[dev-os-conductor]

Scope

Patch the existing Preview dependency baseline without changing application policy, account permissions, provider setup, database state or protocol ownership. Refs #409.

• Next, SWC, env and ESLint companions: 16.3.8, pinned to the minimal reviewed patch rather than a newer minor.
• Sharp: 0.35.5 and its matched binary/libvips family.
• Existing compatible transitive ranges: MCP SDK 1.32.1, proxy-addr 2.0.8, ip-address 10.7.4 and source-map-js 1.2.2.
• Existing overrides: fast-uri 3.1.8 and DOMPurify 3.4.16.
• Only package.json/package-lock.json change. No package nodes added/removed. Unchanged-version lock entries retain the base metadata, including platform libc qualifiers.

Clerk continues to own identity and its SDK v1 transitive dependency; mcp-handler/MCP server v2 remain the existing protocol path. No custom auth, retry, parser or dependency-wrapper workaround is introduced.

Verification

• Full local verify: lint, typecheck, 1,624 product tests (242 files), 47 infrastructure tests (7 files), inventory, architecture, migration safety and production build passed.
• Independent exact-lock/range/native-library review found no blocking defect.
• Native Sharp loads librsvg 2.63.2/vips 8.18.7.
• Exact-head CI, golden browser verification and deployed Preview acceptance remain required.

Explicit residual assessment

This is not a zero-vulnerability claim. Final omit-dev audit still reports 5 high/2 moderate findings in the Tailwind 3 build chain. All 114 completed runtime NFT traces and 634 generated server/static source maps exclude those packages, and application source uses only trusted repository build inputs; untrusted repository/CSS/glob input can still threaten build availability. npm proposes a Tailwind 4 major; this PR does not force that unrelated migration.

The MCP server package also vendors fast-uri 3.1.0 inside its synchronous, application-owned-schema AJV bundle, outside npm's lock audit/override coverage. Inspected use has no remote schema loading or relevant attacker-controlled host/port authorization path. Latest compatible server 2.3.1 still embeds the same bundle, so a version bump would not resolve it. Existing upstream issue #2966 and fix PR #2973 own that follow-up.

Primary patched-library advisory: Sharp/librsvg. The Next ImageResponse advisory and proxy-addr advisory describe the existing reviewed findings; exploitability is not inferred merely from an audit severity.

Rollout boundary

Preview integration only after exact green checks. No Main/production promotion. No migrations.

Canonical Conductor work: #409