fix(web): unblock Vercel monorepo build + finalize Dependabot bumps

.github/workflows/docs.yml

@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 

.github/workflows/mcp.yml

@@ -26,7 +26,7 @@ jobs:
       run:
         working-directory: mcp
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0

.github/workflows/prompts.yml

@@ -21,7 +21,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0

.github/workflows/release-verify.yml

@@ -21,7 +21,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0

.github/workflows/web.yml

@@ -26,7 +26,7 @@ jobs:
       run:
         working-directory: web
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0

web/README.md

@@ -109,7 +109,7 @@ vercel rollback      # promote a previous production deployment
 cd web
 vercel link                                   # team: muraschal, project: auditor
 vercel git connect https://github.com/marcelrapold/auditor.git
-# Root Directory = web, Production Branch = main (set in Project → Settings, or via the API)
+# Root Directory = web, Production Branch = main (set in Project Settings, or via the API)
 ```
 
 The custom domain is attached via `vercel domains add auditor.rapold.io` (one-time).

web/next.config.ts

@@ -1,10 +1,13 @@
+import { join } from "node:path";
 import type { NextConfig } from "next";
 import { AUDIT_SHORT_SLUGS } from "./lib/content";
 
 const nextConfig: NextConfig = {
-  // The app lives in web/ inside a monorepo; pin the tracing root to this folder
-  // so Next does not climb to the repo root looking for a lockfile.
-  outputFileTracingRoot: __dirname,
+  // Monorepo file-tracing root = the repo root (one level up from web/). Vercel's
+  // monorepo builder resolves the Next.js output (`.next`) against the repo root, so
+  // the tracing root must match it — pinning it to `web/` made Vercel look for
+  // `<root>/.next` and fail (ENOENT .next/package.json) once a second package (mcp/) existed.
+  outputFileTracingRoot: join(__dirname, ".."),
 
   // Short, shareable vanity URLs (e.g. /frontend-audit, /privacy-audit) that permanently
   // redirect to the canonical per-audit page in both languages. Derived from AUDITS so the