[docs] Document resolved website advisories

Signed-off-by: Viwat Vchirawongkwin <viwat.v@chula.ac.th>

Author: yyods

CHANGELOG.md

@@ -26,9 +26,13 @@ its annotated tag rather than from the newer branch tip.
   contributor, security, architecture, protocol, and validation documentation.
 - Added an independent `/privacy` policy and stable `/app` landing page, with
   invited Android testing and public TestFlight presented as distinct channels.
-- Patched the remediable website PostCSS/Nanoid dependency chain and bounded
-  the remaining build-only `image-size` advisory behind a static-deploy and
-  no-metadata-image-route contract until an upstream fix exists.
+- Patched the website PostCSS/Nanoid chain, upgraded vinext so `image-size` is
+  absent from the installed dependency graph, and made high/critical npm audit
+  findings fail the release gate.
+- Hardened vinext's internally bundled image parser against the ICNS, HEIF, and
+  JXL zero-length denial-of-service paths, with timeout-bounded regression
+  inputs, fail-closed upstream-drift checks, static-image import guards, and
+  complete MIT attribution while production remains a static-only deployment.
 - Made publication CI fetch the complete source history required by
   ancestry-routed firmware gates, and made the RP2 runtime-closure fixture
   hermetic instead of depending on a retained local archive.

README.md

@@ -201,6 +201,11 @@ npm ci
 npm run check
 ```
 
+The website gate includes a high/critical npm advisory audit, deterministic
+third-party notices, and timeout-bounded regression coverage for the image
+parser bundled inside the pinned preview adapter. Production remains a checked
+static export with no Node.js website process.
+
 The complete build requires the pinned toolchains documented in the relevant
 component README and specifications.
 

tools/web/README.md

@@ -60,25 +60,34 @@ The full release gate is:
 npm run check
 ```
 
-That command checks formatting, lint, strict types, unit/content contracts,
-vinext compatibility, the portable Next.js export, and the Sites preview
-artifact. Canonical VPS production files are written to `out/`; the
-host-specific owner-preview bundle is written to `dist/`, including fully
-prerendered launch routes, static discovery files, a static 404 boundary around
-the vinext handler, and the exact Sites project binding.
+That command checks formatting, lint, strict types, high/critical dependency
+advisories, exact third-party notices, unit/content contracts, vinext
+compatibility, the portable Next.js export, and the Sites preview artifact.
+Canonical VPS production files are written to `out/`; the host-specific
+owner-preview bundle is written to `dist/`, including fully prerendered launch
+routes, static discovery files, a static 404 boundary around the vinext handler,
+and the exact Sites project binding.
 
 No application backend, remote CMS, analytics service, or web-font request is
 needed. A normal build needs no runtime or build-time environment variables.
 
-### Temporary build-dependency exception
-
-Vinext currently depends on `image-size` 2.0.2, and npm has no patched release
-for GHSA-w3rx-r6r6-pgpr or GHSA-5p2g-fcmc-qvqq. The dependency is confined to
-the owner-preview build: production deploys only `out/` and runs no Node.js
-process. Until a compatible fix exists, the test gate forbids filesystem
-metadata image routes under `src/app`, which are the vinext path that invokes
-the parser. Recheck this exception on every vinext or `image-size` update; do
-not describe `npm audit` as clean while the two related high findings remain.
+### Build-dependency security boundary
+
+Vinext `1.0.0-beta.8` removes `image-size` from the installed npm dependency
+graph, so the exact lockfile passes `npm audit --audit-level=high`. Its
+published build tooling still embeds the affected `image-size` 2.0.2 parser,
+however. PyBLE's post-install step therefore adds reviewed fail-closed guards
+for the zero-length ICNS, HEIF, and JXL loops; installation fails if the pinned
+upstream source drifts. Timeout-bounded regression inputs exercise all three
+paths, and the generated notice explicitly retains the embedded parser's MIT
+attribution.
+
+The build contract also forbids static image module imports and filesystem
+metadata image routes; authored images remain static `public/` URLs with
+explicit dimensions. Production deploys only the checked `out/` tree and runs
+no Node.js website process. Keep these defenses until vinext publishes tooling
+with a patched parser, then remove the local hardening only alongside its
+contracts and notice review.
 
 ## Production deployment