Dependency security pass: 16 alerts and closing 15 of them

16 security alerts were sitting on my website's repository.

15 of them are closed as of today.

One remains: a library that has no patched release yet. I documented it and I'm watching it — not hiding it.

Today's job wasn't an upgrade. It was maintenance:

• Next.js pinned exactly to 16.3.8 — the closest version that closes all 7 runtime advisories.
• sharp moved to 0.35.5.
• Transitive dependencies refreshed inside their existing ranges.
• The Tailwind engine frozen at 4.1.18 so CSS output stays identical in local dev and CI and production.

Lesson: dependency security is not a blind update. It is the smallest change that closes an alert — plus freezing the versions that change your output.

The site stayed up through all of it: mehrdad.ir

How often do you audit your project's dependencies?