fix: remediate confirmed npm dependency alerts

[floreks]

Summary

• bump the confirmed direct remediation targets in package.json
• refresh package-lock.json with containerized npm
• validate install, audit, build, and lint in Docker

Dependency updates

• next 15.5.15 -> 15.5.16
• next-intl 4.9.2 -> 4.13.1
• concurrently 9.2.1 -> 9.2.3 (updates transitive shell-quote to 1.8.4)
• postcss 8.5.11 -> 8.5.12

Validation

• npm install --package-lock-only --ignore-scripts ✅
• npm ci --ignore-scripts ✅
• npm run build ✅
• npm run lint ✅
• npm audit ⚠️ residual issues remain

Residual alerts / risk

• npm audit still reports the current Next.js advisory for next because npm now marks versions <15.5.18 as vulnerable and suggests 15.5.20 as the non-breaking fix.
• npm audit also still reports transitive postcss under next/node_modules/postcss.
• Additional remaining alerts appear to be transitive or major-change items not confirmed safe within the provided scope, including form-data, @prismicio/api-renderer/uuid, and some Slice Machine/Prismic dev tooling advisories.

Existing PRs considered

• Considered prior partial remediation PRs #184, #188, and #190 as supersedable context; this PR consolidates the currently confirmed direct package bumps into one branch.

[floreks]

This PR was generated by the codex Plural Agent Runtime. Here's some useful information you might want to know to evaluate the ai's perfomance:

Name	Details
💬 Prompt	You are working only in the pluralsh/marketing repository....
🔗 Run history	View run history

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	next@​15.5.15 ⏵ 15.5.16		+55	+1
	postcss@​8.5.11 ⏵ 8.5.12	+1		+1	+1
	concurrently@​9.2.1 ⏵ 9.2.3				+1
	next-intl@​4.9.2 ⏵ 4.13.1	+1		+1	+1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm next is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → npm/[email protected] ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected]. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[greptile-apps]

Greptile Summary

This PR remediates confirmed npm dependency alerts by bumping four direct packages: next (15.5.15→15.5.16), next-intl (4.9.2→4.13.1), concurrently (9.2.1→9.2.3), and postcss (8.5.11→8.5.12), with the lock file regenerated in a containerised environment.

• concurrently bump pulls in shell-quote 1.8.4, resolving the targeted transitive CVE; the lock file confirms the updated version.
• Residual npm audit findings for next (needs ≥15.5.18) and a nested postcss under next/node_modules are explicitly called out in the PR description as out-of-scope for this batch.
• eslint-config-next remains at 15.5.15 while next moves to 15.5.16, creating a minor version skew between the two tightly-coupled packages.

Confidence Score: 4/5

Safe to merge; changes are confined to dependency version bumps validated through install, build, and lint steps.

All four bumped packages are straightforward patch/minor upgrades with no API-breaking changes observed in the lock file. The only notable gap is eslint-config-next remaining at 15.5.15 while next moves to 15.5.16 — a cosmetic misalignment that lint already passes through. The residual next advisory is acknowledged in the PR description as a known limitation of this batch.

package.json — the eslint-config-next version should be kept in sync with next.

Important Files Changed

Filename	Overview
package.json	Bumps next (15.5.15→15.5.16), next-intl (4.9.2→4.13.1), concurrently (9.2.1→9.2.3), and postcss (8.5.11→8.5.12); eslint-config-next is left at 15.5.15, mismatched with the new next version.
package-lock.json	Lock file regenerated to reflect the four bumped direct dependencies; transitive shell-quote is now at 1.8.4 (the targeted CVE fix), and @next/swc-* entries gain the new libc field introduced in this Next.js release.

_{Reviews (1): Last reviewed commit: "fix: remediate confirmed npm dependency ..." | Re-trigger Greptile}

[greptile-apps]

eslint-config-next is still pinned to 15.5.15 while next has been bumped to 15.5.16. These two packages are tightly coupled and are intended to be kept on the same version; a skew can cause the linter to reference rule sets and Next.js-specific checks that no longer match the runtime version. The PR confirms npm run lint passes today, but keeping them in sync avoids surprises on the next bump.

Suggested change

	"eslint-config-next": "15.5.15",
	"eslint-config-next": "15.5.16",