[scttbnsn]

Patches the production dependency advisories that turned up in the local Qlty/osv pass. npm audit --omit=dev confirms them.

• next ^16.2.11 → ^16.4.3 (resolved 16.4.3). Fixes the critical Image Optimization SSRF and SSG/ISR cache poisoning advisories that affect 16.0.0 through 16.4.0. We serve next/image.
• dompurify 3.4.13 → 3.4.17, pulled in through posthog-js (critical). posthog-js itself stays pinned at 1.417.0.
• sharp 0.35.5, source-map-js 1.2.2, baseline-browser-mapping 2.11.32 and fflate 0.6.11 come from the same lockfile refresh.

Only frontend/package.json and the lockfile change. Locally after npm ci: lint, tsc, scene 12/12, PostHog contracts 30/30, support 9/9, next build and the browser boundary tests 9/9 all pass, and npm audit --omit=dev reports 0.

This goes to dev only. Promoting to main is a separate step.

Summary by CodeRabbit

• Chores
  • Updated the app’s underlying technology baseline. No user-facing changes to features, workflows, or the interface are reported.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
codeswhat-website	Ready	Preview	Oct 24, 2026 4:58pm UTC

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: CodesWhat/codeswhat.com
• Branch: fix/security-deps
• File: .coderabbit.yaml
• Commit: 8ef1e43
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 3df10b8a-13ee-4306-a3eb-33d479372aa1

Commits

Reviewing files that changed from the base of the PR and between cc9da03 and 8ef1e43.

Files ignored due to path filters: 1

• frontend/package-lock.json is excluded by !**/package-lock.json, !**/package-lock.json

Files selected for processing: 1

• frontend/package.json

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

Walkthrough

The frontend package manifest updates the Next.js dependency range from ^16.2.11 to ^16.4.3.

Changes

Frontend dependency update

Layer / File(s)	Summary
Update Next.js version range frontend/package.json	The Next.js dependency range changes from ^16.2.11 to ^16.4.3.

Priority: Normal

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Merge Risk: Minimal · up to 8ef1e

The dependency update is ready to merge with no identified blocking risk.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title accurately describes the dependency security updates. It names Next.js, DOMPurify, and Sharp advisories covered by the pull request objectives.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Warning

Some tools did not complete. Review the errors below.

🔧 Biome (2.5.15)

frontend/package.json

Biome could not lint this file: nested root configuration. Check the repository's Biome configuration and plugins.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[scttbnsn]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.