[agammann]

Changes

• Separately patch vulnerable Next.js, Better Auth, Zod and Vitest dependencies and pin the patched Vite peer. Preserve application behavior and authentication/session/permission checks.
• Keep the existing browser-first synthetic owner bootstrap before real PostgreSQL integration, independent npm-installed SDK ESM/CJS/type consumer, operations/backup, native WebMCP and recovery checks.
• Save exact source/runtime/PostgreSQL image evidence; retain integration artifacts on failure; remove this job's disposable Compose volumes at cleanup. No workflow permissions were widened.

Verified locally

Node24.19.0 / pnpm11.19.0: frozen install, Prisma generation,16 unit tests, SDK/shared/dashboard/reference builds, recursive typecheck, SDK archive packaging audit passed. Full and production audit zero advisories (baseline full audit:16 advisory entries across6 distinct packages, including3 critical entries).

Required before merge

Verify Tally / verify must pass on db79be8. Docker/PostgreSQL/browser/native/recovery execution is pending disposable GitHub CI; local unit/build checks do not establish those outcomes. Existing main-push SDK release publishing remains unchanged.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-28T22:24:14.868716Z	db79be8	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.