[Snyk] Security upgrade next from 15.3.4 to 15.3.6

[NaveenDA]

Snyk has created this PR to fix 1 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• package.json
• package-lock.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Arbitrary Code Injection SNYK-JS-NEXT-14173355	893

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Arbitrary Code Injection

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
shadcn-nextjs-dashboard	Ready	Preview	Comment	Dec 3, 2025 10:05pm

[Copilot]

Pull request overview

This is a security upgrade PR that updates the Next.js framework from version 15.3.4 to 15.3.6 to address a critical arbitrary code injection vulnerability (SNYK-JS-NEXT-14173355) with a severity score of 893/1000.

• Updates the main next package to version 15.3.6
• Updates the @next/env package to 15.3.6
• Updates all platform-specific SWC compilation packages to 15.3.5

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File	Description
package.json	Updates the Next.js dependency from 15.3.4 to 15.3.6 to fix the security vulnerability
package-lock.json	Updates all Next.js-related packages including the main package, environment package, and platform-specific SWC binaries to resolve dependency tree

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Version format inconsistency: In package.json, the next dependency is specified as "15.3.6" (without caret), but in package-lock.json it appears as "^15.3.6" (with caret). These should match for consistency. The package.json should typically use the caret prefix "^15.3.6" to allow patch updates, consistent with other dependencies in the file.

Suggested change

	"next": "15.3.6",
	"next": "^15.3.6",