Possible fix(deps): 10 vulnerable dependencies in package-lock.json

[begininvoke]

I think there may be a problem in package-lock.json around line 8962.

The scanner correctly identified a real vulnerability in Next.js version 16.2.1. CVE‑2026‑44574 affects Next.js 15.4.0‑15.5.15 and 16.2.0‑16.2.4, where crafted query parameters can manipulate the dynamic route value seen by the page without changing the visible path. This allows protected routes to be rendered without passing the intended middleware authorization checks, leading to potential authorization bypass and exposure of sensitive content. The risk is high because an attacker can exploit this to access restricted pages, data, or functionality. Upgrading Next.js to a patched version (e.g., 16.2.5 or 15.5.16) resolves the issue by removing the flawed route resolution logic.

Something like this might fix it:

--- a/package.json
+++ b/package.json
@@ -1,4 +1,4 @@
 {
   "name": "my-app",
   "version": "0.1.0",
@@ -5,7 +5,7 @@
   "scripts": {
     "dev": "next dev",
     "build": "next build",
     "start": "next start"
   },
   "dependencies": {
-    "next": "16.2.1",
+    "next": "16.2.5",
     "react": "18.2.0",
     "react-dom": "18.2.0"
   },
   "devDependencies": {

For reference: rule CVE-2026-44574. Rated high.

I have not run the test suite here, so treat the suggestion as a starting point rather than something ready to merge.

---

Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.