fix: update vulnerable FireVector dependencies

[bgorzelic]

What changed

Updates FireVector's direct production and test dependencies to patched versions, including Next.js, Auth.js, the Drizzle adapter and ORM, Resend, and Vitest. The lockfile also receives npm's non-breaking transitive remediation.

Why

A clean install from main reported 31 known dependency advisories: 3 critical, 17 high, 9 moderate, and 2 low. The direct paths included authentication, framework request handling, SQL identifier escaping, and the test server.

After this change, all critical and high findings are removed. Six moderate findings remain in development-tool dependency chains. npm's proposed complete remediation would downgrade Drizzle Kit across a breaking boundary, so that change is intentionally excluded pending a separate toolchain decision.

Impact and verification

• npm run test:engine: 18 tests passed
• npm run lint --workspace=apps/web: passed
• npm run build: passed, including TypeScript and production route generation
• npm audit: 0 critical, 0 high, 6 moderate

Required before production merge

• Exercise Google and credentials login/logout in a non-production environment.
• Exercise protected routes and two-factor authentication.
• Verify observation create/update/delete against a disposable database.
• Confirm database migration compatibility.
• Run a post-deploy smoke test through the protected production workflow.

Existing verification gaps

The web workspace has no test script, and the root npm test references a missing services/api directory. Those pre-existing gaps are not hidden by this dependency update and should be repaired separately.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
firevector	Error		Aug 12, 2026 2:16am