[msogin]

Summary

Runtime npm audit --omit=dev flagged next (direct dependency, critical) with three advisories, all in range >=16.0.0 <=16.4.0:

• GHSA-2464-fhr4-w9xw — Unauthenticated Remote Code Execution in the Image Optimization API when SVG files are used
• GHSA-p3m5-59mp-jv5r — Denial of Service in App Router using Server Actions
• GHSA-673q-mjm6-r5xr — Unauthenticated Remote Code Execution in use cache functions returning typed arrays

Fix: bump next from ^16.3.8 to ^16.4.2 (latest stable 16.x). This is a patch-level, non-major bump (fixAvailable: true, not an object requiring a semver-major parent) — no code changes needed.

Risk class

Patch (same major version, no breaking changes expected).

Test evidence

npm ci --ignore-scripts                             # clean install, no errors
npm rebuild better-sqlite3 esbuild unrs-resolver     # native deps unchanged by this bump, rebuilt successfully
npx tsx scripts/check-lockfile-registry.ts           # package-lock.json: all packages resolve from the public registry
npm test                                             # Test Suites: 244 passed, 244 total; Tests: 3406 passed, 3406 total
npx tsc --noEmit                                      # clean, no output
npm run build                                        # production build succeeded
npm run test:smoke                                    # 6 passed (Playwright e2e against production build)

Post-fix npm audit --package-lock-only --omit=dev: 0 vulnerabilities (down from 1 critical / 3 advisories). Remaining findings in the full (dev-included) audit are pre-existing dev-only tailwindcss migration items already tracked in #86/#87, untouched by this PR.

---

Generated by Claude Code