[glen-84]

Summary

• Updates next from 16.3.3 to 16.3.6, with @next/mdx and eslint-config-next in lockstep, for GHSA-vcvr-r3jv-pc5j (critical). That advisory is remote code execution through attacker-controlled values rendered by the Node.js ImageResponse from next/og. The site renders its share cards with ImageResponse, but only at build time and only from titles authored in this repo. 16.3.7 is newer, and it clears the seven-day age gate on 2026-10-06.
• Re-resolves dompurify from 3.4.14 to 3.4.16 within mermaid's ^3.3.3 range, for GHSA-p98j-92pf-mc4p (low). Diagram rendering runs the DOMPurify copy bundled inside mermaid, so this clears the lockfile finding and changes nothing that runs.
• Both advisories were published on 2026-09-30 and are not in npm's audit feed yet. yarn npm audit reports neither of them, and the GitHub Advisory Database lists both.

Test plan

• yarn tsc --noEmit, yarn lint, and yarn build pass.
• All 222 share-card images in out/ are byte-identical to a build made before the bump.
• The home, docs, and pricing pages, served from the static export, produce screenshots byte-identical to production's, with no page errors.
• A GitHub Advisory Database query over every version in website/yarn.lock returns no advisories.

[Copilot]

Copilot review overview

🟢 Approval recommended

No unresolved blocking issues were identified, and the requested validation passes.

Review effort: Lite
Findings: None

What changed in this PR

Updates website dependencies to address Next.js and DOMPurify security advisories.

Changes:

• Upgrades Next.js packages from 16.3.3 to 16.3.6.
• Resolves DOMPurify to 3.4.16.
• Refreshes lockfile dependency metadata and checksums.

File	Description
website/​yarn.lock	Locks updated Next.js, DOMPurify, and related dependencies.
website/​package.json	Updates Next.js package versions.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.