chore(security): clear all Dependabot alerts and pin Pages actions

[DUBSOpenHub]

Closes the Dependabot backlog. 5 high-severity alerts → 0. Verified with the exact CI path (npm ci && npx next build), which exits 0 and produces index.html + 404.html.

Dependencies

• next 15.3.3 → 16.2.12, which carries patched postcss and sharp
• overrides pinning postcss >=8.5.24 and sharp >=0.35.3 — next 15.5.22 (latest 15.x) still bundles postcss@8.4.31 and sharp@0.34.5, so staying on 15 could not clear the alerts

npm audit fix --force proposed next@9.3.3 — npm falling back to the last release without an advisory rather than the first release with the fix. Taking it would have downgraded four majors to resolve a CVE. Rejected.

Removed eslint + eslint-config-next — please sanity-check this call

All 9 remaining advisories traced to one root: brace-expansion, reachable only through eslint's minimatch@3.

• There is no patched 1.x — 1.1.16 is the newest and still inside the advisory range
• The only fix is eslint@10, whose peer ranges eslint-config-next@16's plugins do not satisfy
• Tried both eslint@10 and eslint@9 + a brace-expansion override; each crashed the linter outright

That cost is only worth paying for a working linter, and this one never worked: no eslint config file has ever existed in this repo (verified against main), so npm run lint has always exited 2 on a missing config. CI runs next build only and never invoked it. Removing a dependency that has never executed once is cleanup, not a capability loss.

Follow-up: reinstating lint is clean once eslint-config-next supports eslint@10. Note for whoever picks it up — with a config in place, page.tsx reports 8 react-hooks/refs errors that on inspection are false positives from react-hooks v7 flagging valid ref={obj.ref} usage.

Actions

pages.yml was on mutable @v3/@v4 tags while validate.yml was SHA-pinned per the convention set in #11. Now consistent.

Action	Was	Now
actions/checkout	@v4	v7.0.1 (SHA-pinned)
actions/setup-node	@v4	v7.0.0 (SHA-pinned)
actions/upload-pages-artifact	@v3	v5.0.0 (SHA-pinned)
actions/deploy-pages	@v4	v5.0.0 (SHA-pinned)

Every SHA was verified against the tag it claims via the GitHub API — a pin that doesn't match its comment is worse than no pin. validate.yml moved to the same checkout/setup-node versions so both workflows stay in lockstep.

Pages runner node 20 → 22: node 20 reached EOL in April 2026, and next 16 requires >=20.9.0.

tsconfig.json changes are next 16's automatic migration (jsx: react-jsx, dev types path), applied by the build itself.

Supersedes #21, #22, #24, #25, #26.