[Snyk] Security upgrade next from 16.2.12 to 16.3.0

[peterj]

Snyk has created this PR to fix 3 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• ui/package.json
• ui/package-lock.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Directory Traversal SNYK-JS-POSTCSS-18512282	****
	Directory Traversal SNYK-JS-POSTCSS-18313036	506
	Directory Traversal SNYK-JS-POSTCSS-18313038	506

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Directory Traversal

[peterj]

This minor version upgrade from next@16.2.12 to next@16.3.0 is a feature-focused release with no documented breaking changes. The update concentrates on performance, developer experience, and AI integration.

Key Highlights:

• New Features: Introduces several additive and opt-in features, including "Instant Navigations" and "Partial Prefetching" to improve perceived performance, and enhanced support for AI coding assistants.
• Turbopack Improvements: Delivers significant performance and stability enhancements to the Turbopack bundler, focusing on reduced memory usage and faster build times.
• No Breaking Changes: The new navigation features are opt-in and gated behind feature flags, ensuring they do not impact existing applications by default. The release notes focus on new capabilities and performance gains rather than deprecations or required migrations.

Source: Next.js 16.3 Preview Release Notes.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[chromatic-com]

Warning

Testing paused

Monthly snapshot limit reached. Update your plan for additional snapshots and to resume testing.

[Copilot]

Pull request overview

Upgrades the UI’s Next.js dependency to address Snyk-reported vulnerabilities (notably in transitive postcss) by moving from next@16.2.12 to next@16.3.0.

Changes:

• Bump next from ^16.2.12 to ^16.3.0 in the UI package manifest.
• Update package-lock.json to reflect the new Next.js release and its transitive dependency updates (including postcss).

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File	Description
ui/package.json	Updates the declared Next.js dependency version.
ui/package-lock.json	Regenerates the lockfile for the Next.js upgrade and resulting transitive dependency changes.

Files not reviewed (1)

• ui/package-lock.json: Generated file

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.