[v-anumol-baby]

Summary

• Update Next.js from 16.3.0 to 16.3.3, the minimum patched version for the AVIF image-optimization and Windows-hosted server RCE alerts (Dependabot alerts 51 and 50).
• Retain the existing caret range (^16.3.3), with the lockfile resolving to 16.3.3; retain React 18 compatibility.

Fixes :

• https://github.com/github/codespaces-nextjs/security/dependabot/51
• https://github.com/github/codespaces-nextjs/security/dependabot/50

Validation

• npm ci passed.
• Production build and git diff --check passed.
• Homepage returned HTTP 200.
• Both targeted advisories are absent from npm audit;

[Copilot]

🔵 Needs a closer look

Human review is needed because the security-sensitive transitive updates could not be independently verified in the available environment.

No open issues 🎉

What changed in this PR

Updates the application’s Next.js dependency to address the two targeted security alerts while retaining React 18 compatibility and limiting changes to dependency files.

Changes:

• Raise Next.js from ^16.3.0 to ^16.3.3, resolving to 16.3.3.
• Refresh related Next.js binaries, Sharp/libvips packages, and supporting transitive dependencies.

File	Description
package.json	Raises the Next.js minimum patch version; leaves React dependencies unchanged.
package-lock.json	Records Next.js 16.3.3 and refreshed transitive dependency versions and integrity hashes.

_{Review effort: Max}

[biellage-collab]

Play machine, revert containedev.
ALL clear for do little.
Game Fortune Sant tropez