#v0.2.7

Released: April 21, 2026

---

#Per-app lockfile cleanup

create-next-app and create-rsbuild each write a package-lock.json inside the app directory they scaffold. In a workspaces setup those lockfiles are never consulted again — the root lockfile is authoritative — so they freeze on day one and show up in Dependabot scans reporting pre-workspace-hoist vulnerabilities. Both scaffold flows now rm the per-app lockfile right after the upstream tool finishes.

#Security & dependency housekeeping

Cleared all critical and high vulnerabilities from npm audit (69 → 21; the remaining are deferred majors in GCP libs, the @swc/cli chain, and prisma internal tooling).

Notable bumps:

• @nestjs/core / common / platform-express / testing 11.1.14 → 11.1.19
• @nestjs/swagger 11.2.6 → 11.3.2, @nestjs/config 4.0.3 → 4.0.4
• next 16.1.6 → 16.2.4 (HTTP smuggling, DoS via RSC, CSRF bypass)
• handlebars 4.7.8 → 4.7.9 (CVSS 9.8 AST type confusion)

#Docs

• New scheduled jobs page added to docs-site.