fix: apply Snyk vulnerability remediations for website dependencies

[randoneering]

Quick Summary

• Merged Snyk remediation updates to reduce known vulnerabilities in the website dependency set.
• Limited changes to dependency manifest files only, with no application logic changes.

Files Changed

• website/package.json
• website/package-lock.json

Validation

• Dependency updates were applied and lockfile regenerated consistently.
• No functional code paths were modified outside dependency metadata/resolution.

Summary by CodeRabbit

• Chores
  • Updated framework dependencies to the latest patch versions for improved stability.

[coderabbitai]

📝 Walkthrough

Walkthrough

Updated the Next.js dependency version in the website package configuration from version 16.1.6 to 16.1.7, representing a minor patch version increment.

Changes

Cohort / File(s)	Summary
Dependency Update website/package.json	Updated next dependency from ^16.1.6 to ^16.1.7

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Poem

🐰 A hop, skip, and version bump so fine,
Next.js now shines at point-one-seven line,
Dependencies dance, patches applied with care,
Forward we bound through the digital air! 🚀

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: applying Snyk vulnerability remediations to website dependencies, which aligns with the package.json version update from ^16.1.6 to ^16.1.7.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[greptile-apps]

Greptile Summary

This PR applies a Snyk-recommended security remediation by bumping next from 16.1.6 to 16.1.7 in the website's dependency manifest and lockfile. No application logic, configuration, or other dependencies were modified.

Key changes:

• next package upgraded from 16.1.6 → 16.1.7 in website/package.json
• Lockfile updated consistently for next and all 8 @next/swc-* platform-specific binary packages
• baseline-browser-mapping minimum constraint tightened from ^2.8.3 to ^2.9.19 (an upstream change in Next.js 16.1.7's own package.json; the resolved version in the lockfile is unchanged, as the existing resolution already satisfies the new constraint)

The update is minimal, targeted, and the package.json/package-lock.json pair is internally consistent — all version strings and integrity hashes align correctly across the lockfile entries.

Confidence Score: 5/5

Safe to merge — patch-level security bump with no functional code changes and a fully consistent lockfile.

The change is a single patch-level version bump of Next.js (16.1.6 → 16.1.7) applied exclusively to dependency manifest files. The lockfile is internally consistent with matching version strings and integrity hashes. No application logic was touched. No P0 or P1 issues found.

No files require special attention.

Important Files Changed

Filename	Overview
website/package.json	Bumps next dependency from ^16.1.6 to ^16.1.7 — a targeted patch-level security remediation with no other changes.
website/package-lock.json	Lockfile updated consistently — all @next/* platform binaries (9 packages) and the root next package bumped from 16.1.6 to 16.1.7, with baseline-browser-mapping minimum constraint tightened from ^2.8.3 to ^2.9.19 as part of the upstream Next.js release.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Snyk Vulnerability Report] --> B[Identify: next 16.1.6 vulnerable]
    B --> C[Bump next: 16.1.6 → 16.1.7]
    C --> D[Update package.json]
    C --> E[Regenerate package-lock.json]
    E --> F[next 16.1.7]
    E --> G["@next/env 16.1.7"]
    E --> H["@next/swc-* 16.1.7 x8 platforms"]
    E --> I["baseline-browser-mapping: ^2.8.3 → ^2.9.19 (constraint only)"]
    F & G & H & I --> J[Lockfile consistent ✓]

Loading

_{Reviews (1): Last reviewed commit: "Merge pull request #1 from randoneering/..." | Re-trigger Greptile}

[coderabbitai]

🧹 Nitpick comments (1)

website/package.json (1)

17-17: Consider updating eslint-config-next to ^16.1.7 for consistency with the upgraded next version.

Line 17 upgrades next to ^16.1.7, while Line 34 keeps eslint-config-next at ^16.1.6. Although 16.1.6 is explicitly compatible with 16.1.7 per official Next.js documentation, aligning the patch versions is a recommended best practice for toolchain consistency.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@website/package.json` at line 17, Update the package.json dependency
"eslint-config-next" to match the upgraded Next version by changing its version
specifier from "^16.1.6" to "^16.1.7" so the toolchain patch versions align with
the "next" dependency; locate the "next" and "eslint-config-next" entries in
package.json and update the "eslint-config-next" value accordingly, then run
your package manager install to verify compatibility.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@website/package.json`:
- Line 17: Update the package.json dependency "eslint-config-next" to match the
upgraded Next version by changing its version specifier from "^16.1.6" to
"^16.1.7" so the toolchain patch versions align with the "next" dependency;
locate the "next" and "eslint-config-next" entries in package.json and update
the "eslint-config-next" value accordingly, then run your package manager
install to verify compatibility.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 1b43fcd8-5056-4042-b078-e63372df38d0

📥 Commits

Reviewing files that changed from the base of the PR and between 60c1efb and a9134eb.

⛔ Files ignored due to path filters (1)

• website/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (1)

• website/package.json