fix(security): bump Next.js scaffolds to patched versions (PSIRT-1087)

[sanchitmehtagit]

Summary

Patches a critical Next.js security vulnerability by bumping the Next.js dependency in the two eval scaffolds that use it to patched releases. Both scaffolds are aligned on Next.js 16.

File	Before	After
quickstarts/nextjs/scaffold/package.json	16.2.7	^16.3.3
scaffolds/nextjs/auth0-mfa/package.json	^15.0.0	^16.3.3

These are the only Next.js usages in the repo. No lockfiles exist in these scaffolds, and no grader or PROMPT pins the version, so nothing else needed changing.

Compatibility

The auth0-mfa scaffold pairs Next.js with @auth0/nextjs-auth0@^4.0.0. The latest 4.x (4.27.0) declares a next peer-dependency range that includes ^16.0.10, so next@16.3.3 is officially supported — a fresh install produces no peer-dep warnings.

Context

• JIRA: PSIRT-1087
• Patched target versions: next@16.3.3 / next@15.5.24

Notes

These are eval fixture scaffolds (test inputs, never deployed), so real-world exposure is nil — this bump is a compliance / belt-and-suspenders remediation to raise the guaranteed minimum version.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 4d1fd9cd-24dd-4350-8264-0f7a6fdfc923

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}