diff --git a/SECURITY.md b/SECURITY.md
index eb2d865..d44bb08 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -57,9 +57,9 @@ The publication review on 2026-10-26 found no credential-pattern matches in the
 | --- | --- | --- |
 | Tinypool / Vitest mocker (through Vitest 3) | [GHSA-5gmw-xhrv-c9v3](https://github.com/advisories/GHSA-5gmw-xhrv-c9v3), [GHSA-85c8-ppgw-ccpr](https://github.com/advisories/GHSA-85c8-ppgw-ccpr), [GHSA-82fw-gwwq-j7x9](https://github.com/advisories/GHSA-82fw-gwwq-j7x9), [GHSA-qxg6-89mg-rqv8](https://github.com/advisories/GHSA-qxg6-89mg-rqv8) | **Fixed** by upgrading to Vitest 5 (development only) |
 | csv-parse 6 | [GHSA-8cw4-87c7-c6xx](https://github.com/advisories/GHSA-8cw4-87c7-c6xx) | **Fixed** by upgrading to csv-parse 7 |
-| body-parser 2.x, through Express 5 | [GHSA-27r3-jxmh-p828](https://github.com/advisories/GHSA-27r3-jxmh-p828) (compressed-body DoS) | **Mitigated**: no patched 2.x release exists yet, so the JSON parser runs with `inflate: false` and rejects compressed request bodies (covered by a test). `npm audit` still reports it until upstream publishes a fix. |
+| body-parser 2.x, through Express 5 | [GHSA-27r3-jxmh-p828](https://github.com/advisories/GHSA-27r3-jxmh-p828) (compressed-body DoS) | **Mitigated; dependency upgrade pending**: the lockfile currently resolves body-parser 2.3.0. A patched release, 2.4.0, is available; [PR #7](https://github.com/fimdim/github-engineering-insights/pull/7) proposes the upgrade. The JSON parser keeps `inflate: false` and rejects compressed request bodies (covered by a test). `npm audit` will continue to report this advisory until the patched dependency is installed. |
 
-Do not use `npm audit fix --force` for the remaining entry: it would downgrade Express to 4.x.
+Upgrade the remaining dependency to the patched release without downgrading Express; do not use `npm audit fix --force`.
 This is a point-in-time review, not a security certification, exhaustive secret scan, or guarantee that future dependencies or commits are safe.
 
 ## Reporting vulnerabilities
diff --git a/apps/web/vite-env.d.ts b/apps/web/vite-env.d.ts
new file mode 100644
index 0000000..11f02fe
--- /dev/null
+++ b/apps/web/vite-env.d.ts
@@ -0,0 +1 @@
+/// <reference types="vite/client" />
diff --git a/package.json b/package.json
index a96c3cb..4f5f7a4 100644
--- a/package.json
+++ b/package.json
@@ -35,7 +35,6 @@
     "vite": "^7.2.0",
     "vitest": "^5.0.5"
   },
-  "license": "MIT",
   "description": "Local-first DORA, SPACE and GitHub Copilot metrics dashboard for GitHub Enterprise Cloud",
   "keywords": [
     "dora",