Update dependencies and patch transitive audit fixes

[dex-the-ai]

Summary

• Update axios to 1.18.0 and bump next / eslint-config-next from 16.2.6 to 16.2.9 plus prettier to 3.8.4
• Add npm overrides for vulnerable transitive packages form-data@4.0.6 and tar@7.5.16
• Re-materialize .env.local from the canonical machine env for verification only and re-run the local quickstart walkthrough with reviewer-facing media

Verification

• npm run check
• npm test
• npm run init-db:local
• npm run build-indexes
• set -a && source .env.local && set +a && npm run build
• Local walkthrough on http://127.0.0.1:3002 with Dockerized Playwright media capture

Evidence

• The local app rendered successfully and reported isConnected: true.
• GET /api/user?limit=5 returned seeded profile data from the live app.
• POST /api/user succeeded during walkthrough validation, and the UI walkthrough also created + searched a profile successfully.
• Visual proof captured from the running app:
  • tutorial-maintenance/runs/couchbase-examples__nextjs-quickstart/2026-06-15/screenshots/ui-walkthrough.png
  • tutorial-maintenance/runs/couchbase-examples__nextjs-quickstart/2026-06-15/video/ui-walkthrough.webm
• Supporting local notes: tutorial-maintenance/runs/couchbase-examples__nextjs-quickstart/2026-06-15/verification.md

Audit / walkthrough notes

• npm audit --omit=dev dropped from 4 production advisories to 2 after the direct dependency bumps and true transitive overrides.
• The remaining pair is the linked upstream next / nested postcss advisory on next@16.2.9; I explicitly backed out the earlier broken postcss override idea because postcss is already a direct dependency here and Next still vendors its own nested copy.
• npm run load-sample-data is noisy when sample docs already exist (DocumentExistsError) but does not block the build or walkthrough.
• One rerun of npm run init-db:default segfaulted after a connection failure message, but npm test, .env.local init, build, and the live walkthrough all passed afterward.

Notes

• I kept this pass to the smallest safe supportable updates rather than forcing broader major-family churn.
• No README or manifest drift required changes in this sweep.

Media evidence

• Auto-attached reviewer-facing media from the local verification artifacts captured during this run.
• This keeps the main PR body self-contained instead of relying on a follow-up comment for visual proof.

Notes

• Local artifact path: tutorial-maintenance/runs/couchbase-examples__nextjs-quickstart/2026-06-15/screenshots/ui-walkthrough.png

Ui Walkthrough

Notes

• Local artifact path: tutorial-maintenance/runs/couchbase-examples__nextjs-quickstart/2026-06-15/video/ui-walkthrough.webm

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
couchbase-nextjs-quickstart	Ready	Preview, Comment	Jun 30, 2026 3:07pm

[dex-the-ai]

Owner ping for this maintenance PR: @ejscribner

Requesting review from the manifest-listed owner(s) where GitHub does not already show a pending review request.

[gemini-code-assist]

Code Review

This pull request updates several dependencies in package.json and package-lock.json, including upgrading axios to ^1.18.0, next and eslint-config-next to ^16.2.9, and prettier to ^3.8.4. Additionally, it introduces dependency overrides for form-data (version 4.0.6) and tar (version 7.5.16). As there are no review comments, no feedback is provided.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.