fix: bump dependencies and resolve security vulnerabilities

Close the security advisories reachable through the published
@frontegg/nextjs package and the example apps.

SDK production chain (enforced via root "resolutions"):
- follow-redirects -> ^1.16.0 (proxy/auth header leak; via http-proxy)
- cookie -> ^0.7.0 (out-of-bounds cookie parsing; via iron-session)
- @babel/runtime -> ^7.26.10 (inefficient RegExp; via @frontegg/js)

Example apps:
- next / eslint-config-next 14.2.0 -> 14.2.35 (fixes the critical
  middleware authorization bypass CVE-2025-29927 and other 14.2.x CVEs)

Also add a Security section to the README documenting the patched
dependency posture and responsible disclosure to security@frontegg.com.

Verified: `yarn build` and `yarn test` (@frontegg/nextjs) pass.

Known residual: a moderate advisory in `uuid` remains inside the
vendored @frontegg/redux-store bundle; its fix requires uuid v11 (a
major bump) and the affected code path (v3/v5/v6 with a buffer) is not
exercised, so a global override is not applied here.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: dianaKhortiuk-frontegg

README.md

@@ -19,6 +19,7 @@ and integrate them into their SaaS portals in up to 5 lines of code.
   - [withSSRSession](#withssrsession)
   - [Next.js middlewares usage](#nextjs-middlewares-usage)
   - for more [visit](https://docs.frontegg.com/docs/self-service-introduction)
+- [Security](#security)
 
 ## Installation
 
@@ -384,4 +385,20 @@ export const config = {
 
 To easily clone frontegg app sample and deploy with Vercel click [here](https://vercel.com/new/clone?repository-url=https%3A%2F%2Fgithub.com%2Ffrontegg%2Ffrontegg-nextjs%2Ftree%2Fmaster%2Fdemos%2Fquick-starter-demo&env=FRONTEGG_BASE_URL,FRONTEGG_CLIENT_ID,FRONTEGG_ENCRYPTION_PASSWORD&envDescription=Used%20to%20connect%20to%20your%20frontegg%20account%20and%20encrypt%20the%20frontegg%20session%20cookie&envLink=https%3A%2F%2Fdocs.frontegg.com%2Fdocs%2Fnextjs-12-13-ssr-hosted-login%23step-4-setup-environment&project-name=my-frontegg-app&repository-name=my-frontegg-app&demo-title=Authentication&demo-description=Basic%20application%20with%20Frontegg%20authentication%20&demo-url=https%3A%2F%2Fmy-frontegg-app.vercel.app&demo-image=https%3A%2F%2Ffronteggprodeustorage.blob.core.windows.net%2Fpublic-vendor-assets%2F4f091b2c-5755-4145-a313-10d9a530276f%2Fassets%2Flogo-fa2b14b1-d07d-49fd-8c24-a51f5d92c4d7.png)
 
+## Security
+
+The `@frontegg/nextjs` SDK is actively maintained, and its dependencies are kept on current, patched versions. Patched versions of transitive dependencies are enforced through the `resolutions` field in the root `package.json`.
+
+To keep your application protected, always use the latest release:
+
+```bash
+yarn add @frontegg/nextjs@latest
+# or
+npm install @frontegg/nextjs@latest
+```
+
+### Reporting a vulnerability
+
+If you discover a security vulnerability in this SDK, please report it responsibly by emailing **security@frontegg.com**. Please do not open a public GitHub issue for security reports.
+
 

package.json

@@ -75,5 +75,10 @@
   "workspaces": [
     "packages/*"
   ],
+  "resolutions": {
+    "follow-redirects": "^1.16.0",
+    "cookie": "^0.7.0",
+    "@babel/runtime": "^7.26.10"
+  },
   "dependencies": {}
 }

packages/example-app-directory/package.json

@@ -14,8 +14,8 @@
     "@types/react": "^18",
     "@types/react-dom": "^18",
     "eslint": "^10.0.2",
-    "eslint-config-next": "14.2.0",
-    "next": "14.2.0",
+    "eslint-config-next": "14.2.35",
+    "next": "14.2.35",
     "react": "^18.3.0",
     "react-dom": "^18.3.0",
     "typescript": "5.9.3"

packages/example-pages/package.json

@@ -14,7 +14,7 @@
     "test:dev": "concurrently \"yarn test:dev-1\" \"yarn test:dev-2\" \"yarn test:dev-3\""
   },
   "dependencies": {
-    "next": "^14.2.0",
+    "next": "^14.2.35",
     "react": "^18.3.0",
     "react-dom": "^18.3.0"
   },
@@ -23,7 +23,7 @@
     "@types/react": "^18",
     "@types/react-dom": "^18",
     "eslint": "^10.0.2",
-    "eslint-config-next": "14.2.0",
+    "eslint-config-next": "14.2.35",
     "typescript": "5.9.3"
   },
   "browserslist": {

packages/example-ssg/package.json

@@ -10,14 +10,14 @@
     "lint": "next lint"
   },
   "dependencies": {
-    "next": "^14.2.0"
+    "next": "^14.2.35"
   },
   "devDependencies": {
     "@types/node": "^20",
     "@types/react": "^18",
     "@types/react-dom": "^18",
     "eslint": "^10.0.2",
-    "eslint-config-next": "14.2.0",
+    "eslint-config-next": "14.2.35",
     "typescript": "5.9.3"
   },
   "browserslist": {