# next 16.2.6

The React Framework

Snapshot of gominimal/pkgs commit `cd4b09dd2f492c47fba70eb1b8a8c724dabdc7e9` (pushed 2026-07-10T23:16:55.000Z).

## Install

```sh
min add next
```

## Direct advisories

None at this commit.

## Transitive advisories

28 advisories inherited through runtime dependencies:

- CVE-2026-4046 (HIGH) via coreutils → glibc
- CVE-2026-4437 (HIGH) via coreutils → glibc
- CVE-2026-4438 (MEDIUM) via coreutils → glibc
- CVE-2026-5450 (CRITICAL) via coreutils → glibc
- CVE-2026-5928 (HIGH) via coreutils → glibc
- GHSA-q7rw-r7qq-2hx6 (UNKNOWN) via glib → pcre2
- OSV-2026-343 (HIGH) via glib → pcre2
- CVE-2026-45186 (LOW) via libvips → expat
- CVE-2026-50219 (MEDIUM) via libvips → expat
- CVE-2026-56131 (MEDIUM) via libvips → expat
- CVE-2026-56132 (MEDIUM) via libvips → expat
- CVE-2026-56403 (MEDIUM) via libvips → expat
- CVE-2026-56404 (MEDIUM) via libvips → expat
- CVE-2026-56405 (MEDIUM) via libvips → expat
- CVE-2026-56406 (MEDIUM) via libvips → expat
- CVE-2026-56407 (MEDIUM) via libvips → expat
- CVE-2026-56408 (MEDIUM) via libvips → expat
- CVE-2026-56409 (MEDIUM) via libvips → expat
- CVE-2026-56410 (MEDIUM) via libvips → expat
- CVE-2026-56411 (MEDIUM) via libvips → expat
- CVE-2026-56412 (MEDIUM) via libvips → expat
- CVE-2026-40930 (MEDIUM) via libvips → libpng
- CVE-2026-42798 (MEDIUM) via libvips → lcms2
- GHSA-p84g-9fv8-52qw (LOW) via node → lief
- CVE-2025-70873 (HIGH) via node → sqlite
- CVE-2026-11822 (HIGH) via node → sqlite
- CVE-2026-11824 (HIGH) via node → sqlite
- CVE-2026-58055 (MEDIUM) via node → nghttp2

## Dependencies

- Build (8): base, glib, make, node, pkgconf, pnpm, python, toolchain
- Runtime (4): coreutils, glib, libvips, node

## Scorecard

| Category | Score | Band |
| --- | --- | --- |
| supply-chain | 33 | low |
| advisories | 10 | low |
| quality | 48 | low |
| maintenance | 100 | perfect |
| licence | 100 | perfect |

## Links

- Homepage: https://nextjs.org
- Package page (HTML): https://minimal.dev/pkgs/next
- JSON API (floats latest): https://minimal.dev/api/pkgs/next.json
- SBOM (CycloneDX 1.5): https://minimal.dev/api/pkgs/next/sbom.json