Release v0.5.7

.gitignore

@@ -14,6 +14,3 @@ node_modules/
 
 # claude code local settings (per-user, never commit)
 .claude/settings.local.json
-
-# internal planning notes — kept local, never shipped
-/wip/

CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## [v0.5.7] - 2026-10-01
+
+### Security
+
+- **Next.js 16.3.8**: the web app template requires `next` and `eslint-config-next` at `^16.3.8` and locks 16.3.8, past the critical remote-code-execution advisory in `next/og`'s `ImageResponse` that affects Next.js 16.2.0 through 16.3.5 (GHSA-vcvr-r3jv-pc5j). The template does not import `next/og`, but a project made from it inherits the lock and could. The lock also takes the patched `brace-expansion` and `fast-uri`, so `npm audit` reports nothing.
+
 ## [v0.5.6] - 2026-09-27
 
 ### Changed

VERSION

@@ -1 +1 @@
-0.5.6
+0.5.7

initializers/js/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pipelex/create-method-app",
-  "version": "0.5.6",
+  "version": "0.5.7",
   "description": "Start a Pipelex method app: npm create @pipelex/method-app@latest my-app -- --method <bundle | mt_… | address>",
   "keywords": [
     "pipelex",

webapp-js/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pipelex-method-webapp-js",
-  "version": "0.5.6",
+  "version": "0.5.7",
   "private": true,
   "description": "A Next.js app that runs MTHDS methods through the Pipelex API, with each method's input form and result view generated from its own contract.",
   "scripts": {
@@ -28,7 +28,7 @@
   "dependencies": {
     "@pipelex/mthds-form": "^0.10.0",
     "@pipelex/sdk": "^0.26.0",
-    "next": "^16.3.5",
+    "next": "^16.3.8",
     "react": "^19.2.4",
     "react-dom": "^19.2.4",
     "server-only": "^0.0.1",
@@ -45,7 +45,7 @@
     "@types/react-dom": "^19.2.3",
     "@vitejs/plugin-react": "^5.1.4",
     "eslint": "^9.39.2",
-    "eslint-config-next": "^16.3.5",
+    "eslint-config-next": "^16.3.8",
     "happy-dom": "^20.6.1",
     "husky": "^9.1.7",
     "lint-staged": "^16.2.7",