Subject: CVE scanner blocking deployment despite Next.js already updated to 14.2.35

Description:

I'm unable to deploy my project because Railway's security scanner keeps detecting next@14.2.29 even though the package has been updated to 14.2.35 in my repository.

Evidence that the repository is correct:

apps/web/package.json declares "next": "14.2.35"

pnpm-lock.yaml has zero occurrences of next@14.2.29 (confirmed via grep -c "next@14.2.29" pnpm-lock.yaml = 0)

pnpm-lock.yaml has 4 occurrences of next@14.2.35

The lockfile was deleted and regenerated from scratch — result was byte-identical to the committed version, confirming no residual references

What I've tried:

Updated Next.js via pnpm add next@^14.2.35 --filter @inbound/web

Deleted and regenerated pnpm-lock.yaml from scratch

Ran pnpm install --force and pnpm dedupe

Pushed multiple trigger commits to both apps/api and apps/web paths

Added railway.json with explicit NIXPACKS builder config

Railway still reports:

Found 1 vulnerable package(s):

next@14.2.29

Source: pnpm-lock.yaml

This appears to be a cache issue on Railway's scanner side. The repository at github.com/andrenini-arch/inbound-ai is provably clean.

Project: gleaming-reprieve

Service: @inbound/api

Environment: production

Please clear the CVE scanner cache for this project.