Remediate project audit findings

docs/deployment/self-hosting.md

@@ -14,6 +14,8 @@ byteflow.tools is a static Next.js export for privacy-first browser-local develo
 - Container wrapper: use a minimal static server only for files; do not add an API that processes tool payloads.
 - Local automation prototype: `scripts/prototypes/byteflow-local-cli.mjs` can be evaluated on a workstation or CI runner for stdin/stdout transformations. Keep it local to the runner; do not expose it as a hosted payload-processing endpoint.
 
+The export uses extensionless public routes backed by `.html` files. Configure the host's clean-URL or HTML fallback support so `/en/json-formatter` resolves to `/en/json-formatter.html`. `npm start` provides a production-like local static server with that behavior after `npm run build`; a file server that only performs literal path lookup is not compatible.
+
 ## Privacy-Safe Analytics
 
 Analytics should be disabled unless the deployment owner has reviewed the allowlisted taxonomy. If enabled, only aggregate event names and safe identifiers such as tool ID, category, language, size bucket, or result count are allowed. Raw search text, tool input, output, file names, file contents, tokens, logs, full URLs, request bodies, and response bodies are forbidden.

docs/security/next-postcss-advisory-runbook.md

@@ -1,19 +1,22 @@
 # Next Bundled PostCSS Advisory Runbook
 
-This runbook records the remediation for issue #7: GHSA-qx2v-qp2m-jg93 through
-Next.js bundled `postcss`.
+This runbook records the remediation for issue #7 and the later PostCSS source-map
+advisories GHSA-6g55-p6wh-862q and GHSA-r28c-9q8g-f849 through Next.js bundled
+`postcss`.
 
 ## Stable Remediation
 
-Checked on 2026-07-16:
+Checked on 2026-07-26:
 
-- `npm view next version`: `16.2.10`
-- `npm view @next/bundle-analyzer version`: `16.2.10`
+- `npm view next version`: `16.2.12`
+- `npm view @next/bundle-analyzer version`: `16.2.12`
 - Stable Next still declares vulnerable `postcss@8.4.31`.
 - The project keeps Next, `@next/bundle-analyzer`, and `eslint-config-next` aligned at
-  stable `16.2.10`.
+  stable `16.2.12`.
 - A controlled npm override replaces only Next's internal PostCSS copy with
-  `postcss@8.5.10`, the first patched version already used by Next 16.3 canaries.
+  `postcss@8.5.23`, which is newer than the fixed `8.5.18` floor for the current advisories.
+- A second controlled override raises Next's optional Sharp dependency to `0.35.3`,
+  above the `0.35.0` floor for the inherited libvips advisories.
 
 This avoids the unsafe framework downgrade proposed by `npm audit fix --force`, does
 not suppress the advisory, and keeps the application on a stable Next release.
@@ -22,20 +25,24 @@ After `npm ci`, verify the effective dependency and production audit:
 
 ```bash
 node -p "require('./node_modules/next/package.json').version"
-node -p "require('./node_modules/next/node_modules/postcss/package.json').version"
+node -p "require('./node_modules/postcss/package.json').version"
+node -p "require('./node_modules/sharp/package.json').version"
 npm audit --omit=dev --json
 ```
 
 Expected results:
 
-- Next reports `16.2.10`.
-- Next's effective PostCSS reports `8.5.10`, satisfying `postcss >= 8.5.10`.
+- Next reports `16.2.12`.
+- Next's effective PostCSS reports `8.5.23`, satisfying `postcss >= 8.5.18`.
+- Sharp reports `0.35.3`.
 - The production audit reports 0 moderate/high/critical vulnerabilities and no
   `next -> postcss` advisory path.
 
 ## Upstream Evidence
 
 - Advisory: https://github.com/advisories/GHSA-qx2v-qp2m-jg93
+- Advisory: https://github.com/advisories/GHSA-6g55-p6wh-862q
+- Advisory: https://github.com/advisories/GHSA-r28c-9q8g-f849
 - Next PostCSS 8.5.10 bump: https://github.com/vercel/next.js/pull/93288
 - Next applicability discussion: https://github.com/vercel/next.js/issues/93234
 
@@ -63,7 +70,7 @@ npm run test:e2e:pwa
 - Do not merge Next canary into `main` without an explicit project decision.
 - Do not suppress the advisory without upstream evidence.
 - Do not loosen production audit gates.
-- Do not remove the override until stable Next resolves PostCSS to `8.5.10` or newer
+- Do not remove the override until stable Next resolves PostCSS to `8.5.18` or newer
   without it.
 
 ## Closure Comment Template