[cdbartholomew]

Routine dependency maintenance for the root package-lock.json.

Alerts closed

• fix(retain): retry transient extraction failures #1851 — next >= 16.0.0, < 16.3.8 (high, GHSA-cjq9-62q9-8jv4)
• fix(retain): never silently drop memory on a fact-extraction failure (#1833) #1852 — next >= 16.0.0, < 16.3.8 (medium, GHSA-mcj8-r9mp-w47p)
• fix(consolidation): scope-locked parallel dispatch (alternative to #1843) #1853 — next >= 16.0.0, < 16.3.8 (medium, GHSA-f87g-xv8r-7p7x)
• fix(retain): preserve full document body when splitter chunks oversized input #1855 — next >= 16.0.0, < 16.3.8 (medium, GHSA-4jqv-mc3x-m676)
• ci(test-api): shard pytest 3 ways + cache resolved .venv #1856 — next >= 16.3.0, < 16.3.8 (medium, GHSA-3w37-wq28-93x7)
• fix(consolidation): shorten retry backoff base from 60s to 5s #1854 — next >= 16.0.0, < 16.3.8 (low, GHSA-39w2-rjm5-chcv)

Changes

• next 16.3.7 → 16.3.8 (patch release), with @next/env and the eight @next/swc-* platform binaries moving in lockstep.
• Root overrides.next: >=16.3.6 <17 → >=16.3.8 <17, so the floor sits outside the advisory range.
• hindsight-control-plane/package.json: next ^16.2.11 → ^16.3.8 (floor raise only).

The lock records 16.3.8 rather than the newer 16.4.0 minor deliberately, to keep this a patch-level move.

Lockfile notes for reviewers

Generated with npm 11 (npx npm@11 install --package-lock-only); the root lockfile needs npm 11 because npm 10.9.2 mishandles overrides in workspaces. Besides the next entries, npm 11 drops the "peer": true flag from the 26 @esbuild/* optional platform entries. That is metadata normalisation only: no package is added, removed or changes version (esbuild stays 0.28.2), and npm 10.9.2 npm ci accepts the result.

Verification (local, clean worktree of main)

• npm ci with npm 10.9.2 — accepts the lockfile; npm ls next shows a single next@16.3.8 (also deduped under next-intl)
• npm run build --workspace=hindsight-clients/typescript — ok
• hindsight-control-plane: npm test 290/290 (with TZ=UTC, as on CI runners — one date-preset test is timezone-sensitive and fails only under a local non-UTC zone, independent of this change), npm run i18n:check ok, npx tsc --noEmit ok, npm run build ok, standalone server.js present, bin/cli.js --help ok, standalone server responds on HTTP
• hindsight-all-npm: tests 11/11, build ok
• hindsight-tools/hindsight-agent-sdk: tests 20/20, build ok

CI: build-control-plane, build-hindsight-all-npm, build-typescript-client and test-typescript-client. test-hindsight-agent-sdk path-filters on its own directory and is skipped for a root-lockfile change, so the agent SDK test and build above are local only.

Not included: braces (#1775, advisory <= 3.0.3) — 3.0.3 is the latest published release, so there is no fixed version to move to yet.