fix(security): patch Next.js ImageResponse advisory floor

[seonghobae]

Scope

Stacked follow-up to #1798 at 8b8d6a6d0bf73b0b4e2fc19e65709284a211e40b; the owner branch is preserved.

The primary advisory GHSA-vcvr-r3jv-pc5j affects Next.js >=16.2.0,<16.3.6. Pin Next.js and its ESLint config to 16.3.6 and regenerate the existing pnpm lock. No current next/og/ImageResponse usage was found; exploitability is not established.

Verification

• Security-floor regression fails on 16.3.3; both pin contracts pass on the candidate with warnings as errors.
• Ruff and git diff checks pass. Frozen pnpm 11.5.3 install succeeds in an isolated worktree.
• Trivy 0.74.0: both initial 16.3.3 manifests and candidate 16.3.6 manifests return zero findings under the same refreshed database. This proves a scanner coverage gap for this advisory, not that the initial version was patched. Database/metadata hashes are recorded in the doctoring file.
• Frontend lint/typecheck completed without diagnostics. The initial default-concurrency test run has 435 passes and two unchanged 5-second timeouts; the bounded two-worker repeat passes all 437 tests in 51 files without changing timeouts/assertions. Production build exited zero, including type checking and all 16 generated pages.
• Local Node 24.21.0 differs from the repository's 24.19.0 pin; pinned-node and protected hosted acceptance remain unverified.

No security exclusions or protected merge settings change.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Exact-head admission correction — 3fc5ebcbd22e24f05cfd978fbd22c2d8c16fb63a

Ready is review admission only. Fresh audit against base 8b8d6a6d0bf73b0b4e2fc19e65709284a211e40b found:

• no exact-head workflow runs

This PR is moved to Draft/Proposed until the causal owner repair is present on a successor exact head and re-audited. Queued/pending work is neither an additional blocker nor passing evidence. No Close, force push, destructive rebase, manual rerun, synthetic status/approval, merge, auto-merge, or bypass was performed.