Possible fix(deps): 15 vulnerable dependencies in package-lock.json

[begininvoke]

I think there may be a problem in typescript-recipes/parallel-vercel-template/package-lock.json around line 5015.

Next.js version 16.2.3 is below the fixed versions (15.5.16 and 16.2.5). When the Pages Router uses i18n and middleware/proxy‑based authorization, the unprefixed / _next/data/<buildId>/<page>.json requests bypass middleware, exposing SSR JSON of protected pages without authorization. This is a high‑risk issue that should be resolved by upgrading Next.js.

Something like this might fix it:

--- a/typescript-recipes/parallel-vercel-template/package.json
+++ b/typescript-recipes/parallel-vercel-template/package.json
@@ -7,7 +7,7 @@ "scripts": {
   "dependencies": {
-    "next": "^16.2.3",
+    "next": "^16.2.5",
     "react": "^18",
   }
}

For reference: rule CVE-2026-44573. Rated high.

I may be wrong about this one — closing it costs you nothing if so.

---

Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.