fix(deps): remediate dependency security vulnerabilities (165→16, 4 critical→0) (#3406)

* fix(deps): remediate dependency security vulnerabilities (165 -> 16)

Comprehensive dependency-security pass. Reduces `bun audit` from 165
findings (4 critical / 58 high) to 16 (0 critical / 10 high / 3 moderate /
3 low). All changes stay within declared version ranges; bun.lock is a
clean regeneration.

Direct bumps (vulnerable instance was the direct dep):
- better-auth 1.4.22 -> ^1.6.13  (CVE-2026-53512, CVSS 9.1 OAuth
  refresh-token replay; mcp/oidcProvider plugin is enabled in apps/api)
- next -> ^16.2.6 (middleware/proxy bypass, SSRF, DoS)
- axios -> ^1.16.0 (proxy-auth credential leak, prototype pollution)
- vitest -> ^3.2.6, vite -> ^6.4.3, turbo -> ^2.10.5

Dead-dep removal (unused, referenced by no script):
- gitmoji -> cascade-drops request, tough-cookie@2.5.0, tar@2.2.2, node-gyp@3
- semantic-release-discord + -notifier -> drops discord.js/@discordjs/rest
  (which pinned undici@6 and blocked patching it). The real release->Discord
  notification is a separate webhook GitHub Action (no npm deps) - untouched.

Parent bumps (newer parent pulls a patched child):
- @browserbasehq/stagehand -> ^3.7.0 (drops langchain + langsmith)
- @nestjs/swagger -> ^11.4.5 (patched js-yaml 4.3.0)

Overrides for transitive vulns (backcompat-safe, verified):
- axios, form-data, ws, semver, hono, @hono/node-server, multer,
  systeminformation, tmp, dompurify, ip-address, postcss, prismjs, qs,
  effect, protobufjs, linkify-it, mermaid, shell-quote, vite,
  @opentelemetry/core, @sigstore/core, markdown-it, @babel/core
- @tiptap/* pinned 3.22.1 (lockstep; the lockfile regen floated the
  transitive @tiptap/* apart from @tiptap/react@3.22.1)

undici NOT force-overridden across majors (discord.js path removed; the
lockfile regen floats v6->6.27.0 and v7->7.28.0 within ranges instead).

Verified: full `turbo build` (20/20) + typecheck (0 production errors)
across all apps; apps/api Dockerfile.multistage builds clean and boots past
module-load (better-auth 1.6 loads; stops only at the expected SECRET_KEY
env guard). openapi.json intentionally untouched (no API files changed).

Remaining 16 are all dev/build-time or no-upstream-fix: tar
(electron-builder/giget/npm-bundled), minimatch (npm-bundled), esbuild
(dev-server only), uuid (exceljs, no v8 fix), sigstore (release CI), cookie
(disjoint majors), @ai-sdk/provider-utils (low, via stagehand).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(app): make permissions readonly-compatible for better-auth 1.6

better-auth 1.6 types role `statements` as readonly tuples
(ExactRoleStatements = { readonly [P]: readonly [...] }), so casting
`role.statements as Record<string, string[]>` (mutable) is an invalid
conversion and fails `next build`'s TypeScript check on Vercel:

  Type 'readonly ["read"]' cannot be assigned to the mutable type 'string[]'

Widen `mergePermissions`'s `source` param to `Record<string, readonly
string[]>` (it only reads, never mutates) and cast to the readonly type.
Verified against better-auth@1.6.23 dist types; the only `.statements`
cast in the app (other Record<string,string[]> casts are on JSON/any).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: Marfuen

apps/api/package.json

@@ -61,15 +61,15 @@
         "@aws-sdk/lib-storage": "3.1013.0",
         "@aws-sdk/s3-request-presigner": "3.1013.0",
         "@browserbasehq/sdk": "2.6.0",
-        "@browserbasehq/stagehand": "^3.2.1",
+        "@browserbasehq/stagehand": "^3.7.0",
         "@inference/tracing": "^0.0.21",
         "@maced/api-client": "^0.9.2",
         "@mendable/firecrawl-js": "^4.9.3",
         "@nestjs/common": "^11.0.1",
         "@nestjs/config": "^4.0.2",
         "@nestjs/core": "^11.0.1",
         "@nestjs/platform-express": "^11.1.5",
-        "@nestjs/swagger": "^11.2.0",
+        "@nestjs/swagger": "^11.4.5",
         "@nestjs/throttler": "^6.5.0",
         "@prisma/adapter-pg": "7.6.0",
         "@prisma/client": "7.6.0",

apps/app/package.json

@@ -18,7 +18,7 @@
         "@aws-sdk/s3-request-presigner": "3.1013.0",
         "@azure/core-rest-pipeline": "^1.21.0",
         "@browserbasehq/sdk": "2.6.0",
-        "@browserbasehq/stagehand": "^3.0.5",
+        "@browserbasehq/stagehand": "^3.7.0",
         "@date-fns/tz": "^1.2.0",
         "@dnd-kit/core": "^6.3.1",
         "@dnd-kit/modifiers": "^9.0.0",

apps/app/src/lib/permissions.ts

@@ -230,15 +230,18 @@ export function resolveBuiltInPermissions(roleString: string | null | undefined)
     if (BUILT_IN_ROLE_NAMES.includes(roleName)) {
       const role = allRoles[roleName as RoleName];
       if (role) {
-        mergePermissions(combined, role.statements as Record<string, string[]>);
+        mergePermissions(combined, role.statements as Record<string, readonly string[]>);
       }
     }
   }
 
   return { permissions: combined, customRoleNames };
 }
 
-export function mergePermissions(target: UserPermissions, source: Record<string, string[]>): void {
+export function mergePermissions(
+  target: UserPermissions,
+  source: Record<string, readonly string[]>,
+): void {
   for (const [resource, actions] of Object.entries(source)) {
     if (!target[resource]) {
       target[resource] = [];