[fabianzimber]

Summary

Lockfile-only remediation of the two web/ npm advisories that can be fixed without bumping next, typescript, or eslint and that are not already covered by the open Dependabot PRs (#32, #28, #29, #27, #26).

web/package.json is unchanged. Only web/package-lock.json moves.

What changed (lockfile only)

Package	From	To	Fixes
qs	6.15.1	6.16.0	GHSA-q8mj-m7cp-5q26 — qs.stringify DoS (moderate), via shadcn → @modelcontextprotocol/sdk → express → qs
@babel/core	7.29.0	7.29.7	GHSA-4x5r-pxfx-6jf8 — arbitrary file read via sourceMappingURL (low), via shadcn and eslint-config-next → eslint-plugin-react-hooks
@babel/* (14 transitive siblings: parser, traverse, types, generator, template, helpers, code-frame, compat-data, helper-*)	7.27.x–7.29.2	7.29.7 / 7.29.8	pulled forward inside the existing ^7 range by the @babel/core update
side-channel	1.1.0	1.1.1	transitive patch-level bump

Applied with npm update qs @babel/core --package-lock-only (no package.json edit, no lockfile hand-editing, no npm audit fix --force).

Vulnerability status — all 9

#	Vuln	Severity	Resolved here?	Why / who fixes it
1	qs (GHSA-q8mj-m7cp-5q26)	moderate	✅ Resolved	qs 6.15.1 → 6.16.0; in range of express's ^6.14.0
2	@babel/core (GHSA-4x5r-pxfx-6jf8)	low	✅ Resolved	@babel/core 7.29.0 → 7.29.7; in range of shadcn's ^7.28.0
3	next (aggregates postcss + sharp)	high	⛔ Deferred	Only fix is [email protected] → 16.3.3. That is a next bump — explicitly out of scope here. PR #32 / #28
4	postcss (4 advisories, <=8.5.22)	high	⛔ Deferred	Two copies: top-level (8.5.10, via @tailwindcss/postcss/shadcn) and nested next/node_modules/postcss pinned at 8.4.31 by [email protected]. Bumping the top-level copy alone does not clear the audit entry, and the nested pin cannot move without changing next. [email protected] pins [email protected], which clears both copies at once. PR #32 / #28
5	sharp (libvips CVE-2026-33327/33328/35590/35591)	high	⛔ Deferred	[email protected] is an optionalDependency of next at ^0.34.5; the fix needs 0.35.x, outside that range. Forcing it via overrides would swap a major version under next's image optimiser. [email protected] moves to sharp@^0.35.3. PR #32 / #28
6	brace-expansion (3 advisories, <=1.1.17 || 3.0.0–5.0.8)	high	⛔ Deferred — already fixed elsewhere	Fixable without a next bump, but PR #27 already does exactly this lockfile bump (1.1.14→1.1.18, 5.0.5→5.0.9). Not duplicated.
7	ip-address (GHSA-v2v4-37r5-5v8g, GHSA-mwp4-54f8-5fhr)	high	⛔ Deferred — already fixed elsewhere	Same: PR #26 bumps ip-address 10.1.0 → 10.7.0.
8	express-rate-limit (8.0.1–8.5.0)	moderate	⛔ Deferred — already fixed elsewhere	PR #26 bumps it 8.3.2 → 8.7.0 (also drops the vulnerable ip-address pin).
9	body-parser (GHSA-v422-hmwv-36x6)	low	⛔ Deferred — already fixed elsewhere	PR #29 bumps 2.2.2 → 2.3.0.

Net: 9 → 7 vulnerabilities. Merging this PR together with #32 (or #28), #29, #27 and #26 takes web/ to zero.

Verification (local, Node v26.7.0, npm 11.19.0)

Check	Command	Result
Clean install	npm ci	✅ exit 0 (only the 3 pre-existing install-scripts/allowScripts warnings for msw, sharp, unrs-resolver)
Lint	npm run lint	✅ exit 0, no output (ESLint 9.39.4 + eslint-config-next 16.3.1)
Typecheck	npm run typecheck (tsc --noEmit)	✅ exit 0, no output
Build	npm run build	✅ exit 0 — Next.js 16.2.11 (Turbopack), compiled in 1812ms, 12/12 static pages generated
Audit	npm audit	7 vulnerabilities (1 low, 1 moderate, 5 high, 0 critical) — down from 9 (2 low, 2 moderate, 5 high, 0 critical)

Constraint checks after the change, from web/package.json:

• next 16.2.11 (unchanged)
• typescript ^5 (unchanged)
• eslint ^9 (unchanged)
• web/package.json diff: none

Notes

• No npm audit fix --force was run.
• No AWS/Terraform operations were performed; this PR touches web/ only and does not affect the Terraform (format, validate) CI job.