fix: resolve npm audit vulnerabilities

[willwashburn]

Summary

The dependency tree reported 20 vulnerable packages, including a critical Next.js advisory. Upgrade Next.js from 16.2.10 to 16.3.5 and fflate from 0.4.8 to 0.4.9, and refresh affected dependencies in the lockfile. The updated tree reports zero vulnerabilities.

Validation

• npm audit: 0 vulnerabilities
• npm ci --ignore-scripts: passed; subsequent audit also reports 0 vulnerabilities
• npm test: 168 tests passed across web and router
• npm --workspace router run typecheck: passed
• npm run build: passed TypeScript checks and generated 444 static pages
• git diff --check: passed

Existing peer-dependency warnings predate this change. No deployment or preview was run.

---

Note

Medium Risk
Next.js patch upgrade affects the entire web runtime and build; lockfile churn touches image processing (sharp) and Cloudflare dev tooling, so regressions are possible though the change is dependency-only with validation noted in the PR.

Overview
Addresses npm audit findings (including a critical Next.js advisory) by bumping direct dependencies and regenerating the lockfile.

Direct web changes: next 16.2.10 → 16.3.5 and fflate 0.4.8 → 0.4.9. No application source changes.

The lockfile also pulls in related upgrades used by the web build and Cloudflare tooling—e.g. sharp 0.35.x (stricter Node >=20.9.0), @next/swc binaries, tailwindcss 4.3.3, wrangler/miniflare/workerd for local Workers dev, and vitest/rolldown/vite dev transitive updates. @cloudflare/workers-types is no longer hoisted at the root; the router workspace keeps its own pinned types entry in the lockfile.

^{Reviewed by Cursor Bugbot for commit d73f1bc. Bugbot is set up for automated code reviews on this repo. Configure here.}

---

Summary by cubic

Resolves all 20 npm audit vulnerabilities in the dependency tree, including a critical Next.js advisory. Upgrades next from 16.2.10 to 16.3.5 and fflate from 0.4.8 to 0.4.9, and refreshes the lockfile.

Validation

• npm audit reports 0 vulnerabilities after npm ci.
• npm test passes 168 tests across web and router.
• Router typecheck, build, and git diff --check all pass.
• Existing peer-dependency warnings predate this change.

^{Written for commit d73f1bc. Summary will update on new commits.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-15T04:14:09.460155Z	d73f1bc	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 654b7df7-7c14-43fb-9613-8015e91fe63f

📥 Commits

Reviewing files that changed from the base of the PR and between 8b68368 and d73f1bc.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (1)

• web/package.json

---

📝 Walkthrough

Walkthrough

The web package manifest updates fflate from 0.4.8 to 0.4.9 and next from 16.2.10 to 16.3.5. Other listed dependencies remain unchanged.

Changes

Web dependency updates

Layer / File(s)	Summary
Manifest version update web/package.json	The manifest updates fflate and next. gray-matter and lucide-react remain unchanged.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/fix-npm-audit

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the package row
fflate hops one patch ahead
Next follows a newer trail
Gray matter stays in place
The manifest rests, neat and bright}

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Preview deployed!

Environment	URL
Web	https://9c91bfb4-agentrelay-web.agent-workforce.workers.dev

This is a Cloudflare Workers preview version of this PR's build.