Update Next.js to address critical security advisories

[phucnguyen1707]

Summary

• Raise the web Next.js minimum to 16.3.3 and lock the patched version, addressing GHSA-p293-qw3h-jr36 and GHSA-2xp9-vwfh-vxw4.
• Update only Next's required dependency graph and generated type reference; retain unrelated dependency resolutions.
• Independent of mobile Preserve mobile chat drafts and bound delivery waits #103. No mobile source, runtime policy, audit suppression, deployment or workflow changes.

Verification

• Clean frozen install; 885 web tests, 90 shared-types tests, web lint, cold typecheck without .next, full production web build.
• Eight isolated standalone HTTP/image checks, including PNG resizing, benign AVIF passthrough and rejected unallowlisted URLs.
• Subsequently installed the full workspace and passed the unchanged pre-commit hook: lint, types, formatting, workspace tests, script tests and builds. No hook bypass.
• The production critical audit command used by CI passes locally; Next critical findings reduced from 2 to 0.
• Exact final diff reviewed by Claude Opus; follow-up registry metadata, cold typecheck and standalone dependency-resolution checks passed before commit. Committed diff matches reviewed hash.

Remaining Limits

The audit is not clean: production still reports 58 high, 45 moderate and 7 low findings. Dev-inclusive audit includes 3 critical Vitest occurrences in unchanged tooling. No audit exclusions were added. Existing Serwist/Turbopack and middleware warnings remain.

No Windows exploit reproduction, live authenticated service test, physical-device test, EAS build or production deployment was performed. These are source/dependency fixes, not a blanket release approval. #103's existing failed CI run is not retroactively cleared; integrate the dependency fix and rerun its checks before release.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	next@​16.2.9 ⏵ 16.3.3	-2	+75	+1

View full report