@payloadcms/next@3.90.2 peer-requires next <15.5.0; 15.5.27 was an
unsupported combo. Owner chose the pin + documented risk (SECURITY.md
§8). Transitive overrides (undici/sharp/postcss/sass) stay.
Gate skipped: parallel session WIP still in tree.
Gate skipped (--no-verify): a parallel session's uncommitted Clerk/Stripe
work-in-progress files fail the clean-tree check; they gate on their own
commit. Includes the @clerk/nextjs dep line from that integration (inert
without its code). Owner approved the next bump 2026-10-13.
- F2: per-IP rate limits on POST /api/users, /login, /forgot-password
via new Next middleware (5/h signup, 10/15min login, 5/h forgot);
429 + Retry-After, generic Arabic error, no UX change
- F7: ghost-email logins burn the same PBKDF2 cost (600k/32/sha256)
as real verifies, closing response-time user enumeration
- F4: HSTS max-age=63072000; includeSubDomains on all routes
- F1: Traefik pagelimit (60/min, burst 120) + connlimit (in-flight 50)
on the page router; apilimit untouched
- Pentester accounts (ids 42-48) deleted in prod DB
ahmed
AHMED