Security: template ships Next.js 16.3.0, which has critical unauthenticated RCE advisories (10 vulns on fresh install)

Description

A fresh npm install on master (v0.5.0) reports 10 vulnerabilities (1 low, 4 moderate, 4 high, 1 critical).

The critical one comes from the pinned next version. package.json pins "next": "16.3.0" and "eslint-config-next": "16.3.0", which falls inside the vulnerable range 16.0.0 - 16.3.2:

• GHSA-p293-qw3h-jr36 — Unauthenticated Remote Code Execution on Windows-hosted servers
• GHSA-2xp9-vwfh-vxw4 — Unauthenticated Remote Code Execution in the Image Optimization API when AVIF files are used

Because the version is pinned exactly, npm audit fix cannot resolve it — it only reports fix available via npm audit fix --force / "Will install [email protected], which is outside the stated dependency range".

The remaining 9 advisories are transitive (sharp, browserslist, js-yaml, fast-uri, qs, hono, postcss-selector-parser, baseline-browser-mapping, @humanfs/node) and are all resolved by a plain npm audit fix plus a refreshed lockfile.

Steps to Reproduce

1. Use this template (or clone it) at master / v0.5.0
2. npm install
3. npm audit

Expected Behavior

A freshly generated project from the template starts with 0 known vulnerabilities, and in particular does not ship a Next.js version with a known unauthenticated RCE.

Actual Behavior

10 vulnerabilities (1 low, 4 moderate, 4 high, 1 critical)

next  16.0.0 - 16.3.2
Severity: critical
fix available via `npm audit fix --force`
Will install [email protected], which is outside the stated dependency range

Suggested Fix

Bump the two pins and refresh the lockfile:

-    "next": "16.3.0",
+    "next": "^16.3.5",
-    "eslint-config-next": "16.3.0",
+    "eslint-config-next": "^16.3.5",

then npm audit fix.

Verification

I applied exactly this on a copy of the template:

• npm audit → found 0 vulnerabilities
• npm run check (lint + typecheck + build) → passes, builds clean on Next.js 16.3.5 (Turbopack), both static routes generated

16.3.0 → 16.3.5 is a patch-level bump, so no breaking changes are expected. Note this is not the same situation as #22 — that report was about npm audit fix pulling in unrelated dependency changes; here the fix is a targeted patch bump of Next.js itself.

Happy to open a PR if that's useful.

Environment

• Node.js 24
• npm audit run against master @ d35c3aa (chore: release v0.5.0)