fix(deps): upgrade Next.js to 16.3.3 for PROD-5209

[plural-copilot]

Summary

Updates the direct runtime Next.js dependency to the vendor-fixed Next 16 release for PROD-5209.

Security remediation

• GHSA-2xp9-vwfh-vxw4: mitigates the AVIF/libheif remote-code-execution exposure in affected Next.js image optimization paths.
• GHSA-p293-qw3h-jr36 / CVE-2026-75604: mitigates the affected Windows remote-code-execution exposure.

Dependency changes

• next: 16.2.11 → 16.3.3 (exact declaration and resolved lockfile version).
• @next/third-parties: 16.2.11 → 16.3.3 to remain aligned with the Next 16 release.
• Regenerated package-lock.json with npm 11.19.1 using npm; no integrity or resolution data was manually edited.
• The regenerated lockfile also aligns @next/env and all Next SWC platform packages to 16.3.3, and updates transitive @swc/helpers from 0.5.19 to 0.5.23.

AVIF assessment

next.config.ts contains no images, avif, webp, image loader, remote-pattern, or image-domain configuration, and no other relevant image configuration is present. No configuration change was made: upgrading to the vendor-fixed Next.js release is the required remediation, and AVIF was not disabled or otherwise altered as a workaround.

Validation

All commands passed in node:26-alpine3.24:

• npm ci --ignore-scripts
• npm run lint
• ./node_modules/.bin/next build
• npm ls next @next/third-parties --depth=0 (both resolve to 16.3.3)
• git diff --check

The production build exited successfully. It emitted two non-blocking Turbopack dynamic-filesystem tracing warnings for src/app/slice-library/page.tsx.

Plural Flow: marketing
Plural Preview: marketing

Fixes PROD-5209

[plural-copilot]

This PR was generated by the codex Plural Agent Runtime. Here's some useful information you might want to know to evaluate the ai's perfomance:

Name	Details
💬 Prompt	Remediate PROD-5209 in this repository and create exactly one PR....
🔗 Run history	View run history

[linear]

PROD-5209

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	next@​16.2.11 ⏵ 16.3.3	-2	+75	+1
	@​next/​third-parties@​16.2.11 ⏵ 16.3.3	+1		+1

View full report

[greptile-apps]

Confidence Score: 5/5

The dependency upgrade appears safe to merge, with aligned framework packages and no concrete regression identified.

Summary

• Aligns next, @next/third-parties, @next/env, and all Next SWC platform packages on 16.3.3.
• Updates Next.js’s resolved helper and optional image-processing dependency metadata.
• Preserves the repository’s existing safe PostCSS and Nanoid resolutions through its package override.
• No actionable correctness, compatibility, or repository-rule issue was identified.

_{Reviews (1) · Last reviewed commit: "fix(deps): upgrade next to 16.3.3"}

[plural-copilot]

✅ Deploy preview for marketing-pr-205 is ready!

Name	Details
⚡ Service	marketing-pr-205 (5 / 5 ready)
☁️ Cluster	plural (eks)
Commit sha	4d0a650
Plural URL	https://console.mgmt.plural.sh/cd/clusters/446acdef-8524-425a-a49f-5336a...
🔍 Logs URL	https://console.mgmt.plural.sh/cd/clusters/446acdef-8524-425a-a49f-5336a...
🌊 Flow URL	https://console.mgmt.plural.sh/flows/fbbadfa5-fa67-4c16-ab32-42dca133aa3...
Preview Link	Preview

---

You can learn more about preview environments and Plural Flows here

[michaeljguarino]

we should add a skill in this repo that any pr that needs e2e testing should include this annotation in the pr body:

Plural Flow: marketing
Plural Preview: marketing