[simon--poole]

Fixes the still-open Dependabot alerts on docs/package-lock.json. The root package-lock.json alerts for the same advisories were already fixed in #39.

Alert	Advisory	Package	Manifest
#205	GHSA-p293-qw3h-jr36 / CVE-2026-75604 (critical)	next	docs/package-lock.json
#203	GHSA-2xp9-vwfh-vxw4 (critical)	next	docs/package-lock.json
#202	GHSA-rgj7-g3m4-5g8c (high)	sharp	docs/package-lock.json

Changes

docs/: npm update, then raised the next floor to ^16.3.3

• next 16.3.1 → 16.3.6
• sharp 0.35.3 → 0.35.4 (transitive via next)
• react / react-dom 19.2.x → 19.3.0 (in range, from npm update)

root: raised floors only; resolved versions are unchanged (next 16.3.5, sharp 0.35.4)

• dependencies.sharp ^0.35.3 → ^0.35.4: this is a runtime dependency of the published package, so the old range still let consumers resolve the vulnerable sharp
• devDependencies.next ^16.3.1 → ^16.3.3

Before / after npm audit

Path	Before	After
/	0 vulnerabilities	0 vulnerabilities
docs/	2 (1 critical: next, 1 high: sharp)	0 vulnerabilities

Verification

• npm test (oxlint, tsc types, ava): 49 tests passed
• npm run format:check: passes
• npm run test:integration (Turbopack + Webpack fixture builds): passes
• docs: npm run build (Turbopack) and npm run build:webpack: both pass on Next 16.3.6

Release / deployment

• npm package: the only published change is the sharp range. It's worth a patch release (e.g. 0.6.3, changelog entry: "Require sharp ^0.35.4 (GHSA-rgj7-g3m4-5g8c)") via npm run release. Not done here, because it needs approval.
• Docs site: GitHub Pages serves a static export, so the vulnerable Next server code never ran there. Redeploying with npm run release:docs is optional.
• Dependabot should close #205, #203 and #202 automatically once this merges. Vanta closure is tracked separately.

🤖 Generated with Claude Code