feature/Webapp-js-next-1635-advisory · L-261001-8540e1
The web app template's lock resolved next 16.3.5, inside the range of the critical Next.js advisory GHSA-vcvr-r3jv-pc5j (remote code execution in next/og's ImageResponse, fixed in 16.3.6). The template does not import next/og, but every project made from it inherits the lock, so next and eslint-config-next move to ^16.3.8 and npm audit fix re-locks the transitive brace-expansion and fast-uri advisories, leaving npm audit clean.
Closes L-261001-8540e1
🤖 Generated with Claude Code
https://claude.ai/code/session_01PCf9tysTErgWaFcPZW1vPY
Summary by cubic
Bumps the web app template's next and eslint-config-next from 16.3.5 to ^16.3.8 to move past the critical advisory GHSA-vcvr-r3jv-pc5j (remote code execution in next/og's ImageResponse, fixed in 16.3.6). The template does not import next/og, but projects created from it inherit the lock and could. Also re-locks the transitive brace-expansion and fast-uri advisories so npm audit stays clean. Closes L-261001-8540e1.