[HIGH] Manual fix required: CVE-2026-23869 — lock regen timed out

[Pattern Security Automation (pattern-security-automation)]

⚠️ Security Alert: HIGH CVE Requires Manual Fix

This PR was opened by Pattern Security Automation. The version bump was prepared
automatically, but the lock file could not be regenerated because lock regen timed out.
CI will likely fail. This PR is a notification — please follow the steps below.

---

CVE Details

Field	Value
CVE	CVE-2026-23869
Severity	HIGH
Repository	patterninc/heimdall
Vulnerable package	next
Required fix version	16.2.3
Current version	^16.1.6
Dependency type	Direct
Language	javascript

Why Automated Fix Was Blocked

The pipeline bumped web/package.json successfully but could not regenerate
the lock file before the Lambda time limit:

timed out after 180s for patterninc/heimdall

Large modules or slow registry access can exceed the automated lock regen budget.
Please regenerate the lock file locally and push to this branch.

What This PR Contains

• web/package.json — updated to target 16.2.3
• No lock file update — CI will fail until you regenerate it manually

Steps to Fix

1. Check out this branch locally
2. Regenerate the lock file:
   • Go: go mod tidy
   • npm/yarn: npm install or yarn install
   • uv: uv lock
   • poetry: poetry lock
   • bundler: bundle update next
3. Commit the updated lock file to this branch and push — CI should then pass
4. Ping #wiz-alerts if you need help

References

• View in Wiz

Developer feedback

Was this automation helpful? Share feedback (takes ~1 min)

---

Auto-generated by Pattern Security Automation

[Copilot]

Pull request overview

Updates the web app’s direct next dependency to address CVE-2026-23869. The automation notes that lockfile regeneration timed out; reviewing the repo state confirms the lock is still pinned to the old Next version and needs a manual update for CI and the security fix to be effective.

Changes:

• Bump next in web/package.json from ^16.1.6 to ^16.2.11.
• (Still needed) Regenerate and commit web/pnpm-lock.yaml so dependency resolution matches the updated manifest.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Pattern Security Automation (pattern-security-automation)]

Closing as duplicate of #128 — same package/manifest fix cluster.

Automated cleanup (duplicate_pr_cluster_cleanup). Canonical PR kept open for review.