[reformedot]

Purpose

This PR closes Dependabot security alerts for SOC 2 compliance.
It upgrades next to the lowest patched version in the same major version.
The diff changes only the version spec and the lockfile.

Changes

Package	Path	Old -> New	Advisories closed
next	package.json, package-lock.json	16.3.3 -> 16.4.1	GHSA-2464-fhr4-w9xw, GHSA-673q-mjm6-r5xr, GHSA-vcvr-r3jv-pc5j (critical); GHSA-cjq9-62q9-8jv4, GHSA-p3m5-59mp-jv5r (high)

Patch and minor updates in rounds 3 to 5

These updates stay inside the existing version ranges and use the lowest fixed version per installed major line, unless a section below says otherwise. Changes in package.json are marked.

• package-lock.json: dompurify 3.4.14 -> 3.4.17; source-map-js 1.2.1 -> 1.2.2

Alert status

Computed on 2026-10-23 about 06:29 UTC. Closed counts: open Dependabot alerts (including package.json/pyproject.toml alerts whose lockfile is in this PR) that the branch no longer matches. An alert counts as closed only when no installed version in its manifest stays in the vulnerable range. Remaining alerts: every lockfile that this PR changes, plus any bun.lock/bun.lockb in the same folders, checked with OSV and GitHub severities; advisories published after 04:10 UTC are not included. The Advisories column counts critical and high advisories per installed version. Dependabot can show fewer alerts, because it has one alert per package and manifest, and some advisories have no Dependabot alert.

Open Dependabot alerts that this branch closes: 0 critical, 1 high, 0 medium, 0 low.

No critical or high alert remains in these lockfiles.

Local verification

• An earlier version of this PR also added typescript 7.0.2 as a devDependency. next build adds it by itself when typescript is missing. This PR no longer has that change: package.json changes only next. So the CI build job fails with "It looks like you're trying to use TypeScript but do not have the required package(s) installed". The main branch fails CI with the same error since 2026-08-27: the first failing run is https://github.com/browser-use/browser-agent-template/actions/runs/33027124296 (d217cef), and the run on the current main head aae9334 is https://github.com/browser-use/browser-agent-template/actions/runs/33280503230. Adding typescript as a devDependency fixes the build, in this PR or in a separate one.
• npm ci && npm run build: pass.
• npm run typecheck: pass.
• next 16.4.1 requires sharp ^0.35.5, so the lockfile also updates sharp 0.35.4 -> 0.35.5.

osv-scanner shows that all listed advisories are closed for package-lock.json.

🤖 Generated with Claude Code

[cubic-dev-ai]

No issues found across 2 files

_{View guided diff | Turn on auto-fix | Re-trigger cubic}