Harden npm dependency audit posture

[matt-dean-git]

Summary

• update satgate-landing Next.js from 16.1.6 to 16.2.9 and refresh landing lockfile, clearing the landing npm audit to zero
• refresh sdk/nodejs lockfile with non-force npm audit remediation
• intentionally leave sdk/nodejs Jest/Istanbul dev-tooling audit cluster unresolved because npm proposes breaking/downgrade paths (jest@25 / older ts-jest) and scratch major/override paths did not cleanly remediate it

Verification

• satgate-landing: npm ci
• satgate-landing: npm run build
• satgate-landing: npm run test:demo-ia
• satgate-landing: npm audit --json -> 0 vulnerabilities
• sdk/nodejs: npm ci
• sdk/nodejs: npm test -> 2 suites / 4 tests passed
• sdk/nodejs: npm run build
• sdk/nodejs: npm audit --json -> 19 moderate dev-tooling advisories remain
• git diff --check
• changed-file guard: no public source/copy/demo files changed

Caveats

• not production-ready
• not production-promoted
• no Wayne production authorization
• public buyer-demo path was already verified on satgate.io and is not recharacterized by this dependency-only PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
satgate	Ready	Preview, Comment	Jun 27, 2026 8:03pm