Refresh reviewed dependencies and Discord bot guides

.gitignore

@@ -110,6 +110,7 @@ dist
 
 # Serverless directories
 .serverless/
+.vercel/
 
 # FuseBox cache
 .fusebox/

.node-version

@@ -1 +1 @@
-24.19.0
+24.21.0

.nvmrc

@@ -1 +1 @@
-24.19.0
+24.21.0

README.md

@@ -37,10 +37,12 @@ and executable CI actions may change only with a completed record in
 candidate review, advisory assessment, provenance checks, and verification.
 
 Run the governed advisory gate with `corepack pnpm run deps:audit`. CI rejects
-every unreviewed finding; the two visible `image-size` advisories are accepted
-only for the exact locally patched version and are covered by timeout-based
-regression probes. See the current dependency-review record for the owner and
-re-review deadline.
+every advisory; there are no vulnerability allowances or local security patches.
+The exact release-age exemption for `source-map-js@1.2.2` was explicitly
+authorized for its reviewed upstream security fix. The global seven-day gate
+remains enabled. See the
+[source-map upgrade review](docs/dependency-reviews/2026-10-06-source-map-upgrade.md)
+for the authorization, verification, owner, and exemption cleanup date.
 
 ## Styling
 

docs/dependency-plans/2026-10-06-candidates.json

@@ -0,0 +1,51 @@
+{
+  "status": "accepted and implemented; candidate review and acceptance tests passed",
+  "reviewDate": "2026-10-06",
+  "baselineCommit": "eeb0f5f3d09ea091727320817ed45e51304f2082",
+  "toolchain": {
+    "node": "24.21.0",
+    "pnpm": "10.34.6"
+  },
+  "packageManagerCandidate": "pnpm@10.34.6+sha224.b38497a8673a91646bec4f6dc864036e58208b3029b66f8d082aa7d0",
+  "dependencies": {
+    "react": "19.3.0",
+    "react-dom": "19.3.0"
+  },
+  "devDependencies": {
+    "@types/react": "19.3.0",
+    "typescript": "6.0.3",
+    "vite": "8.3.1",
+    "vocs": "2.10.0",
+    "waku": "1.0.0-rc.1",
+    "react-server-dom-webpack": "19.3.0"
+  },
+  "candidateResolutionOverrides": {
+    "vocs>image-size": "2.0.4",
+    "remark-mdx-frontmatter>toml": "4.2.0",
+    "@scalar/json-magic>undici": "7.29.1",
+    "source-map-js": "1.2.2"
+  },
+  "sourceHashes": {
+    "package.json": "2d9a668df01c36db55de234b9deebb633232872ec481c583d8eb26dc06932efc",
+    "pnpm-lock.yaml": "177c829def9143c062bd4641adc1db89c1a2d99fe24619bbd512f3ff8c1f9769",
+    "pnpm-workspace.yaml": "35f58faecc3ddce1f1360bdb412f6553eaf59cd3590792e9d7e22fbfdf01856c",
+    ".node-version": "7e8a2fa94951112b894a3dbe3d05efef5e9263741fa49125f0a70f40fedab4cc"
+  },
+  "heldVersions": {
+    "waku": "1.0.0-rc.2 incompatible with Vocs 2.10.0",
+    "vocs": [
+      "2.10.1",
+      "2.10.2"
+    ],
+    "vite": [
+      "8.3.2",
+      "8.3.3"
+    ],
+    "typescript": "7.0.2 incompatible with Twoslash"
+  },
+  "review": "docs/dependency-reviews/2026-10-06-dependency-refresh.md",
+  "releaseAgeExemptions": [
+    "source-map-js@1.2.2"
+  ],
+  "sourceMapReview": "docs/dependency-reviews/2026-10-06-source-map-upgrade.md"
+}

docs/dependency-plans/2026-10-06-refresh-preflight.md

@@ -0,0 +1,46 @@
+# Dependency refresh plan — accepted 2026-10-06
+
+The network restriction was resolved in the restarted session. Exact package
+selection, isolated resolution, supply-chain review and acceptance tests are
+complete. The implementation and full evidence are recorded in
+[the dependency review](../dependency-reviews/2026-10-06-dependency-refresh.md).
+
+## Selected versions and cross dependencies
+
+| Group | Exact target | Relationship |
+| --- | --- | --- |
+| Toolchain | Node 24.21.0; pnpm 10.34.6 | Match both Node files, engines and integrity-qualified Corepack/devEngines pins. |
+| React | react, react-dom, react-server-dom-webpack 19.3.0; @types/react 19.3.0 | Update together for Vocs/Waku peers; make the RSC peer explicit. |
+| Docs stack | Vocs 2.10.0; Waku 1.0.0-rc.1; Vite 8.3.1 | RC.2 failed the Vocs 2.10.0 build; RC.1 passes build and browser acceptance. |
+| TypeScript | 6.0.3 retained | Twoslash still excludes TypeScript 7. |
+| Image parser | image-size 2.0.4 | Scoped Vocs override replaces the old patch and exceptions; retain probes. |
+| Frontmatter | toml 4.2.0 | Scoped remark-mdx-frontmatter override; verify YAML/TOML MDX compilation and security guards. |
+| HTTP client | undici 7.29.1 | Scoped Scalar JSON-magic override clears ten findings. |
+| Source maps | source-map-js 1.2.2 | User-authorized exact release-age exemption; remove local backport and advisory allowance. |
+
+The original pnpm 10.34.5 proposal was superseded by 10.34.6 after its exact
+npm publish timestamp proved it was old enough. All 793 resolved identities
+passed signature checks; 792 passed the normal strict age gate and
+source-map-js 1.2.2 has an explicitly authorized exact-version exemption.
+270 had verified provenance. Policy protections and existing lifecycle allowances remain.
+
+## Acceptance
+
+Clean frozen installation, audit rejection fixtures, parser probes, MDX
+frontmatter fixtures, type-check, production and Vercel builds passed.
+Headless browser checks passed hydration, prefetch, internal links, anchors,
+search, back/forward scroll, mobile navigation, all 18 authored routes, and
+MDX hot reload. Native file watching required running the test server outside
+the macOS sandbox. The fixed dark scheme, sponsors and footer are preserved.
+
+## Release-age exemption cleanup
+
+The user authorized immediate source-map-js 1.2.2 installation with a
+[documented exact-version exemption](../dependency-reviews/2026-10-06-source-map-upgrade.md).
+The local backport and advisory allowance are removed. Full and production
+audits now report zero findings, with no dated audit-expiry condition.
+
+Normal eligibility is 2026-10-07T14:08:09.382Z UTC. Remove the redundant age
+exclusion after that point; re-review by 2026-10-09 UTC. Hold newer Vite/Vocs
+releases until seven days old and re-test Vocs/Waku together. Linux CI and an
+actual Vercel deployment have not been run locally.