fix(deps): resolve Snyk and npm audit vulnerabilities

[cs-raj]

Problem

A full dependency audit of main (Node v22.21.1, npm 10.9.4) found the following:

Snyk (snyk test) — 14 security issues

Severity	Count
Critical	2
High	7
Medium	5
Low	0

Plus 21 license-only findings (LGPL-3.0 notices on the optional @img/sharp-libvips-* platform binaries pulled in by next > sharp). These are informational and are not addressed here.

npm audit — 6 vulnerabilities (3 high, 3 moderate, 0 critical, 0 low)

Affected packages:

• undici@8.10.0 (via isomorphic-dompurify > jsdom) — 11 findings including 2 critical (Improper Certificate Validation, Origin Validation Error), 5 high, and 4 medium.
• sharp@0.35.3 (via next) — high-severity heap-based buffer overflow through bundled libheif (GHSA-g89c-p67h-r497, GHSA-2jg2-4ch7-h545). Also surfaced by npm audit as a high on next.
• qs@6.15.3 (via @contentstack/delivery-sdk > @contentstack/core) — 2 moderate findings (array-limit bypass / resource exhaustion, uncaught exception via attacker-controlled isBuffer).
• js-yaml@4.3.1 (dev-only, via @eslint/eslintrc) — high-severity CPU exhaustion because maxTotalMergeKeys does not limit work for empty merge sources.

Fix

All changes are confined to package.json (plus the regenerated package-lock.json). No source code was touched. Every upgrade stays within the existing major version — no major bumps.

Direct dependency upgrades

Package	Before	After
next	^16.2.12	^16.3.4
react	^19.2.8	^19.3.0
react-dom	^19.2.8	^19.3.0
eslint-config-next	^16.2.12	^16.3.4

Overrides for transitive dependencies

Package	Before	After	Why an override
qs	^6.15.3	^6.16.0	Nested under @contentstack/delivery-sdk, already at its latest (5.6.0); Snyk's only direct fix was a downgrade to delivery-sdk@5.1.1, a major regression.
sharp	0.35.3	0.35.4	Pinned transitively by next; patch-level fix.
undici	— (new)	^8.10.2	Nested under isomorphic-dompurify > jsdom. Snyk's suggested fix was isomorphic-dompurify@4.0.0, a major bump, so the override pins the patched undici instead.
js-yaml	— (new)	^4.3.2	Nested under @eslint/eslintrc (dev-only); staying on 4.x avoids the js-yaml 5.x major.

The repo's own version was bumped 1.2.3 → 1.2.4.

Results after a clean install (package-lock.json and node_modules deleted, single npm install)

Scan	Before	After
Snyk security issues	14 (C:2 H:7 M:5 L:0)	0
Snyk license-only findings	21	21 (unchanged, informational)
npm audit	6 (high:3 moderate:3)	0

npm run build (next build, Next.js 16.3.4 with Turbopack) passes: compiled successfully, TypeScript clean, all 5 static pages generated.

snyk code test was also run. It reports 4 open issues, but all of them point at file paths that do not exist in this repository (src/main.ts, scripts/db/migrations/...) — this repo's only sources are under app/, components/, and lib/. Those findings appear to come from a stale server-side project mapping rather than this working tree, so nothing here is actionable.

🤖 Generated with Claude Code

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[github-actions]

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Count (with fixes)	Without fixes	Threshold	Result
🔴 Critical Severity	0	0	10	✅ Passed
🟠 High Severity	0	0	25	✅ Passed
🟡 Medium Severity	0	21	500	✅ Passed
🔵 Low Severity	0	0	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	Breaches (with fixes)	Breaches (no fixes)	SLA Threshold (with/no fixes)	Status
🔴 Critical	0	0	15 / 30 days	✅ Passed
🟠 High	0	0	30 / 120 days	✅ Passed
🟡 Medium	0	0	90 / 365 days	✅ Passed
🔵 Low	0	0	180 / 365 days	✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

• Critical without fixes: 0
• High without fixes: 0
• Medium without fixes: 21
• Low without fixes: 0

✅ BUILD PASSED - All security checks passed

[amit-kanswal-cs]

LGTM