if you missed it, next shipped a security update outside the normal cycle: 16.3.6 as active lts and 15.5.26 on maintenance. the interesting part is not the patch itself, it is that nextjs behaves like boring enterprise infrastructure, with lts windows and an eol date for 15 next month. my rule is simple: pin versions, automate the upgrade pr and read the advisory before the changelog.