GitLab (guncad-index) is the maintained upstream and what production
runs. This records ncd/main's history (fc4edc4, Next 16.4.0) as merged
but keeps upstream's tree exactly, so ncd/main fast-forwards with no
force push.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015TH5RRwUukmnBav9aoro9S
next 16.1.6 -> 16.4.0, eslint-config-next 16.1.6 -> 16.4.0 (pinned exact).
React stays at 19.2.3 (next 16.4.0 peer range is ^19.0.0). Version 0.1.0 -> 0.1.1.
Advisories cleared: all 35 npm audit listed against next 16.1.6
(2 critical, 13 high, 16 moderate, 4 low). Critical:
- GHSA-p293-qw3h-jr36 unauthenticated RCE on Windows-hosted servers
- GHSA-2xp9-vwfh-vxw4 unauthenticated RCE in the Image Optimization API (AVIF)
npm audit --omit=dev now reports nothing against next; remaining:
source-map-js (high, GHSA-68fv-2mgg-jv7q) and yaml (moderate), both transitive.
Verification: tsc --noEmit clean; build clean (same 2 routes as baseline);
lint has the same 2 pre-existing no-empty-object-type errors in
components/ui/color-mode.tsx as baseline. next start: / 200, /?q=test 200,
/favicon.ico 200, unknown route 404, no server errors. Chrome at 1280 and 390:
home and /?query=glock render, scrollWidth == clientWidth, no console errors;
"Search on GCI" server action POST 200 and the generated link renders.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015TH5RRwUukmnBav9aoro9S
Scan Container on the 16.3.3 image flagged Alpine libcrypto3/libssl3 CVE-2026-14456 and HIGH/CRITICAL in the Node image bundled npm CLI. Next/React/sharp were clean. Prod only runs node server.js, so apk-upgrade openssl 3.5.8 and delete npm/corepack/yarn from the prod stage.
matty
The Shittinator
Grok Bot