security: vulnerability remediation

[kernel-internal]

Vulnerability Remediation

This PR was generated by the Socket-centric vulnerability remediation workflow. Review the planned dependency changes and confirmation evidence before merging.

Fixed

CVE/GHSA	Package	Ecosystem	Old Version	New Version	Manifest	Confirmation
GHSA-2xp9-vwfh-vxw4	next	None	16.2.11	16.3.3		confirmed

Not Included

• Deferred by batch limit: 72 advisories. They will be considered by future runs.
• Other deferred scanner findings: 2.
• Unconfirmed attempted fixes: 0.

Deferred details

CVE/GHSA	Package	Reason
Unavailable from detector	next	Missing CVE/GHSA identifier required for Socket fix planning.
Unavailable from detector	tar	Missing CVE/GHSA identifier required for Socket fix planning.

---

Note

Medium Risk
Patches a known Next.js advisory but upgrades the full framework and image toolchain (sharp/SWC); regression risk is limited to build/runtime behavior, not app logic changes.

Overview
Bumps Next.js from 16.2.11 to 16.3.3 in package.json and refreshes bun.lock to address GHSA-2xp9-vwfh-vxw4. There are no application source changes—only dependency manifests.

The lockfile also picks up Next’s transitive updates: matching @next/env / @next/swc-* binaries, @swc/helpers 0.5.23, bundled postcss 8.5.23, and optional sharp 0.35.4 (including new wasm platform packages). Reviewers should run bun run build and smoke-test the Next app after merge.

^{Reviewed by Cursor Bugbot for commit ed6d70d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
mcp	Ready	Preview	Sep 9, 2026 3:19am UTC

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	next@​16.2.11 ⏵ 16.3.3	-2	+75	+1

View full report