fix: dependencies security audit

[audrzejq]

Run pnpm audit --audit-level moderate --prod
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ critical │ Auth.js: Configuration errors can cause │
│ │ existence-based auth checks to fail open (auth object │
│ │ populated with an error) │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package │ next-auth │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=5.0.0-beta.0 <=5.0.0-beta.31 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions │ >=5.0.0-beta.32 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths │ examples__chatbot-gateway-with-billing-polar- │
│ │ advanced>next-auth │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info │ GHSA-8fpg-xm3f-6cx3 │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ critical │ Auth.js: Email normalizer validates the address before │
│ │ Unicode normalization, allowing a homoglyph @ bypass │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package │ next-auth │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=5.0.0-beta.1 <=5.0.0-beta.31 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions │ >=5.0.0-beta.32 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths │ examples__chatbot-gateway-with-billing-polar- │
│ │ advanced>next-auth │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info │ GHSA-7rqj-j65f-68wh │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ critical │ Auth.js: Email normalizer validates the address before │
│ │ Unicode normalization, allowing a homoglyph @ bypass │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package │ @auth/core │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=0.1.0 <0.41.3 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions │ >=0.41.3 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths │ examples__chatbot-gateway-with-billing-polar- │
│ │ advanced>next-auth>@auth/core │
├─────────────────────┼────────────────────────────────────────────────────────┤
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate │ Auth.js: OAuth state, nonce, and PKCE check cookies │
│ │ are not bound to the provider that created them │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package │ next-auth │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=5.0.0-beta.1 <=5.0.0-beta.31 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions │ >=5.0.0-beta.32 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths │ examples__chatbot-gateway-with-billing-polar- │
│ │ advanced>next-auth │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info │ GHSA-x445-f3h2-j279 │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate │ Auth.js: OAuth state, nonce, and PKCE check cookies │
│ │ are not bound to the provider that created them │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package │ @auth/core │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <=0.41.2 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions │ >=0.41.3 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths │ examples__chatbot-gateway-with-billing-polar- │
│ │ advanced>next-auth>@auth/core │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info │ GHSA-x445-f3h2-j279 │
└─────────────────────┴────────────────────────────────────────────────────────┘
30 vulnerabilities found
Severity: 2 low | 13 moderate | 12 high | 3 critical
Error: Process completed with exit code 1.

[foreman-ai-billing]

Classification is complete. This is a critical dependency-security fix in the advanced Polar chatbot example. No duplicate was found, and the implementation plan is next.

[foreman-ai-billing]

Planning is complete. The fix will update the vulnerable Auth.js pins, place pnpm overrides in pnpm 10’s supported workspace configuration, regenerate the lockfile, and validate the production audit.

[foreman-ai-billing]

Implementation is complete on a feature branch. The production audit now exits cleanly, frozen installation passes, and affected lint, type, test, and build checks passed. Independent review is next.

[foreman-ai-billing]

Draft pull request: #264

It updates the vulnerable Auth.js pins, moves pnpm overrides into pnpm-workspace.yaml for pnpm 10, and regenerates the lockfile with patched production resolutions. Independent review approved the change. Frozen installation, the production audit, and affected lint, type, test, and build checks passed. The build ran with concurrency 4 because the default sandbox concurrency ran out of memory.

Suggested factory brain note: pnpm 10 reads workspace overrides from pnpm-workspace.yaml, not the root package.json; default-concurrency affected builds may exceed sandbox memory, while --concurrency=4 passes.