fix(security): patch advisories published since #356 across examples

[yosriady]

The audit job failed on every PR that touches these 13 examples (seen on #358), because of advisories published after #356. Nothing in this PR changes app code.

Patched (same major)

Advisory	Fix	Examples
next >=16.0.0 <16.3.8 (GHSA-cjq9-62q9-8jv4 high, + 5 lower)	^16.3.6 → ^16.3.8; porto/tempo (latest) re-resolve to 16.3.8	crossmint, porto, privy, reown, tempo, web3-onboard
shell-quote >=1.8.4 <1.11.0 (GHSA-pqg4-j6r4-53mv critical)	override 1.10.0 → 1.11.0 (the old pin was itself vulnerable)	12 examples
sharp <0.35.5 (GHSA-wq5f-xc86-pv6w high)	override → ^0.35.5	12 examples
source-map-js >=1.0.0 <1.2.2 (GHSA-68fv-2mgg-jv7q high)	new override ^1.2.2	12 examples

Exact pins where a newer release is inside the 7-day minimumReleaseAge gate (next 16.4.0, shell-quote 1.12.0).

Ignored with a reason (no fixed release)

Same mechanism and wording style as with-react-native (auditConfig.ignoreGhsas):

• braces <=3.0.3 (GHSA-vfj7-8cjw-p6xm): reached only through build tooling (tailwindcss, chokidar, micromatch, fast-glob). crossmint, metamask, next-page-router, reown, web3-onboard.
• with-crossmint, through the Crossmint SDK's React Native and Solana dependencies: node-forge <=1.4.0 (GHSA-86w9-cpqp-85rv), bigint-buffer <=1.1.5 (GHSA-3gc7-fjrx-p6mg), image-size 1.x (GHSA-5p2g-fcmc-qvqq, GHSA-w3rx-r6r6-pgpr; fixed only in 2.x, a major bump of metro's dependency, skipped as in fix(security): patch Aikido-flagged dependencies across examples #356).

Verified locally

• pnpm audit --prod passes at each example's CI level (critical for with-react, high for the rest).
• Every changed lockfile passes pnpm install --frozen-lockfile --lockfile-only.
• Resolved: next 16.3.8, sharp 0.35.5, shell-quote 1.11.0, source-map-js 1.2.2.

CI builds each changed example.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[cubic-dev-ai]

No issues found across 30 files

<sub>Tip: cubic can generate docs of your entire codebase and keep them up to date. Try it here.

View guided diff | Turn on auto-fix | Re-trigger cubic</sub>

[socket-security]

Dependency limit exceeded — report not shown.

This pull request scan exceeded the 10,000-dependency limit applied to this scan, so the results are incomplete and may be inaccurate. To avoid reporting false positives, Socket has not posted a report.

Upgrade your plan to raise the dependency limit and get complete reports, or view the partial scan in the dashboard.

Socket is always free for open source. If this is a non-commercial open source project, contact us to request a free Team account.