fix(deps): patch release-blocking frontend advisories

docs/audits/2026-09-07/validation/b06-completion.md

@@ -330,3 +330,31 @@ Pushing this evidence provides one further complete CI attempt with unchanged ap
 [Run 740](https://git.cesnimda.uk/cesnimda/jobtrackingapp/actions/runs/740/jobs/1615) recovered from the compiler issue, confirmed the Linux fixture **build** fix, and executed all 916 backend cases: **903 passed, 13 failed**. These were actionable portability failures rather than another compiler crash: two TLS-rejection cases recorded an empty HTTP read instead of null, and eleven PDF process cases could not start the .NET fixture (exit 131 or ensuing start-marker timeout). The workflow installed .NET in `/root/.dotnet`, but exported `DOTNET_ROOT` only inside the setup step; PATH alone does not supply the runtime location to a native apphost ([Microsoft runtime-location documentation](https://learn.microsoft.com/en-us/dotnet/core/tools/dotnet-environment-variables#dotnet_root-dotnet_rootx86-dotnet_root_x86-dotnet_root_x64)).
 
 The correction persists the already-validated runtime path through `GITHUB_ENV`. The TLS assertion accepts null **or an empty string**, while still requiring `HttpRequestException` with `AuthenticationException`, original-host SNI, no custom validation callback and zero HTTP request content. It does not accept whitespace or any HTTP bytes, trust a bad certificate or alter the transport. Fresh explicit-SDK Release verification with `DOTNET_ROOT` set: **98/98** `PdfRenderAdmissionTests|JobImportHttpTransportTests` pass; `.artifacts/redesign-audit/portability.trx`. No application code or test filters changed. The earlier stop rule applies to repeated compiler crashes, not evidence-backed correction of these now-observed test/setup defects.
+
+### Release dependency gate — 2026-09-10 local / 2026-09-09 UTC
+
+[Run 741](https://git.cesnimda.uk/cesnimda/jobtrackingapp/actions/runs/741/jobs/1617), `2024c37`, confirmed **916/916 Linux backend tests passed, zero skipped**. Compose/safety/parser/build checks also passed. Deployment was then skipped because `npm audit --audit-level=high` found three vulnerable package entries: Next critical, sharp high and js-yaml high. A fresh local audit reproduced the same report. These advisories were updated in the public database on September 8; earlier audit results are historical, not proof of the current dependency gate.
+
+The targeted patch raises the Next and matching lint-config floor to 16.3.3 (lock resolves 16.3.4), updates the existing sharp override from 0.35.3 to 0.35.4, and updates the transitive js-yaml 3.x lock to 3.15.2. Its 4.x copy already uses patched 4.3.2. Lockfile review shows only these dependency families and their required platform/compiler artifacts changed. React, MUI, routing, API and schema contracts were not changed.
+
+Primary advisory evidence: [Next Windows-hosted server issue](https://github.com/advisories/GHSA-p293-qw3h-jr36), [Next AVIF optimization issue](https://github.com/advisories/GHSA-2xp9-vwfh-vxw4), [sharp/libheif](https://github.com/advisories/GHSA-rgj7-g3m4-5g8c), [js-yaml merge budget](https://github.com/advisories/GHSA-2883-xcg3-v3hh). The intended production frontend is a static nginx export, not a Windows Next server or a running Next image optimizer; the advisories alone do not establish production exploitation. Build/development dependencies still fall within the existing release policy, so the gate is retained and patched instead of suppressed.
+
+Initial commands: `npm install --package-lock-only --ignore-scripts --no-audit --no-fund`, then `npm update js-yaml --package-lock-only --ignore-scripts --no-audit --no-fund`; `npm audit --package-lock-only --audit-level=high` reports **zero vulnerabilities**. Actual installation, frontend regression/build and new CI results follow separately; a lockfile-only audit is not runtime verification.
+
+Fresh installation with `npm ci --no-audit --no-fund` succeeded (820 packages); installed-tree `npm audit --audit-level=high` also reports **zero vulnerabilities**. Next's updated lint preset introduced `no-location-assign-relative-destination`, which assumes Next Router. This static SPA uses React Router and deliberately performs full navigation after account deletion to clear private state. That one inapplicable navigation rule is disabled with a configuration comment; both existing full-navigation calls and B02 cleanup remain unchanged.
+
+The patched Next build compiled application code but then exposed the historical `interview-prep.test.tsx:120` TS2571 as a build blocker. The smallest test-only correction uses `objectContaining({ content: expect.not.stringMatching(...) })` on the unknown Axios request argument. The existing positive assertion still requires the exact endpoint/category/title and a string containing the debrief prompt; the negative assertion still rejects invented company/achievement/metric content. No cast, type exclusion, strictness relaxation or production behavior change was introduced. R01a's explicit standalone CI command remains outstanding; its original reproduction is retained.
+
+Fresh local release verification after these changes:
+
+| Command (UI directory unless noted) | Result |
+|---|---|
+| `npm test -- --watchAll=false --runInBand` | **67 suites / 298 tests passed**, 102.468s, after the dependency update |
+| `npm test -- --watchAll=false --runInBand src/interview-prep.test.tsx` | **13/13 passed** after the assertion correction |
+| `node node_modules/typescript/bin/tsc --noEmit --incremental false` | **Exit 0** after correction; original error reproduced before it |
+| `npm run build` with `NEXT_PUBLIC_API_BASE_URL=http://localhost:5302/api` and telemetry disabled | **Exit 0**, Next 16.3.4 static export, including TypeScript |
+| `npm run test:e2e` with `PLAYWRIGHT_STATIC_EXPORT=true`, `PLAYWRIGHT_PREBUILT_EXPORT=true`, explicit installed `DOTNET_HOST_PATH`/`DOTNET_ROOT` | **18/18 passed**, 1.4m; Release API build zero warnings/errors. Includes B02 account isolation, B05 exact CSV bytes, anonymous public CV and long searchable PDF |
+| `npm run lint` | **Exit 0**, zero warnings after the rule compatibility adjustment; one redundant concurrent run raced Playwright's temporary `test-results` cleanup (ENOENT), so final lint is run serially |
+| Root: `python scripts/supply-chain.py scan-secrets`; `git diff --check` | **Pass**; line-ending notices only |
+
+Logs are under `.artifacts/redesign-audit/`. The latest full Linux backend run remains **916/916 at `2024c37`**; no backend source changed in this dependency correction. Deployment still requires the next full CI run and production preflight. This is authorized release repair, not Phase 2 redesign or B07; **F04 remains open**.

docs/audits/2026-09-07/validation/implementation-queue.md

@@ -32,7 +32,7 @@ The numbered order is the default integration order. Independent work may start
 
 | Order / ticket | Size and ownership | Concrete scope and acceptance | Dependencies / rollback risk |
 |---|---|---|---|
-| **R01a Standalone type gate** | S. `interview-prep.test.tsx`, UI package script, CI workflow. | Narrowly type/narrow the mocked request payload, add explicit standalone type checking to CI. Prove 13 interview tests, standalone tsc, and the changed workflow command. Keep strictness and test coverage. | Can run in parallel with Batch 0. No production-code behavior or schema. Do not weaken the gate to preserve a green build. |
+| **R01a Standalone type gate — partially resolved during authorized release repair, 2026-09-10** | S. `interview-prep.test.tsx`, UI package script, CI workflow. | The patched Next build exposed the historical TS2571. A test-only object matcher now preserves the positive/negative content assertions without dereferencing an unknown Axios payload; 13 interview tests, standalone tsc and Next build pass. An explicit standalone CI command remains outstanding; keep strictness and test coverage. See [release evidence](b06-completion.md#release-dependency-gate--2026-09-10-local--2026-09-09-utc). | Can run in parallel with Batch 0. No production-code behavior or schema. Do not weaken the gate to preserve a green build. |
 | **R01b Production DB configuration validation** | S. Provider-selection code in `Program.cs` and startup tests. | Fail startup for an unknown production provider or missing required configured connection. Preserve deliberate dev SQLite defaults and valid explicit SQLite/MariaDB. Assert no fallback database is created on rejected startup. | Integrate after Batch 0 `Program.cs` mutations. No schema; rejecting an existing invalid environment can prevent boot, so validate deployed inputs first. |
 | **R02 Consistent recovery-set creation** | M. `deploy.sh`, existing backup runner/scripts, isolated fixture and operator documentation. | Replace live SQLite tar as the DB consistency mechanism; coordinate file inventory/checkpoint or a short write pause, manifest/checksums and incomplete-set marking. Preserve keys/tombstone recovery. For MariaDB, coordinate the file set with the consistent SQL dump. | No new app schema. Can develop synthetic fixture in parallel with Batch 0. A backup that is only present is not yet verified. Keep previous verified sets. |
 | **R03 Restore drill and schema-compatible rollback** | M. Deploy rollback logic, isolated restore harness and runbook; no production restore in the implementation session. | Restore latest/previous synthetic sets under active-source writes; integrity, FK owner boundaries, attachment hashes, provider-token decryptability and deletion replay must hold. Run previous/new binaries against the intended schema; allow automatic image rollback only when compatible. Record measured RPO/RTO, required key custody and operator steps. | Depends on R02 and Connor's recovery objectives. **Blocks every schema-changing ticket below.** Failed restore is a stop, not permission to reset the source DB. Do not run downgrade migrations automatically. |