[sashimikun]

Summary

• Bumps the packages cve.now matched in the locks the image actually installs: package-lock.json (npm ci) and api/poetry.lock (Poetry). yarn.lock is updated to the same npm pins.
• Next moves to 15.5.28 and Mermaid to 11.17.2. Transitive npm floors: sharp 0.35.5, postcss 8.5.31, DOMPurify 3.4.17, KaTeX 0.18.2, nanoid 3.3.20, brace-expansion 1.1.21 and 5.0.12, source-map-js 1.2.2, and @humanfs/node 0.16.8.
• API floors: aiohttp >=3.14.5, GitPython >=3.2.1, urllib3 >=2.8.0, PyJWT >=2.15.1, multidict >=6.9.1,<7. The resolved lock is aiohttp 3.14.5, GitPython 3.2.1, urllib3 2.8.0, PyJWT 2.15.1, multidict 6.9.1.

Still unmatched because there is no fixed release

• braces 3.0.3 (CVE-2026-93687), dev-only through eslint-config-next → fast-glob → micromatch.
• diskcache 5.6.3 (CVE-2025-69872), pulled in by AdalFlow. 5.6.3 is still the newest release.

Checks

• npm ci --legacy-peer-deps completes. Loaded copies: Next 15.5.28, PostCSS 8.5.31, sharp 0.35.5, nanoid 3.3.20, and KaTeX renderToString.
• Re-uploaded both locks to cve.now. Each report has one remaining hit, the two packages above.
• Did not run the Next production build or the Python tests.

KaTeX 0.18.2 is outside the ^0.16 range requested by mermaid and rehype-katex. That pin is the published fix for CVE-2026-103923. PostCSS 8.5.31 replaces the 8.4.31 copy Next requested.

[greptile-apps]

Your organization has run out of review credits. Add credits to resume code reviews.