Source: npx @rafinery/cli audit --json (rafa.audit/v1, run 2026-07-26), dependency tier —
tool osv-api+pnpm-audit (pnpm-lock.yaml). Machine-sourced; not re-guessed.
next is a direct dependency (chain.direct: true, path next@15.5.15) pinned exactly
at 15.5.15 (package.json:27, resolved at pnpm-lock.yaml:2816). Twenty-one advisories
resolve against that version. Priority is the mechanical map on the highest severity present:
. None are flagged .
The advisories, by shared fix
Highest CVSS in the set is 7.5 (e.g. GHSA-267c-6grr-h53f / CVE-2026-44575, App Router middleware bypass via segment-prefetch routes). One upgrade target — >= 16.2.11 — clears all twenty-one, which is why this is a single row rather than twenty-one.
Reachability — brain-grounded annotation (priority-neutral)
Annotation only; it informs triage and never downgrades the mapped priority.
So the honest picture: roughly half the set is inert against this app's current shape, and the rest (DoS, RSC cache poisoning, XSS in scripts, Server Function endpoint disclosure) is live on the one exposed route. The finding stands at P1 because the mechanical map says high -> P1 and because every "not reachable today" line above is one ordinary feature commit away from being reachable.
Effort note
This is the one row in the ledger that is deliberately not a 10-minute fix: 15 -> 16 is a
major. It is filed at effort: high so it is triaged as planned work rather than picked up
mid-task. If the major has to wait, the two transitive rows
(next-transitive-postcss-sharp-cves, copilotkit-runtime-transitive-cves) are the cheap
levers available in the meantime.