[frano-m]

Closes #5002

What changed

• next, @next/mdx, @next/eslint-plugin-next and eslint-config-next: ^16 → ^16.4.3 in package.json; package-lock.json resolves all four (plus @next/env and the @next/swc-* binaries) to 16.4.3.
• npm audit fix (no --force): fast-uri 3.1.8 → 3.1.9 and zod → 4.6.7, clearing their moderate / high advisories.

Why

next 16.0.0–16.4.0 is affected by GHSA-2464-fhr4-w9xw (critical), GHSA-673q-mjm6-r5xr (critical) and GHSA-p3m5-59mp-jv5r (high). On 16.4.0, next dev prints a security notice and then exits with code 1, which is the "exited before serving a page" behaviour in the issue. On 16.4.3 all four site configs start normally.

Exposure of the deployed sites: next.config.mjs sets output: "export" (and images.unoptimized: true), so the deployed sites are static files with no Next server at runtime. The Image Optimization API, use cache functions and Server Actions the advisories describe are not running in production; the exposure was local dev and build machines.

Assumptions I made

• Latest patch, raised floor. Went to 16.4.3 (the latest 16.x, released 2026-10-23) rather than the 16.4.2 named in the issue, and raised the package.json floor to ^16.4.3 so the manifest itself cannot resolve to a vulnerable version.
• Generated files not committed. Next rewrites next-env.d.ts (16.4.3 adds a root-params.d.ts import, in an order that fails prettier-plugin-organize-imports) and tsconfig.json (16.4.0 does this too) during build/dev. Both are left as on main; expect them to show as modified after a local build.
• Remaining audit findings left alone. csv-parse, esbuild and @digitak/esrun need breaking upgrades (npm audit fix --force), so they are out of scope.
• Compatibility. findable-ui (next ^16), @mui/material-nextjs (^16), next-sitemap (any) and next-mdx-remote 6 (no Next peer) all accept 16.4.3; next-auth is not installed in this repo.
• Existing problems, not caused by this PR (reproduced on main / 16.4.0 or caused by the backend):
  • anvil-catalog dev detail pages (e.g. /data/consortia/CARD) throw TypeError: _jsx is not a function from next-mdx-remote. Production builds render all 170 pages fine.
  • lungmap dev index 404s because Azul dev no longer has the lm2 catalog (only dcp3, dcp3-it).
• Follow-up. .github/dependabot.yml points at the removed /spa directory, so the root manifest gets no Dependabot version PRs — tracked in Investigate dependabot config pointing at removed /spa directory #5006.

How to verify

1. git checkout frano-m/5002-next-security-upgrade && npm ci
2. npm ls next → a single next@16.4.3, deduped under findable-ui, @mui/material-nextjs and next-sitemap. npm audit → no next, fast-uri or zod entries.
3. For each of npm run dev:anvil-cmg, dev:hca-dcp, dev:anvil-catalog, dev:lungmap: the banner reads Next.js 16.4.3, there is no "affected by a known security vulnerability" notice, and the server stays up.
4. With each dev server running:
   • anvil-cmg — http://localhost:3000/datasets lists datasets; open one (e.g. ANVIL_1000G_2019_Dev) for the detail page; Sign In shows the Google sign-in card.
   • hca-dcp — http://localhost:3000/projects lists projects; open one for the detail page; Sign In shows the sign-in card.
   • anvil-catalog — http://localhost:3000/data/consortia lists consortia. Detail pages hit the _jsx dev error above (same on main); sign-in is disabled for this site.
   • lungmap — index shows the lm2 404 above (backend); sign-in is disabled for this site.
5. npm run lint (0 errors), npx tsc --noEmit, npx jest, and the production builds build-dev:anvil-catalog, build:anvil-cmg, build-ma-dev:hca-dcp, build-dev:lungmap all pass.

Definition of done from #5002:

• next and the @next/* / eslint-config-next packages are on a release that fixes the advisories (16.4.2 or later), and package-lock.json is updated. → steps 1–2
• next dev starts without the security notice for every site config (anvil-catalog, anvil-cmg, hca-dcp, lungmap). → step 3
• Lint, typecheck, unit tests and the production builds pass for every site config. → step 5
• Smoke check on dev: the index pages, detail pages and sign-in for each site. → step 4. Passes for anvil-cmg and hca-dcp; anvil-catalog detail and lungmap index are blocked by the problems listed above, which already exist on main.

🤖 Generated with Claude Code
🐦 Built with cc-claude-tools

[Copilot]

🟢 Approval recommended

The dependency updates are consistent across the manifest and lockfile, with no identified blocking issues.

No open issues 🎉

What changed in this PR

Updates the data browser’s Next.js dependencies to address the security upgrade requested in #5002, without changing application code.

Changes:

• Raises Next.js, MDX, and Next.js ESLint package minimums to ^16.4.3.
• Updates locked Next.js packages and platform binaries to 16.4.3, plus security-related updates to fast-uri and zod.

File	Description
package.json	Raises the minimum versions of four Next.js-related dependencies.
package-lock.json	Records updated dependency versions, integrity hashes, and matching Next.js binaries.

_{Review effort: Balanced}

[NoopDog]

Thanks Fran!