[HIGH] Manual fix required: CVE-2026-44574 — lock regen timed out

[Pattern Security Automation (pattern-security-automation)]

⚠️ Security Alert: HIGH CVE Requires Manual Fix

This PR was opened by Pattern Security Automation. The version bump was prepared
automatically, but the lock file could not be regenerated because lock regen timed out.
CI will likely fail. This PR is a notification — please follow the steps below.

---

CVE Details

Field	Value
CVE	CVE-2026-44574
Severity	HIGH
Repository	patterninc/heimdall
Vulnerable package	next
Required fix version	16.2.5
Current version	^16.1.6
Dependency type	Direct
Language	javascript

Why Automated Fix Was Blocked

The pipeline bumped web/package.json successfully but could not regenerate
the lock file before the Lambda time limit:

timed out after 180s for patterninc/heimdall

Large modules or slow registry access can exceed the automated lock regen budget.
Please regenerate the lock file locally and push to this branch.

What This PR Contains

• web/package.json — updated to target 16.2.5
• No lock file update — CI will fail until you regenerate it manually

Steps to Fix

1. Check out this branch locally
2. Regenerate the lock file:
   • Go: go mod tidy
   • npm/yarn: npm install or yarn install
   • uv: uv lock
   • poetry: poetry lock
   • bundler: bundle update next
3. Commit the updated lock file to this branch and push — CI should then pass
4. Ping #wiz-alerts if you need help

References

• View in Wiz

Developer feedback

Was this automation helpful? Share feedback (takes ~1 min)

---

Auto-generated by Pattern Security Automation

[Copilot]

Pull request overview

This PR aims to remediate CVE-2026-44574 (HIGH) by updating the direct next dependency used by the web/ app. The change updates web/package.json, but the repo’s pnpm lockfile is not updated, so installs/CI will still resolve the older version until the lockfile is regenerated and committed.

Changes:

• Bumped next dependency in web/package.json from ^16.1.6 to ^16.2.11.
• (Missing in this PR) web/pnpm-lock.yaml still resolves next@16.1.6 and must be regenerated to complete the security fix.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.