[juicycleff]

This clears all 102 open Dependabot alerts on main. Every one of them is in the docs site, and none touch either Go module, so nothing here changes what you get when you import shield.

Three lines move in docs/package.json:

• next 16.1.6 to 16.4.5. That covers 76 of the 102 alerts (the same 38 advisories, raised once against package.json and once against the lockfile), including the four criticals. The newest fix any of them needs is 16.4.1, and 16.4.5 is the latest patch on that line.
• fumadocs-mdx 14.2.7 to 14.2.14. This is the only way to a fixed esbuild. 14.2.7 asks for esbuild ^0.27.3 and the fix only exists in 0.28.1, so no amount of lockfile refreshing gets there. 14.2.12 is the first release that moved to ^0.28.0.
• postcss (dev) ^8.5.6 to ^8.5.23, so the range itself can't resolve back to a vulnerable version.

The rest are transitive and already allowed by the ranges their parents declare, so pnpm update moved only those packages in the lockfile. The lockfile wasn't regenerated. The other packages that changed in it are the platform builds for next, sharp and esbuild, plus a handful of small deps the new next and fumadocs-mdx releases ask for (@swc/helpers, semver, tinyexec, tinyglobby, @emnapi/runtime, @img/colour).

Triage

Alerts	Package	Manifest	Severity	Reaches shipped Go code?	What changed
1-19, 71, 73, 75, 77, 79, 81, 83, 85, 91, 104, 106, 115-119, 128-130	next	docs/package.json	4 critical, 14 high, 16 moderate, 4 low	No, docs site only	16.1.6 to 16.4.5
20-24, 29, 31-43, 72, 74, 76, 78, 80, 82, 84, 86, 92, 105, 107, 123-127, 131-133	next	docs/pnpm-lock.yaml	same 38 as above	No, docs site only	16.1.6 to 16.4.5
30, 89, 90, 93	postcss	docs/pnpm-lock.yaml	2 high, 2 moderate	No, docs build	8.4.31 to 8.5.23 (next's exact pin), 8.5.6 to 8.5.32 (ours)
70, 108, 122	sharp	docs/pnpm-lock.yaml	3 high	No, docs build (next image/OG)	0.34.5 to 0.35.5, via next
55, 87, 96, 109	js-yaml	docs/pnpm-lock.yaml	3 high, 1 moderate	No, docs build (fumadocs-mdx frontmatter)	4.1.1 to 4.3.2
98, 99, 102	nanoid	docs/pnpm-lock.yaml	3 high	No, docs build (postcss)	3.3.11 to 3.3.20
113, 114	image-size	docs/pnpm-lock.yaml	2 high	No, docs build (fumadocs-core)	2.0.2 to 2.0.4
27, 28	path-to-regexp	docs/pnpm-lock.yaml	1 high, 1 moderate	No, docs site (fumadocs-core)	8.3.0 to 8.4.2
25, 26	picomatch	docs/pnpm-lock.yaml	1 high, 1 moderate	No, docs build (tinyglobby)	4.0.3 to 4.0.7
121	source-map-js	docs/pnpm-lock.yaml	high	No, docs build (postcss, tailwind)	1.2.1 to 1.2.2
134	zod	docs/pnpm-lock.yaml	high	No, docs build (fumadocs-core peer)	4.3.6 to 4.6.7
100, 135	postcss-selector-parser	docs/pnpm-lock.yaml	1 moderate, 1 low	No, docs build (@fumadocs/tailwind)	7.1.1 to 7.1.7
103	baseline-browser-mapping	docs/pnpm-lock.yaml	moderate	No, docs build (next)	2.9.19 to 2.11.35
51	esbuild	docs/pnpm-lock.yaml	low	No, docs build. The bug is in esbuild's dev server on Windows, and fumadocs-mdx only uses the build API	0.27.3 to 0.28.2, via fumadocs-mdx 14.2.14

After the change pnpm audit reports no known vulnerabilities in docs/.

The Go side

Dependabot has nothing open against go.mod or integrations/nexusguard/go.mod, but we ran govulncheck ./... in both modules anyway. Two things came out of it, and neither is a reason to touch go.mod here.

golang.org/x/crypto v0.58.0 carries GO-2026-5932, the openpgp package being unmaintained. Shield doesn't import openpgp, so govulncheck lists it at module level only and finds no call path. The only fix is a pseudo-version, which isn't worth pinning for a package we never load.

Everything else is the standard library. The local toolchain was go1.26.3, and govulncheck traces real calls into net/http, crypto/tls, crypto/x509, encoding/asn1, encoding/xml and net/url (18 advisories in the root module, 6 in nexusguard), all fixed by go1.26.10. Shield is a library, so the standard library you get is whichever toolchain builds the final binary. go 1.26.0 in our go.mod doesn't pin it. In practice that means Loomplane (and anything else that embeds shield) should build with go1.26.10 or later. CI's setup-go reads go-version-file: go.mod, so the Go jobs here test against whatever that resolves to. A toolchain line would only move CI, since Go ignores it in a dependency's go.mod, and that's a separate call from these alerts.

Checks

• docs/: pnpm install, pnpm build, pnpm types:check and pnpm lint all pass. Biome prints the same "run biome migrate" info it printed before.
• Root module: go test -race -count=1 ./... and golangci-lint run ./....
• integrations/nexusguard: the same two, through a temporary go.work (go work init . ./integrations/nexusguard) that was deleted afterwards.

No Go code or go.mod changed, so there's nothing to release from this.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!