[JCodesMore]

Summary

Fixes #117. References #118; thanks to @atahan150 for reporting the vulnerabilities and proposing the update.

This is a maintainer-generated update from master, not a checkout or merge of the contributor branch.

• Pin next and eslint-config-next exactly to 16.3.5, preserving the existing version policy. Unlike a caret range, these pins do not permit future minor updates.
• Regenerate the lockfile using npm and resolve the remaining transitive advisories without --force.
• Credit the issue and proposed PR in the changelog.

Dependency review

Only package.json, package-lock.json, and CHANGELOG.md change. All resolved downloads use registry.npmjs.org; no new install hooks appear in the lockfile. The only added package is @humanfs/types, an upstream dependency of the updated HumanFS packages. No application code, workflow, or project script changes.

Verification

• npm ci --ignore-scripts: passed, 0 known vulnerabilities
• npm audit --omit=dev: 0 known vulnerabilities
• npm run check: lint, typecheck, and production build passed on Next.js 16.3.5
• git diff --check: passed

GitHub CI will also exercise the existing normal npm ci workflow. PR #118 is left open; this PR does not close it automatically.