Dep upd

Dockerfile

@@ -3,31 +3,28 @@
 # ============================================
 # Stage 1: Dependencies
 # ============================================
-FROM --platform=$BUILDPLATFORM node:22-alpine3.22 AS deps
+FROM --platform=$BUILDPLATFORM node:26-alpine3.24 AS deps
 
 WORKDIR /app
 
 ENV NEXT_TELEMETRY_DISABLED=1
-ENV COREPACK_DEFAULT_TO_LATEST=0
 
 COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
 
-RUN corepack enable \
+# Node 25+ images ship without corepack; keep pnpm in sync with "packageManager"
- && corepack prepare [email protected] --activate \
+RUN npm install -g [email protected] \
  && pnpm install --frozen-lockfile
 
 # ============================================
 # Stage 2: Builder
 # ============================================
-FROM --platform=$BUILDPLATFORM node:22-alpine3.22 AS builder
+FROM --platform=$BUILDPLATFORM node:26-alpine3.24 AS builder
 
 WORKDIR /app
 
 ENV NEXT_TELEMETRY_DISABLED=1
-ENV COREPACK_DEFAULT_TO_LATEST=0
 
-RUN corepack enable \
+RUN npm install -g [email protected]
- && corepack prepare [email protected] --activate
 
 COPY --from=deps /app/node_modules ./node_modules
 
@@ -38,7 +35,7 @@ RUN pnpm build
 # ============================================
 # Stage 3: Runner
 # ============================================
-FROM node:22-alpine3.22 AS runner
+FROM node:26-alpine3.24 AS runner
 
 WORKDIR /app
 

package.json

@@ -2,7 +2,7 @@
   "name": "nini-artgallery",
   "version": "0.1.0",
   "private": true,
-  "packageManager": "pnpm@11.9.0",
+  "packageManager": "pnpm@12.5.1",
   "scripts": {
     "dev": "next dev --turbopack",
     "build": "next build",
@@ -11,42 +11,35 @@
     "lint:fix": "eslint --fix ."
   },
   "dependencies": {
-    "@ai-sdk/react": "^4.0.5",
+    "@ai-sdk/react": "^4.0.112",
     "@heroicons/react": "^2.2.0",
-    "@openrouter/ai-sdk-provider": "^2.10.0",
+    "@openrouter/ai-sdk-provider": "^3.1.0",
     "@types/jsonwebtoken": "^9.0.10",
-    "@types/nodemailer": "^8.0.1",
+    "ai": "^7.0.109",
-    "ai": "^7.0.4",
     "jsonwebtoken": "^9.0.3",
-    "next": "16.2.9",
+    "next": "16.3.6",
-    "next-intl": "^4.13.0",
+    "next-intl": "^4.14.6",
-    "nodemailer": "^9.0.1",
+    "nodemailer": "^10.0.10",
-    "react": "19.2.7",
+    "react": "19.3.0",
-    "react-dom": "19.2.7",
+    "react-dom": "19.3.0",
     "server-only": "^0.0.1",
-    "zod": "^4.4.3"
+    "zod": "^4.6.5"
   },
   "devDependencies": {
-    "@eslint/eslintrc": "^3.3.5",
+    "@eslint/eslintrc": "^3.3.7",
     "@eslint/js": "^10.0.1",
-    "@tailwindcss/postcss": "^4.3.1",
+    "@tailwindcss/postcss": "^4.3.3",
-    "@types/node": "^26.0.1",
+    "@types/node": "^26.6.2",
-    "@types/react": "19.2.17",
+    "@types/react": "19.3.0",
-    "@types/react-dom": "19.2.3",
+    "@types/react-dom": "19.3.0",
-    "@typescript-eslint/eslint-plugin": "^8.62.0",
+    "@typescript-eslint/eslint-plugin": "^8.70.1",
-    "@typescript-eslint/parser": "^8.62.0",
+    "@typescript-eslint/parser": "^8.70.1",
-    "eslint": "^10.6.0",
+    "eslint": "^10.11.0",
-    "eslint-config-next": "16.2.9",
+    "eslint-config-next": "16.3.5",
-    "globals": "^17.7.0",
+    "globals": "^17.12.0",
-    "postcss": "^8.5.16",
+    "postcss": "^8.5.28",
     "postcss-load-config": "^6.0.1",
-    "tailwindcss": "^4.3.1",
+    "tailwindcss": "^4.3.3",
     "typescript": "^6.0.3"
-  },
-  "pnpm": {
-    "overrides": {
-      "@types/react": "19.2.17",
-      "@types/react-dom": "19.2.3"
-    }
   }
 }

pnpm-workspace.yaml

@@ -3,11 +3,19 @@ allowBuilds:
   '@swc/core': true
   sharp: true
   unrs-resolver: true
+# [email protected] fixes GHSA-vcvr-r3jv-pc5j (critical RCE in next/og); these exact-version
+# exclusions only bypass the 24h release-age gate and can be removed after 2026-09-24.
 minimumReleaseAgeExclude:
-  - [email protected]
+  - '@next/[email protected]'
-onlyBuiltDependencies:
+  - '@next/[email protected]'
-  - "@parcel/watcher"
+  - '@next/[email protected]'
-  - "@swc/core"
+  - '@next/[email protected]'
-  - sharp
+  - '@next/[email protected]'
-  - unrs-resolver
+  - '@next/[email protected]'
-  - "@tailwindcss/oxide"
+  - '@next/[email protected]'
+  - '@next/[email protected]'
+  - '@next/[email protected]'
+  - [email protected]
+overrides:
+  '@types/react': 19.3.0
+  '@types/react-dom': 19.3.0

src/app/api/chat/route.ts

@@ -81,7 +81,7 @@ export async function POST(req: Request) {
 
     const result = streamText({
       model: openrouter("openai/gpt-4o-mini"),
-      system:
+      instructions:
         `You ARE ${artist.name}, the artist whose gallery the visitor is browsing. ` +
         `Always speak in first person. When greeting a visitor or starting a conversation, ` +
         `introduce yourself by name (${artist.name}) so they know who they're talking to.\n\n` +

src/app/api/transcribe/route.ts

@@ -64,15 +64,13 @@ export async function POST(req: Request) {
     // ── Transcribe via OpenRouter audio model ─────────────────────
     const result = await generateText({
       model: openrouter(TRANSCRIPTION_MODEL),
+      // AI SDK v7 rejects system messages inside `messages`; use `instructions`.
+      instructions:
+        `Transcribe the following audio exactly in ${languageName}. ` +
+        "Return ONLY the transcription text — no preamble, no explanation, no formatting. " +
+        "If the audio contains only silence, background noise, or no discernible speech, " +
+        "return exactly the string [SILENCE] and nothing else.",
       messages: [
-        {
-          role: "system",
-          content:
-            `Transcribe the following audio exactly in ${languageName}. ` +
-            "Return ONLY the transcription text — no preamble, no explanation, no formatting. " +
-            "If the audio contains only silence, background noise, or no discernible speech, " +
-            "return exactly the string [SILENCE] and nothing else.",
-        },
         {
           role: "user",
           content: [