fix: remediate production dependency audit findings

[foreman-ai-billing]

Problem

The production dependency audit failed with critical Auth.js findings in the advanced Polar chatbot example, plus other moderate-or-higher findings in the shared dependency graph. Root pnpm.overrides was also ignored by pnpm 10.

Approach

• Updated all six next-auth beta.31 example pins to 5.0.0-beta.32, resolving @auth/core 0.41.3.
• Moved overrides to pnpm-workspace.yaml, where pnpm 10 reads them, and removed the ignored root configuration.
• Updated the shared Next catalog to 16.2.11 and regenerated the lockfile with patched production dependency resolutions.

The linkify-it and nanoid overrides stay within their existing major versions. An unbounded update broke a chatbot build because linkify-it 6 removed the default export expected by markdown-it.

Acceptance criteria

• Frozen pnpm installation succeeds with the committed lockfile.
• All direct vulnerable next-auth pins use beta.32 and resolve patched @auth/core.
• Next and the audited transitive dependencies resolve to their patched versions.
• Override policy is in pnpm 10-supported workspace configuration.
• pnpm audit --audit-level moderate --prod exits 0 with no known vulnerabilities.
• Affected lint, type, test, and build checks pass.
• No application source/API changes or changeset were added.

Verification

Command	Result
pnpm install --frozen-lockfile	Passed
pnpm audit --audit-level moderate --prod	Passed, no known vulnerabilities
pnpm turbo run lint --affected --concurrency=4	Passed, 53/53
pnpm turbo run check-types --affected --concurrency=4	Passed, 53/53
pnpm turbo run test --affected --concurrency=4	Passed, 42/42
pnpm turbo run build --affected --concurrency=4	Passed, 32/32

The default-concurrency affected build exceeded the available sandbox memory. It passed with concurrency set to 4.

Deviations

The initial plan used unbounded minimum versions for linkify-it and nanoid. Their overrides were capped to patched versions within the existing majors to keep markdown-it compatible. No application code changed.

Closes #263

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
ai-billing-storybook	Ready	Preview	Aug 31, 2026 8:37pm

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!