Same-minor bump of the exact-pinned direct dependency next (16.3.4 and 16.3.5
are affected by the remote code execution in next/og ImageResponse; fixed in
16.3.6, published 2026-09-22).
package.json next 16.3.4 -> 16.3.6 (exact pin)
pnpm-lock.yaml next + @next/env + 8 @next/swc-* platform packages -> 16.3.6,
baseline-browser-mapping 2.11.21 -> 2.11.23 (next's own dep)
package-lock.json next + @next/env + 8 @next/swc-* -> 16.3.6 (targeted edit;
this legacy lockfile is already out of sync with package.json
and npm cannot regenerate it because of the workspace:*
protocol, so only the next entries were touched)
No other dependency changed. pnpm install --frozen-lockfile, typecheck,
check:contrast, vitest (1154 passed / 184 skipped), next build and eslint
(0 errors) all pass on Node 22.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>