Skelet 0.2.2

Security3

• Go 1.27.2 and golang.org/x/net v0.60.0. Fixes the standard library’s HTTP/2 and HTTP/1 desync issues, the MIME header memory limit bypass, ECH validation in crypto/tls, two html/template escaping bugs and os.Root following junctions on Windows, plus the matching HTTP/2 fixes in x/net. golangci-lint moves to v2.14.0 and golang.org/x/tools to v0.50.0, the first releases that read 1.27.2’s export data, which gqlgen needs too.

• Next.js 16.3.8, fixing a server-side request forgery in image optimization, with sharp 0.35.5 for its bundled librsvg.

• No high or critical pnpm audit findings in either app. Patched floors pin the flagged dependencies (shell-quote, fast-uri, undici, brace-expansion, busboy, source-map-js, proxy-addr, the MCP SDK and two GraphQL Tools packages) within their current major lines. braces has no fixed release and only build tooling reaches it, so it’s recorded as a reviewed exception.