fix(deps): clear the visualizer's npm advisories, including an RCE in next/og

[hijohnnylin]

Summary

This clears all 23 open Dependabot alerts on visualizer-web/package-lock.json and visualizer-web/docs-site/package-lock.json. Only package.json and the two lockfiles change.

The critical alert: next

next 16.3.4 is inside the range of the next/og ImageResponse remote code execution advisory, fixed in 16.3.6. next is pinned to an exact version, so npm audit fix cannot move it. The pin is now 16.3.7: still exact, still a patch inside 16.3. eslint-config-next moves from 16.3.0 to 16.3.7 with it.

16.3.8 is out, but it is younger than the two-day min-release-age cooldown, so it waits for a later bump.

Indirect dependencies, via npm audit fix

No overrides were needed.

Project	Package	Now
visualizer-web	undici	7.30.0
visualizer-web	ip-address	10.7.2
visualizer-web	fast-uri	3.1.8
visualizer-web	brace-expansion	1.1.21 / 5.0.12
docs-site	joi	17.13.8
docs-site	image-size	2.0.4
docs-site	fast-uri	3.1.8
docs-site	brace-expansion	1.1.21

The last dependency fix could not repair image-size, because no safe release existed then. 2.0.3 and later are outside the vulnerable range.

Out of scope

The Python alerts on uv.lock and validator/uv.lock (PyJWT, urllib3, httpx2, accelerate, nltk, pytest, setuptools, torch) are not touched here.

Release

This does not cut a release, because visualizer-web/ is outside the sdist.

Test plan

• npm audit reports 0 issues in visualizer-web and in docs-site
• In the lockfiles, every flagged package is at or above its fixed version
• make viz-check: eslint, tsc, knowledge bundle, doc links, GPU catalog
• npm run build: the Docusaurus build writes public/docs, and next build on 16.3.7 generates all 9 pages
• The pre-push hook's static checks pass