Bump the application-delivery lock to Next.js 16.3.6 for GHSA-vcvr-r3jv-pc5j

[seathatflowsinourveins]

Why

Next.js v16.3.6 fixes GHSA-vcvr-r3jv-pc5j (CVE-2026-94545). The advisory is critical: remote code execution in next/og ImageResponse, affecting >= 16.2.0 < 16.3.6. The release was published 2026-09-22T17:15:10Z at tag commit a758ffcf501f6f1ddb03175bd1033508424c261e and is not a prerelease. Because this is a security fix, it takes the urgent-fix exception instead of waiting out the 7-day cooldown.

Exposure. rg -n --hidden "next/og|ImageResponse|@vercel/og" over the whole repository returns no matches, and the same search in agent-ecosystem also finds nothing. The fixture's app/ serves a static icon.svg, so it never reached the vulnerable path. The bump takes the vulnerable package out of the lock.

What changed

• blueprints/convergence-practice/application-delivery/package.json: next 16.3.5 -> 16.3.6.

• pnpm-lock.yaml: regenerated with the fixture's own pnpm 12.4.2 (pnpm install --lockfile-only --ignore-scripts).

  • Only next, @next/env and the eight @next/swc-* entries change.
  • All ten integrity values equal registry.npmjs.org dist.integrity for 16.3.6.
  • next@16.3.6 declares the same dependency and peer ranges as 16.3.5.
  • npm publishes a SLSA v1 provenance attestation for it.

• history/recipe-revisions.json: keeps the 16.3.5 package.json and pnpm-lock.yaml under history/ with their receipt hashes, following the existing Makefile/serve.py pattern. It records the source review and the checks below. The README gets a short note.

• manifests/stack.json, the saturation-audit.json row and the catalogs/landscape/upstream-snapshot.json record move to 16.3.6 / a758ffc.

  • The snapshot record comes from a fresh run of the same four gh api endpoints.
  • The manifests/evidence.json hashes are updated.

• experiment.json (a recorded convergence experiment) bound pnpm-lock.yaml by path and hash, so validate_convergence --all-recorded failed once the lock moved. Its frozen_inputs.sources[4] now names the byte-identical retained history/pnpm-lock.0472177.yaml; the frozen hash and every other byte are unchanged. The original record is kept as history/experiment.json.0472177. Without a .json suffix it stays out of record discovery, like Makefile.cabbe2c. A new portability test checks that the path is the only change.

sources.json, receipt.json and freeze.json are unchanged. With experiment.json, they still describe the 2026-09-20 acceptance of 16.3.5.

Evidence (Mac arm64, Node 24.21.0, pnpm 12.4.2)

• pnpm install --frozen-lockfile --ignore-scripts: passed.
• pnpm peers check: no issues.
• pnpm typecheck: passed.
• NEXT_TELEMETRY_DISABLED=1 pnpm build: passed; 3 static routes.
• test_portability.py: 6 tests OK. It now also verifies the two new retained-file mappings and the relocated frozen input.
• These all pass: validate.py, host_receipts.py validate, validate_catalogs.py, validate_foundation.py, landscape.py, build_ecosystem.py --check, component_matrix.py --check, new_host_grand_list.py --check, build_verdicts.py --check, gap_crosswalk.py build --check, gap_wave_ledger.py --check, validate_convergence.py --all-recorded, audit_reports.py --check and evidence_manifest.py --check.
• python3 -m unittest: 5072 tests, 2 failures. Both also fail on unmodified main on this Mac, and both are local-environment issues:
  • the SIP llama-wrapper quoting test (Make the llama wrapper quoting test pass on SIP-enabled Macs (wrapper unaffected) #178);
  • the user-name token check on --record-host (Match the user name as a whole token in host_receipts.sanitize() #227).

Gaps

• The full make verify was not rerun at 16.3.6 (PostgreSQL build, API tests and the Playwright browser workflow). The 2026-09-20 receipt still qualifies 16.3.5 only.
• This PR leaves dagu in this repository's manifests/stack.json at 2.16.6. That pin is bound to VelaNext and other host evidence, and it lacks dagu v2.17.2's fix for secrets stored in plain text in step outputs (fix: mask secrets in stored step outputs dagucloud/dagu#2861). VelaNext is managed from its own sessions, so its owner re-qualifies it; this PR does not change it.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​next@​16.3.6

View full report