[JJTGG]

Summary

Merge the tested fixes and dependency-security remediation from "JJTGG-patch-2" into "main" before continuing Agoré development.

Changes included

• Authentication and signup: Fix the signup entry point from the “Join Agoré” CTA and require sign-in for username profile redirects.
• Onboarding reliability: Improve retry behavior so onboarding can repair missing account defaults.
• Public-post security: Restrict public-post access unless visibility is explicitly permitted, failing closed by default.
• Analytics request protection: Enforce request-body size limits while streaming and add bounded JSON parsing.
• Regression coverage: Add tests for bounded JSON parsing and the disabled public-post endpoint.
• Dependency security: Update Next.js, React, and Zod to patched versions.
• CI and lockfile automation: Run regression tests, TypeScript checks, production builds, and dependency audits. Automatically synchronize "package-lock.json" on "JJTGG-patch-2" after successful checks, then run verification against the bot-generated commit.

Verification completed on "JJTGG-patch-2"

• Regression tests passed.
• TypeScript checks passed.
• Production build passed.
• Dependency audit reported zero vulnerabilities across all severity levels.
• The automatically generated lockfile commit passed a separate verification run.
• The latest Vercel preview deployment is READY.

Merge checklist

• Confirm the pull request's own CI checks pass.
• Review the final diff and resolve any merge conflicts.
• Merge into "main" using a merge commit to preserve branch history.
• Verify the production deployment after merging.

Scope: This PR consolidates the fixes and CI/security work from "JJTGG-patch-2". It does not represent a complete security audit of the entire application.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
agore	Ready	Preview	Oct 25, 2026 7:35pm UTC