[Snyk] Security upgrade next from 16.1.0 to 16.1.5

[SMSDAO]

Snyk has created this PR to fix 2 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• webapp/package.json
• webapp/package-lock.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Allocation of Resources Without Limits or Throttling SNYK-JS-NEXT-15104645	696
	Allocation of Resources Without Limits or Throttling SNYK-JS-NEXT-15105315	696

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Allocation of Resources Without Limits or Throttling

[railway-app]

🚅 Deployed to the reimagined-jupiter-pr-156 environment in gxq

Service	Status	Web	Updated (UTC)
reimagined-jupiter	❌ Build Failed (View Logs)		Jan 28, 2026 at 2:33 am

[github-actions]

⚠️ Railway Preview Deployment Skipped

Preview deployment was skipped because required secrets are not configured.

Required Secrets

Repository maintainers need to configure these secrets in repository settings:

• RAILWAY_TOKEN - Railway API authentication token
• RAILWAY_PROJECT_ID - Railway project ID (should be 2077acd9-f81f-47ba-b8c7-8bf6905f45fc)
• SOLANA_RPC_URL - Solana RPC endpoint URL
• WALLET_PRIVATE_KEY - Wallet private key (base58 format)
• ADMIN_USERNAME - Admin panel username
• ADMIN_PASSWORD - Admin panel password
• JWT_SECRET - JWT secret for authentication

How to Configure

1. Go to repository Settings → Secrets and variables → Actions
2. Add the required secrets
3. Re-run this workflow or push a new commit

For more information, see the Railway deployment documentation.

[Copilot]

Pull request overview

This is a Snyk-automated security update that upgrades Next.js from version 16.1.0 to 16.1.5 in the webapp frontend to address two high-severity vulnerabilities (SNYK-JS-NEXT-15104645 and SNYK-JS-NEXT-15105315). Both vulnerabilities relate to "Allocation of Resources Without Limits or Throttling" with a severity score of 696/1000. This is a patch version upgrade that maintains compatibility with the existing React 19.2.3 dependencies.

Changes:

• Upgraded Next.js package from 16.1.0 to 16.1.5
• Updated all related Next.js dependencies (@next/env and platform-specific @next/swc-* packages) to 16.1.5
• Security patch addresses resource allocation vulnerabilities

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File	Description
webapp/package.json	Updates next dependency version to 16.1.5
webapp/package-lock.json	Updates next and all Next.js-related package versions and integrity hashes to 16.1.5

Files not reviewed (1)

• webapp/package-lock.json: Language not supported

[Copilot]

There's an inconsistency in the version specifier for the Next.js package. In package.json, the version is specified as "16.1.5" (exact version without caret), but it should likely include the caret prefix "^16.1.5" to allow patch updates, which is consistent with how other dependencies are specified in this file and how it appears in the package-lock.json. This inconsistency may cause issues with dependency resolution.

Suggested change

	"next": "16.1.5",
	"next": "^16.1.5",