Upgrade Next.js to resolve npm audit vulnerabilities

[tom5610]

Summary

Running npm audit on the current repository reports two vulnerabilities:

• next@16.1.0: high severity, direct dependency
• postcss@8.4.31: moderate severity, transitive dependency under next

The audit recommendation is to upgrade Next.js. npm currently suggests next@16.2.10.

Current output

2 vulnerabilities (1 moderate, 1 high)

next  9.3.4-canary.0 - 16.3.0-canary.5
Severity: high
...
Depends on vulnerable versions of postcss
fix available via `npm audit fix --force`
Will install next@16.2.10, which is outside the stated dependency range
node_modules/next

postcss  <8.5.10
Severity: moderate
PostCSS has XSS via Unescaped </style> in its CSS Stringify Output - https://github.com/advisories/GHSA-qx2v-qp2m-jg93
fix available via `npm audit fix --force`
Will install next@16.2.10, which is outside the stated dependency range
node_modules/next/node_modules/postcss

Notes

• The vulnerable postcss copy appears to come from next, not from the top-level Tailwind/PostCSS dependency:

  agents.md@0.1.0
  ├─┬ @tailwindcss/postcss@4.1.11
  │ └── postcss@8.5.16
  └─┬ next@16.1.0
    └── postcss@8.4.31
  

• The app appears to be a small Pages Router site with minimal next.config.ts.

• I did not find middleware/proxy, rewrites, App Router, Server Actions, i18n, or remote image patterns in the current codebase, so several listed advisories may not be directly exploitable here.

• This is still worth tracking because next is a direct production dependency of a public web app.

Proposed fix

Upgrade Next.js to a patched version, update the relevant lockfile(s), and rerun npm audit.

The repository declares pnpm@9.15.1 in package.json, but both package-lock.json and pnpm-lock.yaml are present. The fix should clarify whether both lockfiles are intentionally maintained or whether one should be removed.