[atahan150]

Fixes #117

A fresh npm install on master (v0.5.0) reports 10 vulnerabilities (1 low, 4 moderate, 4 high, 1 critical). This PR brings that to 0.

What changed

1. Next.js 16.3.0 → ^16.3.5 (next + eslint-config-next)

16.3.0 sits inside the vulnerable range 16.0.0 - 16.3.2:

• GHSA-p293-qw3h-jr36 — critical, unauthenticated RCE on Windows-hosted servers
• GHSA-2xp9-vwfh-vxw4 — critical, unauthenticated RCE in the Image Optimization API via AVIF

Because the version was pinned exactly, npm audit fix could not resolve this on its own — it only reported fix available via npm audit fix --force.

2. Lockfile refresh for the 9 transitive advisories

sharp, browserslist, js-yaml, fast-uri, qs, hono, postcss-selector-parser, baseline-browser-mapping, @humanfs/node — all resolved by a plain npm audit fix, no direct dependency changes needed.

Verification

• npm audit → found 0 vulnerabilities
• npm run check (lint + typecheck + build) → passes; builds clean on Next.js 16.3.5 (Turbopack), both static routes generated

Notes

• 16.3.0 → 16.3.5 is a patch-level bump, so no breaking changes are expected, and the full build confirms it.
• I switched the two pins from exact to caret (^16.3.5). If you'd rather keep them pinned exactly, say the word and I'll change them to 16.3.5 — happy either way. Keeping the caret does mean future patch-level security fixes land without a template release.
• This is unrelated to Bug: 'claude --chrome' skill fails to load after npm audit fix #22: that report was about npm audit fix pulling in unrelated dependency churn. Here the critical fix is a targeted patch bump of Next.js itself.

🤖 Generated with Claude Code

[JCodesMore]

Thanks @atahan150 for the report and proposed fix! Addressed in #119, keeping our existing exact-version pins. The dependency audit is clean and CI passed. Closing this as superseded, with credit included in the changelog.