[miguelcalderon]

Updates the examples’ dependencies to fix critical vulnerabilities in Next.js and DOMPurify, high-severity issues in markdown-it and Vite, and both current Dependabot alerts for follow-redirects. Application source is unchanged.

CI is pinned to Biome 2.3.8, matching the committed npm lockfile and formatter configuration, so new formatter releases cannot unexpectedly change the required checks.

The 15-day dependency cooldown stays in place. This adds a narrow exception for the exact patched releases and required Next.js companion packages. The policy checker rejects broader exclusions and quoted strings that pnpm would not treat as arrays. The temporary exclusions can be removed once all approved releases have passed the cooldown on October 31, 2026.

Validation and remaining risks

• Audited all 27 npm and three pnpm lockfiles on October 23, 2026: no critical findings remain. The remaining high findings trace to the unpatched braces advisory, GHSA-vfj7-8cjw-p6xm.
• The full biome ci . check passes locally with Biome 2.3.8 on a clean snapshot.
• All 14 dependency-policy tests, override checks, and three frozen pnpm checks pass. The AI editing example also passes its 55 tests, type check, lint, and build.
• Pre-existing build failures remain in dws, redact-one-by-one, text-2-speech, ui-customization, and signing-demo-complete. Each failure was reproduced with the original dependencies. No application code or type checks were changed to hide them.

The dependency-policy change and exact exception list are documented in documentation/dependency-cooldowns.md.