fix(KNO-15018, KNO-15006): upgrade Next.js and fast-uri

[kylemcd]

Description

These upgrades remove three exploitable security flaws from the docs site.

• Next.js 16.3.3 blocks Windows server RCE and AVIF image RCE
• fast-uri 3.1.6 blocks an SSRF filter bypass from repeated hostname percent-decoding
• stops tracking next-env.d.ts, which changes between next dev and next build

Tasks

• Closes KNO-15018
• Closes KNO-15006

[linear-code]

KNO-15018

KNO-15006

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview	Aug 27, 2026 8:23pm

[cursor]

Risk HIGH: Security patch upgrade bumping Next.js 16.2.11→16.3.3 and fast-uri 3.1.5→3.1.6, with regenerated lockfile and Next.js type declarations.

Reasons

• package.json is modified, triggering the dependency change HIGH risk rule
• yarn.lock has ~500 lines changed, triggering the lockfile HIGH risk rule
• Next.js minor upgrade pulls transitive updates (sharp, postcss, @swc/helpers, @next/swc-* binaries)
• next-env.d.ts updated with new root route parameter type imports from Next.js 16.3
• No documentation content changes; scope is limited to dependency and generated type files

Notes

• Verify Vercel preview build completes successfully and key pages render (MDX, API reference, search)
• Confirm no TypeScript build regressions from the updated next-env.d.ts route types
• Security fixes address Next.js RCE advisories (GHSA-p293-qw3h-jr36, GHSA-2xp9-vwfh-vxw4) and fast-uri SSRF bypass (GHSA-fph4-wmhf-6fwf)
• Author kylemcd is a known team member; not auto-approved due to HIGH risk classification

  

_{Sent by Cursor Automation: Docs PR classifier}