fix(deps): next 16.3.3 — clears 2 critical unauthenticated RCE advisories

[AminDhouib]

Why

Two critical, unauthenticated RCE advisories in next were published after this
fleet's last green dependency audit. They were caught by GetItDone's Dependency Audit job and are fleet-wide, not GetItDone-specific.

GHSA	severity	package	affected	patched
GHSA-p293-qw3h-jr36	critical (CVSS 9.0)	next	>=16.0.0 <16.3.3	16.3.3
GHSA-2xp9-vwfh-vxw4	critical	next	>=16.0.0 <16.3.3	16.3.3
GHSA-rgj7-g3m4-5g8c	high	sharp	<0.35.4	0.35.4
GHSA-2883-xcg3-v3hh	high	js-yaml	>=3.0.0 <3.15.2	3.15.2

p293 is RCE on Windows-hosted servers; 2xp9 is RCE in the Image Optimization API when
AVIF files are used. Neither needs authentication.

What changed

Only package.json files and the lockfile. No workflow file, no source file.

file	package	before	after
apps/landing/package.json	next (dep)	16.2.11	16.3.3
apps/next-example/package.json	next (dep)	16.2.11	16.3.3
apps/playground/package.json	next (dep)	16.2.11	16.3.3
packages/next/package.json	next (devDep)	16.2.11	16.3.3
package.json	pnpm.overrides	—	js-yaml@3 → 3.15.2

• 16.2.11 → 16.3.3 is a minor bump, not a patch. There is no patched release in
  the 16.2 line; 16.3.3 is the smallest patched version anywhere in the 16 major.
• sharp needed no direct change. Nothing here declares it — it arrives under
  next, and next@16.3.3 resolves it to 0.35.4, which clears both sharp advisories
  as a side effect. Confirmed in the regenerated lockfile.
• js-yaml is transitive. The lockfile carried 3.14.1 and 3.14.2. Fixed with a
  version-scoped js-yaml@3 override pinned to 3.15.2, so the 3.x consumers stay
  inside their own major. A blanket js-yaml override would have dragged them onto
  4.x, which removed safeLoad/safeDump.

One thing deliberately NOT changed

packages/next/package.json declares "next": ">=15.0.0" as a peerDependency.
That range does admit vulnerable versions (15.0.0 through 15.5.23), but it is the
published contract of this package, not an installed version. Raising it to
>=15.5.24 would be a breaking change for every consumer on an older 15.x and would
not patch a single installed tree — the consumer's own lockfile decides that. Left
alone on purpose; flagging it here so the choice is visible rather than silent.

pnpm audit --prod before / after

Run with the repo's own package manager (packageManager: pnpm@10.11.0, via corepack).
Baseline from a pristine git worktree at base commit
813756ed7450bba117c87bb9bf47c2cc7584c674, so the runs differ only by this diff.

	low	moderate	high	critical	total
before	4	5	20	2	31
after	4	3	15	0	22

9 advisories cleared, 0 new, and the repo now has zero criticals in its production
tree.

CLEARED
  critical  next     GHSA-p293-qw3h-jr36, GHSA-2xp9-vwfh-vxw4
  high      sharp    GHSA-rgj7-g3m4-5g8c, GHSA-f88m-g3jw-g9cj
  high      js-yaml  GHSA-2883-xcg3-v3hh, GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj
  moderate  js-yaml  GHSA-h67p-54hq-rp68, GHSA-mh29-5h37-fv8m
NEW
  (none)

What was verified locally, and what was not

check	result
pnpm install --lockfile-only	clean
pnpm audit --prod before/after	table above
resolved versions read back from the lockfile	next 16.3.3, sharp 0.35.4, js-yaml 3.15.2 + 4.3.2
CR byte count on all 6 changed files	0 (byte-level check, not a shell grep)
git ls-files --eol on all 6 changed files	i/lf w/lf

turbo run typecheck and turbo run build were NOT run locally, and this is not a
claim that they pass. A full install of this workspace pulls the Storybook, Angular,
Vue and Svelte toolchains plus a patched @storybook/angular, which is not
reproducible on the machine this branch was prepared on. CI is the gate — please do
not merge on a red build.

Deployment note

upup is Dokploy-tracked with 5 deployed units, so this PR is deliberately not
being merged by automation — merging triggers a redeploy. Left for the owner's
review window.

[codesandbox]

Review or Edit in CodeSandbox

Open the branch in Web Editor • VS Code • Insiders

Open Preview