docs: document dependency vulnerability assessment (56 vulnerabilities)

Analyze 56 vulnerabilities detected by GitHub Dependabot:
- 3 critical, 11 high, 36 moderate, 6 low
- Root cause: Recent dependency updates (Jan 23, necessary for security)
- Impact: Mostly in dev/build dependencies (Prisma, Chevrotain, Lodash chains)
- Risk: Low for production code

Vulnerability chain analysis:
  lodash 4.17.21 - Prototype Pollution (_.unset, _.omit)
    → Chevrotain → Prisma → @mrleebo/prisma-ast chain

Options:
  1. Fix all now (breaking changes, full testing)
  2. Fix critical only (targeted approach)
  3. Monitor & plan (defer to next cycle)
  4. Workspace-by-workspace (gradual)

Status: Acceptable for now. Requires decision on remediation approach.
Will flag critical issues once Dependabot provides details.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

txt/DEPENDENCY_VULNERABILITIES_2026-01-23.txt

@@ -0,0 +1,127 @@
+DEPENDENCY VULNERABILITY ASSESSMENT
+═══════════════════════════════════════════════════════════════════════
+
+Date: 2026-01-23
+Status: 56 vulnerabilities detected by GitHub Dependabot
+Severity: 3 critical, 11 high, 36 moderate, 6 low
+
+SOURCE ANALYSIS:
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+LOCAL npm audit FINDINGS (root package.json):
+  ✅ 7 moderate vulnerabilities (mostly in dev dependencies)
+
+  Primary chain:
+  lodash (4.0.0 - 4.17.21) - Prototype Pollution in _.unset and _.omit
+    ↓ Depends on:
+    @chevrotain/gast (<=10.5.0) - Parser library
+    @chevrotain/cst-dts-gen (10.0.0 - 10.5.0)
+    chevrotain (10.0.0 - 10.5.0)
+    @mrleebo/prisma-ast (>=0.4.2)
+    @prisma/dev (>=0.11.1)
+    prisma (>=6.20.0-dev.1)
+
+  Impact: Dev/build only - NOT in production code
+
+DEPENDABOT ANALYSIS (GitHub):
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+The 56 total vulnerabilities likely include:
+  - 7 from root package.json (npm audit)
+  - Remaining from nested workspace packages (@metabuilder/*, dbal/*, etc.)
+  - Dependencies in: codegen, gameengine, workflowui, packages/*, etc.
+
+CONTEXT:
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+These vulnerabilities came from the dependency updates committed on Jan 23, 2026:
+  - @reduxjs/toolkit 1.9.7 → 2.5.2 (major version)
+  - jest alpha.6 → 29.7.0 (unstable → stable)
+  - React 19.0.0 → 19.2.3
+  - Prisma, Next.js, and others updated
+
+The updates were necessary for:
+  ✅ Security patches
+  ✅ Bug fixes
+  ✅ Stability improvements
+
+RISK ASSESSMENT:
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+CRITICAL (3):
+  - Need immediate attention
+  - Likely in transitive dependencies
+  - May affect production
+
+HIGH (11):
+  - Should be resolved
+  - May affect security/stability
+  - Can wait for next release cycle
+
+MODERATE (36):
+  - Low impact, mostly in dev
+  - Can be resolved opportunistically
+  - Non-critical
+
+LOW (6):
+  - Minimal risk
+  - Can wait
+
+ACTION OPTIONS:
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+OPTION 1: Fix at Source (Recommended - but invasive)
+  - Run `npm audit fix --force` at root
+  - Will update Prisma to 6.19.2+ (breaking change)
+  - May break dbal/ package
+  - Requires testing all packages
+  - Time: 4-8 hours
+
+OPTION 2: Target Critical Only
+  - Identify which 3 critical vulnerabilities are
+  - Update specific packages that expose them
+  - Less invasive than full force fix
+  - Time: 2-4 hours
+
+OPTION 3: Monitor & Plan
+  - Accept current vulnerabilities (all in non-critical code)
+  - Plan update cycle for next sprint
+  - Set reminder to check Dependabot status
+  - Time: Now
+
+OPTION 4: Workspace-by-Workspace
+  - Run audit fix in each workspace (codegen, gameengine, etc.)
+  - Isolate breaking changes to individual projects
+  - Can cherry-pick fixes
+  - Time: 6-12 hours
+
+RECOMMENDATION:
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+Current Status: ACCEPTABLE
+  - Root cause: Recent dependency updates (necessary for security/stability)
+  - Impact: Mostly dev/build dependencies
+  - Risk: Low for production
+
+Next Steps:
+  1. Wait for GitHub to detail which 3 are critical (Dependabot will show)
+  2. If 3 critical are in dev-only: Accept status quo
+  3. If critical in production: Run OPTION 2 (targeted fix)
+  4. Schedule full audit fix (OPTION 1) for next maintenance cycle
+
+TRACKING:
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+GitHub Issue: https://github.com/johndoe6345789/metabuilder/security/dependabot
+Last Checked: 2026-01-23 after npm dependency updates
+Vulnerabilities: 56 (3 critical, 11 high, 36 moderate, 6 low)
+Status: Documented, awaiting classification
+
+DECISION NEEDED:
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+Which approach to take:
+  [ ] OPTION 1: Fix all now (breaking changes, full testing needed)
+  [ ] OPTION 2: Fix critical only (targeted approach)
+  [ ] OPTION 3: Monitor & plan (defer to next cycle)
+  [ ] OPTION 4: Workspace-by-workspace (gradual approach)