fix: bump Next.js to 16.2.7 and resolve dependency vulnerabilities

[chapzin]

Summary

This PR resolves the dependency security vulnerabilities reported by npm audit, taking the template from 10 findings (3 high, 7 moderate) down to 2 moderate. The two remaining are inside Next.js's own bundled postcss and are not fixable without an upstream Next patch (details below).

The most important fix is the Next.js bump, since those are the only remotely-reachable vulnerabilities for anyone who deploys the template and serves traffic.

Changes

Change	Severity addressed	Why
next 16.2.1 → 16.2.7	HIGH	Fixes Server Component DoS, Middleware/Proxy bypass, cache poisoning, and CSP-nonce XSS advisories. These run on the server and are reachable by remote traffic on a deployed app.
eslint-config-next 16.2.1 → 16.2.7	—	Keeps it in lockstep with next, per Next.js convention.
npm audit fix (non-breaking)	moderate/high	Patches transitive deps: hono, @hono/node-server, fast-uri, ip-address, brace-expansion, qs.
Move shadcn to devDependencies	hygiene	See rationale below.

Why move shadcn to devDependencies?

shadcn is a build-only dependency here:

• src/app/globals.css does @import "shadcn/tailwind.css" — resolved at build time and inlined into the compiled CSS.
• The shadcn CLI itself is dev tooling (scaffolding components), not runtime code.

Keeping it in dependencies pulls a large server-side subtree (@modelcontextprotocol/sdk → express, hono, @hono/node-server, express-rate-limit; @dotenvx/dotenvx → eciesjs → @noble/ciphers) into production installs that use npm ci --omit=dev. None of that code is reachable at runtime in this template. Moving shadcn to devDependencies removes that subtree from production installs and correctly reflects that it is a build-time dependency. The production build is unaffected because the build step installs devDependencies.

Remaining findings (intentionally not "fixed")

Two moderate postcss findings remain in node_modules/next/node_modules/postcss — i.e. the postcss that Next.js bundles internally. They are left as-is because:

1. 16.2.7 is the latest patch in the 16.2 line; the fix has to come from an upstream Next.js release.
2. npm audit fix --force "resolves" this by downgrading Next to 9.3.3 — a massive breaking change and a net security regression. That is not acceptable.
3. The advisory (XSS via unescaped </style> in CSS stringify output) requires attacker-controlled CSS being stringified. In this template, CSS is author-controlled and processed at build time, so it is not practically exploitable.

Test plan

• npm run check (lint + typecheck + production build) passes
• Production build succeeds on Next.js 16.2.7 with Turbopack
• @import "shadcn/tailwind.css" still resolves with shadcn in devDependencies
• npm audit: 10 → 2 (only the upstream Next-bundled postcss remains)

Notes

• No breaking changes; all bumps are within-range patch updates.
• No application code changed — this is dependency hygiene only.

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Updates the Next.js toolchain versions and adjusts dependency classification for the shadcn CLI.

Changes:

• Bump next from 16.2.1 to 16.2.7
• Bump eslint-config-next from 16.2.1 to 16.2.7
• Move shadcn from dependencies to devDependencies