[AQIB-NAWAB]

Summary

Focused security upgrade for the frontend Next.js stack only. No open Dependabot/security upgrade PRs existed for this work (open PRs were feature branches only). GitHub Dependabot Alerts API returned 403 for this token, so versions and advisories were verified from frontend/package.json + lockfile, npm, and official Vercel/Next.js / GitHub Advisory sources.

Version changes

Package	Before	After
next	16.2.12 (pinned + lockfile)	16.4.5
eslint-config-next	16.2.12	16.4.5 (kept in lockstep)
sharp (transitive via Next image pipeline)	0.34.5	0.35.5 (≥0.35.5 required for image-opt RCE workaround/fix)

Only frontend/package.json and frontend/pnpm-lock.yaml changed.

Criticals addressed (verified)

Installed 16.2.12 is inside the affected ranges for these official advisories; 16.4.5 is the current Active LTS security release on npm.

1. GHSA-vcvr-r3jv-pc5j — Critical — RCE in Node.js next/og ImageResponse
   Affected: >=16.2.0 <16.3.6 · Patched: 16.3.6
   Sources: GHSA-vcvr-r3jv-pc5j · https://nextjs.org/blog/nextjs-security-update-september-22-2026

2. GHSA-673q-mjm6-r5xr — Critical — Unauthenticated RCE in use cache returning typed arrays
   Affected: >=16.0.0 <=16.4.0 · Patched: 16.4.1
   Sources: GHSA-673q-mjm6-r5xr · https://nextjs.org/blog/nextjs-security-update-october-14-2026

3. GHSA-2464-fhr4-w9xw / CVE-2026-96889 — Critical — Unauthenticated RCE in Image Optimization when SVG is involved (glibc Linux)
   Affected (16.x): >16.0.0 <=16.4.0 · Patched: 16.4.1 (pulls fixed sharp)
   Sources: GHSA-2464-fhr4-w9xw · https://nextjs.org/blog/nextjs-security-update-october-14-2026

Also covered by landing on 16.4.5 (November 2026 security release):

• GHSA-p3m5-59mp-jv5r — High — DoS via Server Actions (Oct 14 release / 16.4.1+) — https://nextjs.org/blog/nextjs-security-update-october-14-2026
• GHSA-mfr8-8qww-v76h — High — cross-tenant cache disclosure (unstable_cache + use cache) — https://nextjs.org/blog/november-2026-security-release
• November moderate set including GHSA-7qx7-33qx-rqx2 (SVG rejection bypass in image optimization), plus cache/shell/cookie issues listed in https://github.com/vercel/next.js/releases/tag/v16.4.5 and https://nextjs.org/blog/november-2026-security-release

Checks run (this branch)

Check	Result
pnpm typecheck (frontend)	Pass
pnpm lint (frontend)	Fail: 16 problems (10 errors, 6 warnings) — same count/signature on main with Next 16.2.12; CI already marks this step continue-on-error: true (“Pre-existing react-hooks lint findings”)
pnpm test (frontend)	Pass — 168 files / 4778 passed / 3 skipped
pnpm build (frontend)	Pass (production Next build + standalone prepare)
pnpm audit (frontend, after upgrade)	0 critical; remaining: 8 high / 12 moderate / 4 low (non-Next transitive: e.g. playwright, zod, undici, body-parser, systeminformation via other deps)

Remaining risks / out of scope

• Other Dependabot/transitive highs (playwright SSL verify, zod memory DoS, undici, body-parser, systeminformation, etc.) were not changed here to keep the PR minimal and avoid unrelated breakage.
• GitHub Dependabot alert inventory could not be enumerated via API (403 Resource not accessible by integration); treat remaining repo alert count as still needing a human pass in the Security tab after merge.
• Server pnpm audit --prod also showed 0 critical at time of check; no server dependency changes in this PR.
• Not merged, not deployed, no alerts dismissed.

Compatibility notes

• @sentry/nextjs peer range includes ^16; left unchanged at resolved 10.76.2.
• React remains 19.2.4.
• No app code / feature changes.