Current baseline
Stay on Next 16.3.4 and its matching lint configuration. This is the version in Application/package-lock.json.
npm install next@16.3.4 eslint-config-next@16.3.4Dependency transparency
Security
A lockfile-backed view of known dependency findings, optional runtime paths, and the exact upgrade choices available to Opus consumers.
0 high0 critical0 development
Application/package-lock.json
Current repository snapshot
npm reports no production vulnerabilities in this lockfile. Next.js 16.3.4 permits Sharp 0.35.4, which patches the optional image-processing advisories previously reported through 16.2.12.
Consumer choices
Current baseline and optional installs
Image optimisation runtime
If your deployment explicitly installs Sharp, pin a patched 0.35 release alongside Next 16.3.4. Next's optional range already permits Sharp 0.35.4.
npm install next@16.3.4 eslint-config-next@16.3.4 sharp@^0.35.4No native optional packages
Install with --omit=optional only if your runtime does not require the optional native image backend. Confirm image behaviour in your deployment target.
npm install --omit=optionalRecently addressed
Resolved findings
next
16.3.4Upgraded from 16.2.12. Optional Sharp range now permits 0.35.4.
GHSA-f88m-g3jw-g9cjsharp
0.35.4Patched optional image-processing dependency shipped with Next.js 16.3.4.
GHSA-f88m-g3jw-g9cjnanoid
3.3.18Updated through the PostCSS dependency chain.
GHSA-2v37-7h3g-55p8brace-expansion
1.1.18 / 5.0.9Development dependency paths are patched.
Three ReDoS advisoriesjs-yaml
4.3.1Development dependency path is patched.
GHSA-5p4m-2wfm-xmqjReproduce the result
Audit commands
Run these from Application. The first includes optional production dependencies; the second shows the required production graph only.
npm audit --omit=devnpm audit --omit=dev --omit=optional