security: vulnerability remediation

[kernel-internal]

Vulnerability Remediation

This PR was generated by the Socket-centric vulnerability remediation workflow. Review the planned dependency changes and confirmation evidence before merging.

Fixed

CVE/GHSA	Package	Ecosystem	Old Version	New Version	Manifest	Confirmation
GHSA-vcvr-r3jv-pc5j	next	None	16.3.3	16.3.6		confirmed

Not Included

• Deferred by batch limit: 67 advisories. They will be considered by future runs.
• Other deferred scanner findings: 3.
• Unconfirmed attempted fixes: 0.

Deferred details

CVE/GHSA	Package	Reason
Unavailable from detector	next	Missing CVE/GHSA identifier required for Socket fix planning.
Unavailable from detector	proxy-addr	Missing CVE/GHSA identifier required for Socket fix planning.
Unavailable from detector	tar	Missing CVE/GHSA identifier required for Socket fix planning.

---

Note

Low Risk
Patch-level framework upgrade with no source edits; main risk is routine regression in build/runtime after a Next.js security release.

Overview
Bumps Next.js from 16.3.3 to 16.3.6 in package.json and refreshes bun.lock to address GHSA-vcvr-r3jv-pc5j. There are no application or config code changes—only the framework and its pinned @next/env / platform @next/swc-* binaries (and Next’s optional sharp range) move with the upgrade.

^{Reviewed by Cursor Bugbot for commit 443858e. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
mcp	Ready	Preview	Oct 7, 2026 3:22am UTC

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	next@​16.3.3 ⏵ 16.3.6		+75	+1

View full report

[ulziibay-kernel]

Diff is package.json + bun.lock only: next ^16.3.3 to ^16.3.6 (GHSA-vcvr-r3jv-pc5j) with matching @next/env and @next/swc platform binaries. No source changes; ci green. Approving.