[HIGH] Manual fix required: CVE-2026-44578 — lock regen timed out

[Pattern Security Automation (pattern-security-automation)]

⚠️ Security Alert: HIGH CVE Requires Manual Fix

This PR was opened by Pattern Security Automation. The version bump was prepared
automatically, but the lock file could not be regenerated because lock regen timed out.
CI will likely fail. This PR is a notification — please follow the steps below.

---

CVE Details

Field	Value
CVE	CVE-2026-44578
Severity	HIGH
Repository	patterninc/heimdall
Vulnerable package	next
Required fix version	16.2.5
Current version	^16.1.6
Dependency type	Direct
Language	javascript

Why Automated Fix Was Blocked

The pipeline bumped web/package.json successfully but could not regenerate
the lock file before the Lambda time limit:

timed out after 180s for patterninc/heimdall

Large modules or slow registry access can exceed the automated lock regen budget.
Please regenerate the lock file locally and push to this branch.

What This PR Contains

• web/package.json — updated to target 16.2.5
• No lock file update — CI will fail until you regenerate it manually

Steps to Fix

1. Check out this branch locally
2. Regenerate the lock file:
   • Go: go mod tidy
   • npm/yarn: npm install or yarn install
   • uv: uv lock
   • poetry: poetry lock
   • bundler: bundle update next
3. Commit the updated lock file to this branch and push — CI should then pass
4. Ping #wiz-alerts if you need help

References

• View in Wiz

Developer feedback

Was this automation helpful? Share feedback (takes ~1 min)

---

Auto-generated by Pattern Security Automation

[Copilot]

Pull request overview

This PR updates the web app’s direct next dependency in response to a high-severity CVE report, but it does not include the corresponding lockfile regeneration that’s required for the patched version to be installed in CI/production.

Changes:

• Bumped next in web/package.json from ^16.1.6 to ^16.2.11.
• (Missing for completion) Regenerate and commit the pnpm lockfile so the resolved next version is actually updated during installs.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Pattern Security Automation (pattern-security-automation)]

Closing as duplicate of #128 — same package/manifest fix cluster.

Automated cleanup (duplicate_pr_cluster_cleanup). Canonical PR kept open for review.