security: vulnerability remediation

[kernel-internal]

Vulnerability Remediation

This PR was generated by the Socket-centric vulnerability remediation workflow. Review the planned dependency changes and confirmation evidence before merging.

Fixed

CVE/GHSA	Package	Ecosystem	Old Version	New Version	Manifest	Confirmation
GHSA-4633-3j49-mh5q	next	None	16.2.6	16.2.11		confirmed

Not Included

• Deferred by batch limit: 69 advisories. They will be considered by future runs.
• Other deferred scanner findings: 311.
• Unconfirmed attempted fixes: 0.

Deferred details

CVE/GHSA	Package	Reason
Unavailable from detector	sharp-libvips-darwin-arm64	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	sharp-libvips-darwin-x64	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	sharp-libvips-linux-arm	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	sharp-libvips-linux-arm64	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	sharp-libvips-linux-ppc64	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	sharp-libvips-linux-riscv64	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	sharp-libvips-linux-s390x	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	sharp-libvips-linux-x64	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	sharp-libvips-linuxmusl-arm64	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	sharp-libvips-linuxmusl-x64	Non-CVE alert is not handled by dependency remediation.
...	...	301 additional items omitted from PR body. See workflow artifacts for full details.

---

Note

Low Risk
Patch-level Next.js upgrade with no app code changes; main residual risk is normal framework regression, so a quick build/test pass is enough before merge.

Overview
Security dependency bump for GHSA-4633-3j49-mh5q: next is raised from 16.2.6 to 16.2.11 in package.json (^16.2.11), with bun.lock updated so next, @next/env, and platform @next/swc-* binaries all resolve to 16.2.11.

No application or config source files change—only manifests and the lockfile. Other deferred scanner findings are out of scope for this PR.

^{Reviewed by Cursor Bugbot for commit d4d7b54. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
mcp	Ready	Preview	Aug 26, 2026 3:29am

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	next@​16.2.6 ⏵ 16.2.11		+40	+1

View full report

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want fixes drafted automatically? Bugbot Autofix can create code changes for findings. A team admin can enable Autofix in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit ca7ccd8. Configure here.}

[ulziibay-kernel]

Verified the bump against the advisory's first patched version; rebuilt on current main and confirmed the toolchain lock/build is clean. CI green.