[Snyk] Security upgrade next from 9.5.5 to 10.0.2

[amplience-snyk]

Snyk has created this PR to fix 2 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• package.json
• package-lock.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Infinite loop SNYK-JS-TAR-17909068	710
	Allocation of Resources Without Limits or Throttling SNYK-JS-TAR-17909152	710

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Allocation of Resources Without Limits or Throttling

[amplience-snyk]

The upgrade from Next.js v9 to v10 introduces several new features and a key behavioral change that requires verification.

While the official documentation states there are no breaking changes, routing is now case-sensitive by default. Developers should verify that the casing used in <Link> components matches the file names in the pages directory to prevent 404 errors.

Key New Features:

• Built-in Image Component (next/image): A new component for automatic image optimization, resizing, and format selection (e.g., WebP).
• Internationalized (i18n) Routing: Built-in support for subpath and domain routing to handle different locales.
• React 17 Support: Full compatibility with React 17 and its new JSX Transform without configuration changes.
• Automatic href Resolving: The as prop is no longer required on next/link for dynamic routes, simplifying link creation.

Recommendation: The primary action required is to audit internal links to ensure they use case-sensitive paths. While this is a minor version bump to 10.0.2, the core changes were introduced in 10.0.0.

Source: Next.js 10 Release Notes, Upgrading to Version 10 Guide

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[amplience-snyk]

⛔ Snyk checks have failed. 15 issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (15)
⛔	Open Source Security	1	8	6	0	15 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[orca-security-eu]

Orca Security Scan Summary

Status	Check	Issues by priority
Passed	Infrastructure as Code	0   0   0   0	View in Orca
Warning	OSS Licenses	0   0   0   0	View in Orca
Passed	SAST	0   0   0   0	View in Orca
Passed	Secrets	0   0   0   0	View in Orca
Warning	Vulnerabilities	8   0   0   0	View in Orca

☢️ The following Vulnerabilities (CVEs) have been detected

	PACKAGE	FILE	CVE ID	INSTALLED VERSION	FIXED VERSION
	ini	./package-lock.json	CVE-2020-7788	1.3.5	1.3.6	View in code
	next	./package-lock.json	CVE-2021-39178	10.0.2	11.1.1	View in code
	next	./package-lock.json	CVE-2026-44577	10.0.2	15.5.16, 16.2.5	View in code
	sharp	./package-lock.json	GHSA-54xq-cgqr-rpm3	0.26.2	0.32.6	View in code
	simple-get	./package-lock.json	CVE-2022-0355	3.1.0	4.0.1, 3.1.1, 2.8.2	View in code
	tar-fs	./package-lock.json	CVE-2024-12905	2.1.0	1.16.4, 2.1.2, 3.0.7	View in code
	tar-fs	./package-lock.json	CVE-2025-48387	2.1.0	1.16.5, 2.1.3, 3.0.9	View in code
	tar-fs	./package-lock.json	CVE-2025-59343	2.1.0	3.1.1, 2.1.4, 1.16.6	View in code

Note: The scan should have failed if no policies were configured in warn-only mode.