[HIGH] Manual fix required: CVE-2026-44575 — lock regen timed out

[Pattern Security Automation (pattern-security-automation)]

⚠️ Security Alert: HIGH CVE Requires Manual Fix

This PR was opened by Pattern Security Automation. The version bump was prepared
automatically, but the lock file could not be regenerated because lock regen timed out.
CI will likely fail. This PR is a notification — please follow the steps below.

---

CVE Details

Field	Value
CVE	CVE-2026-44575
Severity	HIGH
Repository	patterninc/heimdall
Vulnerable package	next
Required fix version	16.2.5
Current version	^16.1.6
Dependency type	Direct
Language	javascript

Why Automated Fix Was Blocked

The pipeline bumped web/package.json successfully but could not regenerate
the lock file before the Lambda time limit:

timed out after 180s for patterninc/heimdall

Large modules or slow registry access can exceed the automated lock regen budget.
Please regenerate the lock file locally and push to this branch.

What This PR Contains

• web/package.json — updated to target 16.2.5
• No lock file update — CI will fail until you regenerate it manually

Steps to Fix

1. Check out this branch locally
2. Regenerate the lock file:
   • Go: go mod tidy
   • npm/yarn: npm install or yarn install
   • uv: uv lock
   • poetry: poetry lock
   • bundler: bundle update next
3. Commit the updated lock file to this branch and push — CI should then pass
4. Ping #wiz-alerts if you need help

References

• View in Wiz

Developer feedback

Was this automation helpful? Share feedback (takes ~1 min)

---

Auto-generated by Pattern Security Automation

[Copilot]

Pull request overview

This PR is a security-driven dependency update in the web/ app to remediate CVE-2026-44575 by bumping the direct next dependency to a patched release line.

Changes:

• Updates web/package.json to require next@^16.2.11.
• (As noted in the PR description) does not update the pnpm lockfile, so the change won’t be applied in CI/builds until lock regeneration is committed.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Pattern Security Automation (pattern-security-automation)]

Closing as duplicate of #128 — same package/manifest fix cluster.

Automated cleanup (duplicate_pr_cluster_cleanup). Canonical PR kept open for review.