forces react-router to ^8.3.0, but react-router-dom@7.17.0 (used in the lockfile for libs/jitsu-react) declares a hard dependency on react-router@7.17.0. The resolved lockfile now pairs react-router-dom@7.17.0 with react-router@8.3.0, and react-router@8.3.0 also requires React >=19.2.7 while this repo is on React 18.3.1. Could we pin to a non-breaking 7.x security patch range instead?

[jitsu-code-review]

Reviewed the dependency override updates in package.json, webapps/console/package.json, and the lockfile refresh. I found one compatibility risk worth addressing (left inline) around the react-router override; the rest of the version bumps look consistent with the security update intent.

[jitsu-code-review]

This looks like a potential runtime regression: this override now forces react-router to ^8.3.0, but the lockfile still resolves react-router-dom@7.17.0, and that package gets paired with react-router@8.3.0. react-router@8.3.0 declares peers react >=19.2.7, while this repo is on React 18.3.1. Could we keep the fix on a safe 7.x line instead so react-router-dom@7.x stays compatible?