fix: resolve all Dependabot security alerts

[CharanMN7]

Summary

Resolves all three open Dependabot alerts (and additional transitive advisories surfaced by npm audit) without breaking any existing functionality.

Before: 3 Dependabot alerts (1 high, 2 moderate) + additional Next.js CVEs
After: npm audit reports 0 vulnerabilities

---

What was vulnerable

Package	Severity	Installed	Patched	How it got in
sharp	High	0.34.5	≥ 0.35.0	Next.js optional dependency (image optimization)
postcss	High	8.4.31	≥ 8.5.18	Next.js pinned dependency
@hono/node-server	Moderate	1.19.14	≥ 2.0.5	@modelcontextprotocol/sdk (MCP server)

What each CVE means in practice

sharp — libvips vulnerabilities (CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591). Affects image processing of untrusted input via next/image.

postcss — Three separate issues:

• XSS via unescaped </style> in CSS stringify output (GHSA-qx2v-qp2m-jg93)
• Arbitrary file read via attacker-controlled sourceMappingURL (GHSA-6g55-p6wh-862q)
• Path traversal in source map auto-loading (GHSA-r28c-9q8g-f849)

Low practical risk for docs sites (no user-submitted CSS), but pinned to latest patched version regardless.

@hono/node-server — Windows-only path traversal in serve-static via encoded backslash (%5C). Relevant only if running the MCP server on Windows.

---

How we fixed it

1. Next.js patch bump (16.2.10 → 16.2.12)

Updated across all active workspaces (3 themes + 3 examples). Addresses multiple Next.js security advisories:

• Middleware/proxy bypass in App Router with Turbopack
• Server Action DoS and SSRF
• Cache confusion of response bodies
• Image optimization SVG DoS
• Unauthenticated Server Function endpoint disclosure

Archive templates left unchanged (not in workspaces, reference only).

2. npm overrides for transitive dependencies

Next.js 16.2.12 still bundles vulnerable postcss (8.4.31) and sharp (^0.34.5). The MCP SDK still depends on @hono/node-server ^1.19.9. Since upstream hasn't bumped these yet, we pin patched versions via root package.json overrides:

"overrides": {
  "next": {
    "postcss": "8.5.23",
    "sharp": "0.35.3"
  },
  "postcss": "8.5.23",
  "sharp": "0.35.3",
  "@modelcontextprotocol/sdk": {
    "@hono/node-server": "2.0.12"
  },
  "@hono/node-server": "2.0.12"
}

Nested overrides target next and @modelcontextprotocol/sdk specifically so the lockfile resolves patched versions throughout the entire workspace tree.

3. CI comment update

Removed the stale note in .github/workflows/ci.yml that said postcss was unfixable until a Next.js release — overrides now handle it.

---

Commits

Commit	What
chore: bump Next.js 16.2.10 → 16.2.12	Patch-level update across 6 active workspaces
fix: override transitive deps to resolve Dependabot alerts	npm overrides + regenerated lockfile
chore: update CI audit comment	Remove stale postcss acknowledgment

---

Verification

All CI-equivalent commands pass locally:

✓ npm run typecheck    — all 7 workspaces
✓ npm test             — 80/80 Vitest tests (framework)
✓ npm run build        — all 6 Next.js apps (themes + examples)
✓ npm audit --audit-level=high  — 0 vulnerabilities

Resolved versions in lockfile:

• [email protected] (was 0.34.5)
• [email protected] (was 8.4.31)
• @hono/[email protected] (was 1.19.14)

---

Follow-up (not in this PR)

These overrides can be removed once upstream packages ship patched versions:

• Next.js bumps its bundled postcss and sharp — watch for 16.2.13+
• @modelcontextprotocol/sdk depends on @hono/node-server@≥2.0.5 — watch for 1.30.0+

When that happens, drop the corresponding override entries and regenerate the lockfile.

Made with Cursor

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
framework-inkform-docs	Building	Preview, Comment	Jul 26, 2026 1:32pm
pokeapi	Building	Preview, Comment	Jul 26, 2026 1:32pm