chore: safe non-breaking dependency bumps (npm audit fix)

[shipdocs]

User description

Summary

• Ran npm audit fix (no --force, no major version bumps) — only package-lock.json changed, package.json untouched.
• Resolved 18 of 21 npm-audit-reported vulnerabilities (including the 1 critical), via safe transitive dependency bumps (e.g. next 15.5.9 → 15.5.21, plus various transitive package updates).
• 3 high-severity findings remain (postcss, sharp, bundled by an old next canary range) — the only fix npm audit offers for these is --force, which would downgrade next from 15.x to 9.3.3, a major breaking regression. Left untouched per "no risky/forced fixes" — needs manual/major-version review separately.
• Repo has 78 open dependabot alerts total (43 high, 30 moderate, 5 low); this PR only addresses what maps to safe, non-force npm audit fix output. Exact alert-to-fix mapping wasn't independently re-verified against the Dependabot alerts API (that endpoint returned malformed/non-JSON output in this session), but the npm audit before/after counts confirm real, non-breaking progress.

Test plan

• npm install — succeeds
• npm audit fix (no force) — applied, git diff confirms only package-lock.json touched
• No test script in package.json (not run)
• npm run build — fails, but with a pre-existing TypeScript error in app/api/ask/route.ts:60 (string | undefined not assignable to string | null) that is unrelated to this change: typescript version is unchanged (5.9.2 before and after) and the error is in application source, not a dependency. This appears to be a pre-existing break on main, worth a separate look.

---

CodeAnt-AI Description

Refresh locked dependencies to remove known security issues without changing app code

What Changed

• Updated the lockfile to pull in safe dependency fixes, including newer Next.js, sharp, MongoDB, webpack, and browser data packages.
• Removed several outdated transitive packages and replaced them with newer equivalents used by the same app features.
• Left the app’s source and package manifest unchanged, so this update only affects installed dependency versions.

Impact

✅ Fewer dependency security alerts
✅ Lower risk from vulnerable install-time packages
✅ Safer upgrades without app behavior changes

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

[codeant-ai]

🤖 CodeAnt AI — Review Status

Status	Commit	Started (UTC)	Finished (UTC)
✅ Reviewed your PR	e5bee9b	Jul 23, 2026 · 18:27	18:28

_{Updated in place by CodeAnt AI · last 5 reviews}

[codeant-ai]

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[qodo-code-review]

Qodo reviews are paused for this user.

Troubleshooting steps vary by plan Learn more →

On a Teams plan?
Reviews resume once this user has a paid seat and their Git account is linked in Qodo.
Link Git account →

Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center?
These require an Enterprise plan - Contact us
Contact us →

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 68a0cbdf-e6c2-4e4a-8006-9150444c92b9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch deps/dependabot-safe-fixes

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[augmentcode]

🤖 Augment PR Summary

Summary: Updates transitive npm dependencies via a safe, non-breaking npm audit fix to reduce reported security vulnerabilities.

Changes:

• Applied lockfile-only dependency bumps (package-lock.json), leaving package.json untouched.
• Upgraded next from 15.5.9 → 15.5.21 and refreshed related transitive packages.
• Reduced npm-audit findings by 18 (including clearing the previously reported critical).
• Left 3 high-severity findings unresolved because npm’s suggested fix requires --force and would downgrade next to 9.3.3 (breaking change).

Technical Notes: No major-version bumps were introduced; remaining vulnerabilities likely require a manual/major-version strategy. Build currently fails due to a pre-existing TypeScript type error noted in the PR description (not caused by the lockfile changes).

_{🤖 Was this summary useful? React with 👍 or 👎}

[augmentcode]

Review completed. No suggestions at this time.

Comment augment review to trigger a new review at any time.