vulncheck
9e81436391
next-auth was never imported — the backend issues the JWTs itself — so a package carrying a critical advisory sat in the tree doing nothing. Removing it beats upgrading it. next 16.1.5 → 16.3.1 also clears postcss, sharp, nanoid, form-data, follow-redirects and uuid, which came in transitively. eslint-config-next moves in lockstep with next, otherwise it pins the old toolchain. npm audit --omit=dev: 9 findings (1 critical) → 0.
TrueVuln Frontend
Next.js 16 (App Router) UI for TrueVuln. See the root README for setup, deployment, and configuration — this app is deployed via Docker Compose alongside the backend, not standalone or on Vercel.
Local dev (without Docker)
npm install
npm run dev
Open http://localhost:3000. The dev server proxies API calls to the backend — see ../README.DEV.md for the full local (non-Docker) setup.