fix(security): clear base CVEs and review quota false positives

[seonghobae]

Summary

• upgrade Next.js/PostCSS/brace-expansion/sharp to their exact fixed versions and preserve the patched minimatch graph
• copy pnpm patches before frozen Docker installs so local, CI, and image builds use one dependency tree
• narrow CodeRabbit issue-summary blocking evidence to real pre-merge failures and actionable findings
• keep check-run conclusions and inline review-comment enforcement unchanged

Security evidence

• fixes the default-branch Next.js CVE-2026-64641 through CVE-2026-64649 findings
• fixes PostCSS GHSA-r28c-9q8g-f849, brace-expansion GHSA-mh99-v99m-4gvg, and sharp GHSA-f88m-g3jw-g9cj
• pnpm audit --audit-level moderate: no known vulnerabilities

Verification

• bash scripts/ci/test_pr_governance_gate.sh
• python -m pytest -q backend/tests/test_release_governance.py -k pr_governance
• pnpm install --frozen-lockfile with pnpm 11.5.3 supply-chain policy verification
• frontend: 46 files / 341 tests, ESLint zero warnings, TypeScript typecheck
• CodeGraph initialized and queried for governance and dependency blast radius

This lands on trusted develop first so pull_request_target can reevaluate #1109 without the quota-notice false positive.

Summary by CodeRabbit

• Bug Fixes

  • Improved frontend build reliability by ensuring required patch files are available during installation.
  • Updated frontend tooling and dependencies, including Next.js, PostCSS, and related package resolution.
  • Improved compatibility for minimatch and brace-expansion package loading.

• CI Improvements

  • Prevented “review limit reached” notifications from incorrectly blocking pull request merges.
  • Added automated coverage for the updated review-gate behavior.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 32 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: e431bd15-7540-4688-a7e4-8ad08adb8bee

📥 Commits

Reviewing files that changed from the base of the PR and between c1d281e and 5797c02.

📒 Files selected for processing (1)

• scripts/ci/test_pr_governance_gate.sh

📝 Walkthrough

Walkthrough

The frontend build now applies a local minimatch compatibility patch and pinned dependency overrides. The CI governance gate separately narrows CodeRabbit issue-comment blocking detection and adds coverage for review-limit comments.

Changes

Frontend dependency patching

Layer / File(s)	Summary
Dependency resolution and Docker build integration frontend/package.json, frontend/pnpm-workspace.yaml, Dockerfile, frontend/Dockerfile	Frontend packages and overrides are updated, the minimatch patch is registered, and both Docker build stages copy frontend/patches before installation.
Minimatch export compatibility patch frontend/patches/minimatch@3.1.5.patch	brace-expansion is loaded through its .expand export when available, with a fallback to the module value.

Governance comment filtering

Layer / File(s)	Summary
Issue comment blocking classification scripts/ci/pr_governance_gate.sh	Issue comments now use a dedicated CodeRabbit blocking pattern instead of the general blocking pattern.
Review-limit comment regression coverage scripts/ci/test_pr_governance_gate.sh	Adds a fake GitHub review-limit comment scenario and verifies it does not block or request a merge.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• ContextualWisdomLab/naruon#186: Updates overlapping frontend Next.js and ESLint dependency versions.
• ContextualWisdomLab/naruon#248: Modifies the CI governance gate test harness for comment scenarios.
• ContextualWisdomLab/naruon#1109: Applies related frontend Docker copying and minimatch dependency patching.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately reflects the dependency CVE fixes and the review-quota false positive handling changes.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/fix-governance-review-limit-base

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

PR governance metadata gate is not ready for 5797c02afc031725639a3290aa07eebbd81e55fb:

• Current-head CodeRabbit issue comment has blocking warning/failure evidence on 5797c02.

[seonghobae]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@scripts/ci/test_pr_governance_gate.sh`:
- Line 655: Update the assertion in the governance gate test to inspect the gate
output file, output.txt, instead of temp_dir/gh.log. Keep the existing
“Current-head CodeRabbit issue comment” pattern and assert it is absent from the
actual output used to classify blockers.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 6929063f-a893-4343-86c7-dc63e21da298

📥 Commits

Reviewing files that changed from the base of the PR and between 58d19ee and c1d281e.

⛔ Files ignored due to path filters (1)

• frontend/pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (7)

• Dockerfile
• frontend/Dockerfile
• frontend/package.json
• frontend/patches/minimatch@3.1.5.patch
• frontend/pnpm-workspace.yaml
• scripts/ci/pr_governance_gate.sh
• scripts/ci/test_pr_governance_gate.sh