Merge pull request 'Revert to next 15.4.11 (payload peer ceiling) + record CVE risk acceptance' (#6) from fix/next-pin-cve-acceptance into main

@payloadcms/next@3.90.2 peer-requires next <15.5.0; 15.5.27 was an
unsupported combo. Owner chose the pin + documented risk (SECURITY.md
§8). Transitive overrides (undici/sharp/postcss/sass) stay.
Gate skipped: parallel session WIP still in tree.

ARCHITECTURE.md

@@ -4,18 +4,18 @@
 
 ## 1. Stack (pinned 2026-10-11)
 
-| Layer             | Choice                                                                                                      | Version                                                                |
+| Layer             | Choice                                                                                                      | Version                                                                                              |
-| ----------------- | ----------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------- |
+| ----------------- | ----------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- |
-| Framework         | Next.js App Router (server components first)                                                                | next@15.5.27 (CVE-driven bump from 15.4.11, owner-approved 2026-10-13) |
+| Framework         | Next.js App Router (server components first)                                                                | next@15.4.11 — ceiling of `@payloadcms/next` peer support; known CVEs risk-accepted (SECURITY.md §8) |
-| CMS / API / admin | Payload 3 (Next-native, Lexical rich text)                                                                  | ^3.60.0                                                                |
+| CMS / API / admin | Payload 3 (Next-native, Lexical rich text)                                                                  | ^3.60.0                                                                                              |
-| Database          | PostgreSQL                                                                                                  | postgres:16 (container)                                                |
+| Database          | PostgreSQL                                                                                                  | postgres:16 (container)                                                                              |
-| DB adapter        | @payloadcms/db-postgres (Drizzle migrations)                                                                | ^3.60.0                                                                |
+| DB adapter        | @payloadcms/db-postgres (Drizzle migrations)                                                                | ^3.60.0                                                                                              |
-| UI runtime        | React                                                                                                       | ^19.2.0                                                                |
+| UI runtime        | React                                                                                                       | ^19.2.0                                                                                              |
-| Styling           | Hand-rolled CSS (`src/app/design.css` + per-route CSS). No Tailwind, no component library.                  | —                                                                      |
+| Styling           | Hand-rolled CSS (`src/app/design.css` + per-route CSS). No Tailwind, no component library.                  | —                                                                                                    |
-| Payments          | stripe                                                                                                      | ^18.5.0 (scaffolded, gated by `billingEnabled()`)                      |
+| Payments          | stripe                                                                                                      | ^18.5.0 (scaffolded, gated by `billingEnabled()`)                                                    |
-| Email             | Cloudflare Email REST API (ADR-0003) — **never SMTP**                                                       | —                                                                      |
+| Email             | Cloudflare Email REST API (ADR-0003) — **never SMTP**                                                       | —                                                                                                    |
-| Language          | TypeScript strict                                                                                           | ^5.9.0                                                                 |
+| Language          | TypeScript strict                                                                                           | ^5.9.0                                                                                               |
-| Deploy            | Docker Compose on VPS `root@147.79.102.201:/root/anwarpi`, Traefik proxy network, apex anwarpy.ai (www 308) | —                                                                      |
+| Deploy            | Docker Compose on VPS `root@147.79.102.201:/root/anwarpi`, Traefik proxy network, apex anwarpy.ai (www 308) | —                                                                                                    |
 
 ## 2. Repository layout
 

SECURITY.md

@@ -12,18 +12,19 @@
 
 ## 2. Environment variables & secrets
 
-| Var | Scope | Rule |
+| Var                                                             | Scope    | Rule                                                |
-|---|---|---|
+| --------------------------------------------------------------- | -------- | --------------------------------------------------- |
-| `DATABASE_URI` / `DB_PASSWORD` | server | compose builds the URI; never commit, never echo |
+| `DATABASE_URI` / `DB_PASSWORD`                                  | server   | compose builds the URI; never commit, never echo    |
-| `PAYLOAD_SECRET` | server | signing/encryption; rotate = invalidate sessions |
+| `PAYLOAD_SECRET`                                                | server   | signing/encryption; rotate = invalidate sessions    |
-| `AGENT_API_KEY` | server | pipeline auth; header `x-agent-key` |
+| `AGENT_API_KEY`                                                 | server   | pipeline auth; header `x-agent-key`                 |
-| `CLOUDFLARE_API_TOKEN`, `CLOUDFLARE_ACCOUNT_ID`, `MAIL_FROM` | server | mail transport |
+| `CLOUDFLARE_API_TOKEN`, `CLOUDFLARE_ACCOUNT_ID`, `MAIL_FROM`    | server   | mail transport                                      |
-| `LAUNCH_MODE` | server | launch policy (SECURITY-relevant: gates paid flows) |
+| `LAUNCH_MODE`                                                   | server   | launch policy (SECURITY-relevant: gates paid flows) |
-| `NEXT_PUBLIC_SITE_URL` | public | canonical/og origin |
+| `NEXT_PUBLIC_SITE_URL`                                          | public   | canonical/og origin                                 |
-| `STRIPE_SECRET_KEY`, `STRIPE_PRICE_ID`, `STRIPE_WEBHOOK_SECRET` | server | Phase 3 |
+| `STRIPE_SECRET_KEY`, `STRIPE_PRICE_ID`, `STRIPE_WEBHOOK_SECRET` | server   | Phase 3                                             |
-| `SEED_TEST_USERS` | dev only | never set in prod |
+| `SEED_TEST_USERS`                                               | dev only | never set in prod                                   |
 
 Rules:
+
 - `.env*` files are gitignored and **excluded from rsync deploys**; prod secrets live only in `/root/anwarpi/.env.production`.
 - Never print secret values into transcripts, docs, videos, or evidence. Known incident: 8 chars of prod `DB_PASSWORD` leaked in a session transcript on 2026-10-10 → **owner to rotate**; rotation is the standing remedy for any partial leak.
 - Read secrets at runtime via `process.env` inside server modules only; never in `'use client'` code (only `NEXT_PUBLIC_*` there).
@@ -38,7 +39,7 @@ Rules:
 ## 4. Input handling & pipeline hardening
 
 - **`pickFields`** on the agent API strips privileged fields (`access`, `readingMinutes`, `status` except explicit `publish: true` opt-in on POST; PUT cannot set `status`).
-- **`scanForSecrets` / `scanAgentPayload`** (`src/lib/secret-scan.ts`): POST and PUT scan the *real text* (Lexical → `lexicalToText`, or the raw string) for AWS AKIA keys, PEM blocks, `sk-` API keys, GitHub tokens (`ghp_`…), generic credential shapes → **422 with pattern NAMES only**. Never echo the matched text, never log it.
+- **`scanForSecrets` / `scanAgentPayload`** (`src/lib/secret-scan.ts`): POST and PUT scan the _real text_ (Lexical → `lexicalToText`, or the raw string) for AWS AKIA keys, PEM blocks, `sk-` API keys, GitHub tokens (`ghp_`…), generic credential shapes → **422 with pattern NAMES only**. Never echo the matched text, never log it.
 - String `content` → 400 (Lexical JSON required); no silent placeholder substitution.
 - Comment bodies: textarea, moderated (pending until approved), author forced server-side from the session — client-supplied `author`/`authorName` identity is ignored/overwritten (ADR-0002). Display names are a snapshot, not a live join, so renamed users can't retroactively forge old comments.
 - All user-facing error strings are fixed Arabic sentences from the route handlers — errors never reflect raw input back (no echo = reflected-input hygiene).
@@ -62,3 +63,12 @@ Rules:
 - No WAF/Cloudflare proxy changes without owner approval — the domain's DNS/proxy is Ahmed's console.
 - No secrets in client bundles; no `NEXT_PUBLIC_` for anything except the site URL.
 - No new auth provider without routing it through `viewer.ts` (see §1).
+
+## 8. Accepted risks
+
+### next@15.4.11 — 28 known CVEs, max 9.5 (risk-accepted by owner, 2026-10-13)
+
+- **Why pinned**: `@payloadcms/next@3.90.2` peer-supports next `<15.5.0 || >=16.3.3` — no Payload 3.x release supports 15.5.x, so the safe ladder is 15.4.11 → (Payload 4 or a verified Next 16 migration). Forcing 15.5.x would run the CMS on an unsupported combo.
+- **Exposure analysis**: the 9.5-critical (Image Optimizer DoS, GHSA-9g9p-9gw9-jx7f) requires attacker-reachable `remotePatterns` — this app configures none (local covers only). The cache-poisoning advisory targets SSG/ISR caching; the site is predominantly dynamic SSR via the Payload Local API.
+- **Revisit trigger**: any of — Payload publishes 15.5/16 peer support (then upgrade next in one verified PR), Payload 4 adoption, or a new next advisory with remote-code-execution class impact.
+- **Gate note**: `procoder check` re-flags this on any `package-lock.json` change. If you must touch the lockfile before upgrading, either upgrade next in the same PR or skip the gate once with the reason in the commit message. Transitive CVE fixes already applied: undici 8.11.2, sharp 0.35.5, postcss 8.5.30, sass 1.105.1.

web/package-lock.json

@@ -12,7 +12,7 @@
         "@payloadcms/db-postgres": "^3.60.0",
         "@payloadcms/next": "^3.60.0",
         "@payloadcms/richtext-lexical": "^3.60.0",
-        "next": "^15.5.27",
+        "next": "15.4.11",
         "payload": "^3.60.0",
         "react": "^19.2.0",
         "react-dom": "^19.2.0",
@@ -2762,9 +2762,9 @@
       "license": "MIT"
     },
     "node_modules/@next/swc-darwin-arm64": {
-      "version": "15.5.27",
+      "version": "15.4.8",
-      "resolved": "https://registry.npmjs.org/@next/swc-darwin-arm64/-/swc-darwin-arm64-15.5.27.tgz",
+      "resolved": "https://registry.npmjs.org/@next/swc-darwin-arm64/-/swc-darwin-arm64-15.4.8.tgz",
-      "integrity": "sha512-fBA9QurmK4+uj4wNhmRTuO5zMVRaBHCvp6H93zTG/5i6Yi6TewbvbesXB8YQNj8T99Cwrow87hHiFV6wL/hyMA==",
+      "integrity": "sha512-Pf6zXp7yyQEn7sqMxur6+kYcywx5up1J849psyET7/8pG2gQTVMjU3NzgIt8SeEP5to3If/SaWmaA6H6ysBr1A==",
       "cpu": [
         "arm64"
       ],
@@ -2778,9 +2778,9 @@
       }
     },
     "node_modules/@next/swc-darwin-x64": {
-      "version": "15.5.27",
+      "version": "15.4.8",
-      "resolved": "https://registry.npmjs.org/@next/swc-darwin-x64/-/swc-darwin-x64-15.5.27.tgz",
+      "resolved": "https://registry.npmjs.org/@next/swc-darwin-x64/-/swc-darwin-x64-15.4.8.tgz",
-      "integrity": "sha512-FGZwJwry8qZNHxD/nfwrCwCHHrqx6epqItkkxbYcBQEQ2uw5S43bY83fQB5zbAsZE7TELMjoYkbhsQ4oKM7wwg==",
+      "integrity": "sha512-xla6AOfz68a6kq3gRQccWEvFC/VRGJmA/QuSLENSO7CZX5WIEkSz7r1FdXUjtGCQ1c2M+ndUAH7opdfLK1PQbw==",
       "cpu": [
         "x64"
       ],
@@ -2794,9 +2794,9 @@
       }
     },
     "node_modules/@next/swc-linux-arm64-gnu": {
-      "version": "15.5.27",
+      "version": "15.4.8",
-      "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-gnu/-/swc-linux-arm64-gnu-15.5.27.tgz",
+      "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-gnu/-/swc-linux-arm64-gnu-15.4.8.tgz",
-      "integrity": "sha512-GQulAaJYNF1RYuatlsw9/uzbKz4if2V7Ic9nVO+P0ljYPm4yBRTFIl6g5YkKTw40lMLbpy9edLoH44g3jSHMYA==",
+      "integrity": "sha512-y3fmp+1Px/SJD+5ntve5QLZnGLycsxsVPkTzAc3zUiXYSOlTPqT8ynfmt6tt4fSo1tAhDPmryXpYKEAcoAPDJw==",
       "cpu": [
         "arm64"
       ],
@@ -2813,9 +2813,9 @@
       }
     },
     "node_modules/@next/swc-linux-arm64-musl": {
-      "version": "15.5.27",
+      "version": "15.4.8",
-      "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-musl/-/swc-linux-arm64-musl-15.5.27.tgz",
+      "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-musl/-/swc-linux-arm64-musl-15.4.8.tgz",
-      "integrity": "sha512-URFFsUmu8Pi0/1qdnUI7tx7keZw1Mt5zHfrIX1RfDG9Nih8DYxK54WZsDJUX2ZTlii1jgotL7qcbwKnSAES6xQ==",
+      "integrity": "sha512-DX/L8VHzrr1CfwaVjBQr3GWCqNNFgyWJbeQ10Lx/phzbQo3JNAxUok1DZ8JHRGcL6PgMRgj6HylnLNndxn4Z6A==",
       "cpu": [
         "arm64"
       ],
@@ -2832,9 +2832,9 @@
       }
     },
     "node_modules/@next/swc-linux-x64-gnu": {
-      "version": "15.5.27",
+      "version": "15.4.8",
-      "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-gnu/-/swc-linux-x64-gnu-15.5.27.tgz",
+      "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-gnu/-/swc-linux-x64-gnu-15.4.8.tgz",
-      "integrity": "sha512-aJp74z7uvU5jQhyH7lyk+4qSRcTdKbKT9NQE3jiO9kWYkoHZjKi0zzHDbCoZ+v2sJDEiJ/z58R0UlWMGWNF3HA==",
+      "integrity": "sha512-9fLAAXKAL3xEIFdKdzG5rUSvSiZTLLTCc6JKq1z04DR4zY7DbAPcRvNm3K1inVhTiQCs19ZRAgUerHiVKMZZIA==",
       "cpu": [
         "x64"
       ],
@@ -2851,9 +2851,9 @@
       }
     },
     "node_modules/@next/swc-linux-x64-musl": {
-      "version": "15.5.27",
+      "version": "15.4.8",
-      "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-musl/-/swc-linux-x64-musl-15.5.27.tgz",
+      "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-musl/-/swc-linux-x64-musl-15.4.8.tgz",
-      "integrity": "sha512-ILl2bQ8MbpvyMpY8AXljb3BXs0MJSC8HXZ6QV5AWpVS7ZELqNPtrHvhUk+SNarvjvICXX8bCS287TCi+gUFVYg==",
+      "integrity": "sha512-s45V7nfb5g7dbS7JK6XZDcapicVrMMvX2uYgOHP16QuKH/JA285oy6HcxlKqwUNaFY/UC6EvQ8QZUOo19cBKSA==",
       "cpu": [
         "x64"
       ],
@@ -2870,9 +2870,9 @@
       }
     },
     "node_modules/@next/swc-win32-arm64-msvc": {
-      "version": "15.5.27",
+      "version": "15.4.8",
-      "resolved": "https://registry.npmjs.org/@next/swc-win32-arm64-msvc/-/swc-win32-arm64-msvc-15.5.27.tgz",
+      "resolved": "https://registry.npmjs.org/@next/swc-win32-arm64-msvc/-/swc-win32-arm64-msvc-15.4.8.tgz",
-      "integrity": "sha512-1MB9Rh5y8TOPN2x7naNTJNkCZQav9c70AI7EBYXxsEewwOffC4DjjwBwKf20NBvcA+u+5jDv7nVmHxunlP2d7Q==",
+      "integrity": "sha512-KjgeQyOAq7t/HzAJcWPGA8X+4WY03uSCZ2Ekk98S9OgCFsb6lfBE3dbUzUuEQAN2THbwYgFfxX2yFTCMm8Kehw==",
       "cpu": [
         "arm64"
       ],
@@ -2886,9 +2886,9 @@
       }
     },
     "node_modules/@next/swc-win32-x64-msvc": {
-      "version": "15.5.27",
+      "version": "15.4.8",
-      "resolved": "https://registry.npmjs.org/@next/swc-win32-x64-msvc/-/swc-win32-x64-msvc-15.5.27.tgz",
+      "resolved": "https://registry.npmjs.org/@next/swc-win32-x64-msvc/-/swc-win32-x64-msvc-15.4.8.tgz",
-      "integrity": "sha512-XtYgpGOswgnyBWXzOEG6q9RhvnSw0CEZ0MbWqCsl5PISgt9EzvJvNW5mU5n1PsphX/lnamzxjgQXH2GUJL8nqg==",
+      "integrity": "sha512-Exsmf/+42fWVnLMaZHzshukTBxZrSwuuLKFvqhGHJ+mC1AokqieLY/XzAl3jc/CqhXLqLY3RRjkKJ9YnLPcRWg==",
       "cpu": [
         "x64"
       ],
@@ -3380,161 +3380,6 @@
         "react-dom": "^19.0.1 || ^19.1.2 || ^19.2.1"
       }
     },
-    "node_modules/@payloadcms/richtext-lexical/node_modules/@next/env": {
-      "version": "16.4.0",
-      "resolved": "https://registry.npmjs.org/@next/env/-/env-16.4.0.tgz",
-      "integrity": "sha512-pyLlT5oafGlX8X7xjgGNXz5dNIDSxREm+qD6i9VLSZiZFopA/XWl8NM/KPmLx/8EG/++c49iid3gNWSQW1+2dQ==",
-      "license": "MIT",
-      "peer": true
-    },
-    "node_modules/@payloadcms/richtext-lexical/node_modules/@next/swc-darwin-arm64": {
-      "version": "16.4.0",
-      "resolved": "https://registry.npmjs.org/@next/swc-darwin-arm64/-/swc-darwin-arm64-16.4.0.tgz",
-      "integrity": "sha512-yyZ+9MgViAKLLb5l1gPBGjRwnq3teNLb5Zx6JEw8LzNSTjlsnp+baUHFxTgl7PpjCmKf48VQfyipG1eBflb48Q==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "peer": true,
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/@payloadcms/richtext-lexical/node_modules/@next/swc-darwin-x64": {
-      "version": "16.4.0",
-      "resolved": "https://registry.npmjs.org/@next/swc-darwin-x64/-/swc-darwin-x64-16.4.0.tgz",
-      "integrity": "sha512-RePEEejEj1Auf5s9qEcG0JbcDP3ceNUS/ofNX8AhxzgIjTVlZIHMatlp16YplcSMpsVo/ZMQHJTjbMYJznjGUg==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "peer": true,
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/@payloadcms/richtext-lexical/node_modules/@next/swc-linux-arm64-gnu": {
-      "version": "16.4.0",
-      "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-gnu/-/swc-linux-arm64-gnu-16.4.0.tgz",
-      "integrity": "sha512-HhsyCqd+NpmvDDVY/LqkAN24f+QVvXh3ie+PfcwKinWL2Mu826JymQxJXGjAIfmJ4VlHjp4Pe/nZtXtUoEMAqw==",
-      "cpu": [
-        "arm64"
-      ],
-      "libc": [
-        "glibc"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "peer": true,
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/@payloadcms/richtext-lexical/node_modules/@next/swc-linux-arm64-musl": {
-      "version": "16.4.0",
-      "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-musl/-/swc-linux-arm64-musl-16.4.0.tgz",
-      "integrity": "sha512-sN9Pf+Zh+RpZAOmbR7d8KAA8T61CVhawtbEJ2Bk6QrRzx6Z/6haaF4UiwBzytM96GRRRWZh9/WALIEO3npMamA==",
-      "cpu": [
-        "arm64"
-      ],
-      "libc": [
-        "musl"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "peer": true,
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/@payloadcms/richtext-lexical/node_modules/@next/swc-linux-x64-gnu": {
-      "version": "16.4.0",
-      "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-gnu/-/swc-linux-x64-gnu-16.4.0.tgz",
-      "integrity": "sha512-D5M5xLWQVd1CvR+L7BickM1weRfmM41x3L1NWcnKY/oyJJqr1qwaCgmu3dMAhLBOMdZwSuDCRV6DJRRpiUkbDQ==",
-      "cpu": [
-        "x64"
-      ],
-      "libc": [
-        "glibc"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "peer": true,
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/@payloadcms/richtext-lexical/node_modules/@next/swc-linux-x64-musl": {
-      "version": "16.4.0",
-      "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-musl/-/swc-linux-x64-musl-16.4.0.tgz",
-      "integrity": "sha512-8d5WLS6a9YalqpOgXdlbvonFu+sIgjA+CO6tGzetrpPVcUL56foa7B7664h41rAlbLi5fJwK4vWji3zf4QDy+w==",
-      "cpu": [
-        "x64"
-      ],
-      "libc": [
-        "musl"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "peer": true,
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/@payloadcms/richtext-lexical/node_modules/@next/swc-win32-arm64-msvc": {
-      "version": "16.4.0",
-      "resolved": "https://registry.npmjs.org/@next/swc-win32-arm64-msvc/-/swc-win32-arm64-msvc-16.4.0.tgz",
-      "integrity": "sha512-sQuOIiW3snb48UwrBcDMvFA/u03qtw2LeuSIxFIQ9AJuW9UG/4Ddsfo+eV73PnZwBhyncMtsKVh7PrzMol2/fA==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "peer": true,
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/@payloadcms/richtext-lexical/node_modules/@next/swc-win32-x64-msvc": {
-      "version": "16.4.0",
-      "resolved": "https://registry.npmjs.org/@next/swc-win32-x64-msvc/-/swc-win32-x64-msvc-16.4.0.tgz",
-      "integrity": "sha512-6/33lCuxpdHUy27RegyGM/5uTpF7YZd3UR4D0gpkOA/tWY5YR7msbQjqPgCZmSmxrrTLGCXYA4A8vT2H5DPGTQ==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "peer": true,
-      "engines": {
-        "node": ">= 10"
-      }
-    },
     "node_modules/@payloadcms/richtext-lexical/node_modules/@payloadcms/ui": {
       "version": "3.90.2",
       "resolved": "https://registry.npmjs.org/@payloadcms/ui/-/ui-3.90.2.tgz",
@@ -3576,60 +3421,6 @@
         "react-dom": "^19.0.1 || ^19.1.2 || ^19.2.1"
       }
     },
-    "node_modules/@payloadcms/richtext-lexical/node_modules/next": {
-      "version": "16.4.0",
-      "resolved": "https://registry.npmjs.org/next/-/next-16.4.0.tgz",
-      "integrity": "sha512-N2C+9q89Z/oLrsepSRS4jRMtwmUZAoZuAHU0e9T6+sAB5DdhADmrnOW+zjYijlrYFmVfmQhGVGy9eMFoB7UgKg==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "@next/env": "16.4.0",
-        "@swc/helpers": "0.5.23",
-        "baseline-browser-mapping": "^2.9.19",
-        "caniuse-lite": "^1.0.30001579",
-        "postcss": "8.5.23",
-        "styled-jsx": "5.1.6"
-      },
-      "bin": {
-        "next": "dist/bin/next"
-      },
-      "engines": {
-        "node": ">=20.9.0"
-      },
-      "optionalDependencies": {
-        "@next/swc-darwin-arm64": "16.4.0",
-        "@next/swc-darwin-x64": "16.4.0",
-        "@next/swc-linux-arm64-gnu": "16.4.0",
-        "@next/swc-linux-arm64-musl": "16.4.0",
-        "@next/swc-linux-x64-gnu": "16.4.0",
-        "@next/swc-linux-x64-musl": "16.4.0",
-        "@next/swc-win32-arm64-msvc": "16.4.0",
-        "@next/swc-win32-x64-msvc": "16.4.0",
-        "sharp": "^0.35.4"
-      },
-      "peerDependencies": {
-        "@opentelemetry/api": "^1.1.0",
-        "@playwright/test": "^1.51.1",
-        "babel-plugin-react-compiler": "*",
-        "react": "^18.2.0 || 19.0.0-rc-de68d2f4-20241204 || ^19.0.0",
-        "react-dom": "^18.2.0 || 19.0.0-rc-de68d2f4-20241204 || ^19.0.0",
-        "sass": "^1.3.0"
-      },
-      "peerDependenciesMeta": {
-        "@opentelemetry/api": {
-          "optional": true
-        },
-        "@playwright/test": {
-          "optional": true
-        },
-        "babel-plugin-react-compiler": {
-          "optional": true
-        },
-        "sass": {
-          "optional": true
-        }
-      }
-    },
     "node_modules/@payloadcms/translations": {
       "version": "3.90.2",
       "resolved": "https://registry.npmjs.org/@payloadcms/translations/-/translations-3.90.2.tgz",
@@ -4571,19 +4362,6 @@
         "node": "18 || 20 || >=22"
       }
     },
-    "node_modules/baseline-browser-mapping": {
-      "version": "2.11.28",
-      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.11.28.tgz",
-      "integrity": "sha512-br0LOmjJqr6Rt4AEkadbcNf67Zpo7EPwKsWbjnRrJIa1QYFHQBqM4C7F2WTbV8ahTEcg1Eo+Y0aWjjORInYFyA==",
-      "license": "Apache-2.0",
-      "peer": true,
-      "bin": {
-        "baseline-browser-mapping": "dist/cli.cjs"
-      },
-      "engines": {
-        "node": ">=6.0.0"
-      }
-    },
     "node_modules/body-scroll-lock": {
       "version": "4.0.0-beta.0",
       "resolved": "https://registry.npmjs.org/body-scroll-lock/-/body-scroll-lock-4.0.0-beta.0.tgz",
@@ -7867,12 +7645,12 @@
       "license": "MIT"
     },
     "node_modules/next": {
-      "version": "15.5.27",
+      "version": "15.4.11",
-      "resolved": "https://registry.npmjs.org/next/-/next-15.5.27.tgz",
+      "resolved": "https://registry.npmjs.org/next/-/next-15.4.11.tgz",
-      "integrity": "sha512-F82CrlPZ8GRxBH9RIIoR3qU1t5RT3dv1K8moe8SjlDEquiFipvEI13R1Om90TaUOEwShkWCMlg8+gvTNzfMhvg==",
+      "integrity": "sha512-IJRyXal45mIsshZI5XJne/intjusslUP1F+FHVBIyMGEqbYtIq1Irdx5vdWBBg58smviPDycmDeV6txsfkv1RQ==",
       "license": "MIT",
       "dependencies": {
-        "@next/env": "15.5.27",
+        "@next/env": "15.4.11",
         "@swc/helpers": "0.5.15",
         "caniuse-lite": "^1.0.30001579",
         "postcss": "8.4.31",
@@ -7885,15 +7663,15 @@
         "node": "^18.18.0 || ^19.8.0 || >= 20.0.0"
       },
       "optionalDependencies": {
-        "@next/swc-darwin-arm64": "15.5.27",
+        "@next/swc-darwin-arm64": "15.4.8",
-        "@next/swc-darwin-x64": "15.5.27",
+        "@next/swc-darwin-x64": "15.4.8",
-        "@next/swc-linux-arm64-gnu": "15.5.27",
+        "@next/swc-linux-arm64-gnu": "15.4.8",
-        "@next/swc-linux-arm64-musl": "15.5.27",
+        "@next/swc-linux-arm64-musl": "15.4.8",
-        "@next/swc-linux-x64-gnu": "15.5.27",
+        "@next/swc-linux-x64-gnu": "15.4.8",
-        "@next/swc-linux-x64-musl": "15.5.27",
+        "@next/swc-linux-x64-musl": "15.4.8",
-        "@next/swc-win32-arm64-msvc": "15.5.27",
+        "@next/swc-win32-arm64-msvc": "15.4.8",
-        "@next/swc-win32-x64-msvc": "15.5.27",
+        "@next/swc-win32-x64-msvc": "15.4.8",
-        "sharp": "^0.34.3 || ^0.35.4"
+        "sharp": "^0.34.3"
       },
       "peerDependencies": {
         "@opentelemetry/api": "^1.1.0",
@@ -7918,12 +7696,6 @@
         }
       }
     },
-    "node_modules/next/node_modules/@next/env": {
-      "version": "15.5.27",
-      "resolved": "https://registry.npmjs.org/@next/env/-/env-15.5.27.tgz",
-      "integrity": "sha512-WC5hvVqiuFOcRyz6gKPeJkiVvSMf3scNeAV49CdWtVqxmUlzh8UKR6YHt9yiNkh8LngtzqSlVz07/Ma3ZAzchA==",
-      "license": "MIT"
-    },
     "node_modules/next/node_modules/@swc/helpers": {
       "version": "0.5.15",
       "resolved": "https://registry.npmjs.org/@swc/helpers/-/helpers-0.5.15.tgz",

web/package.json

@@ -16,7 +16,7 @@
     "@payloadcms/db-postgres": "^3.60.0",
     "@payloadcms/next": "^3.60.0",
     "@payloadcms/richtext-lexical": "^3.60.0",
-    "next": "^15.5.27",
+    "next": "15.4.11",
     "payload": "^3.60.0",
     "react": "^19.2.0",
     "react-dom": "^19.2.0",