[next-devin]

security-audit (npm audit --omit=dev) started failing on every docs PR on 2026-10-23. Three critical Next.js advisories cover next 16.0.0–16.4.0:

• RCE in the Image Optimization API when SVG files are used
• RCE in use cache functions returning typed arrays
• DoS in the App Router via Server Actions (GHSA-p3m5-59mp-jv5r)

16.4.2 fixes all three. That's outside the patch-only ~16.3 range, so this PR changes the range explicitly, as docs/MAINTENANCE.md requires for a security fix:

• next ~16.3.6 → ~16.4.2 (installs 16.4.2)
• @next/third-parties ~16.3.1 → ~16.4.2, moved with Next.js per the same doc

The lockfile was regenerated with npm 11, which wrote the committed lockfile, so the only changes are the next, @next/env, @next/swc-* and @next/third-parties versions. npm 10 would also have dropped every libc field.

Local results:

• npm audit --omit=dev: 0 vulnerabilities
• npm run build, including its prebuild link, capability and markup checks: passes
• check-search-budget (0.47 MB of 0.75 MB) and check-search-quality: both pass
• check-dependency-compatibility: passes

This unblocks #74 and the other open docs PRs once it merges.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	nextcommerce-docs	1241f8e	Commit Preview URL Branch Preview URL	Oct 23 2026, 02:52 AM

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Overview

Dependency-only security bump of next and @next/third-parties from ~16.3.6/~16.3.1 to ~16.4.2, covering three critical advisories (Image Optimization SVG RCE, use cache typed-array RCE, App Router Server Action DoS).

Verified:

• package.json and package-lock.json ranges agree; all next-family entries (next, @next/env, all 8 @next/swc-*, @next/third-parties) resolve to exactly 16.4.2.
• next's new sharp optional dep ^0.35.5 matches the existing overrides.next.sharp: 0.35.5 pin and the locked sharp@0.35.5 — no override/lock drift.
• lockfileVersion still 3 and no unrelated churn; the only other lockfile edits are the intended integrity/resolved hashes and the @next/third-parties peer range tightening to ^16.0.0 (still satisfied by next@16.4.2).
• Range change is allowed by docs/MAINTENANCE.md for security fixes outside patch-only ranges, and next was moved together with @next/third-parties as that doc requires.
• Risk surface checked: the site is a static export (output: 'export', images.unoptimized) with no use cache, no Server Actions, and no optimizer-backed <Image> usage, so none of the three vulnerable code paths are exercised. scripts/check-dependency-compatibility.mjs does not pin a Next.js version, so no CI check conflicts with the new range.

Note (not a finding): this is a Next.js minor upgrade, which the maintenance doc normally expects to be reviewed as a migration. No migration-relevant changes surfaced in the reviewed code; the PR reports npm run build, check-search-budget, check-search-quality, and check-dependency-compatibility all passing. Build/audit output could not be re-verified here (read-only review), so that claim rests on the PR description.

Files Reviewed (2 files)

• package.json - 0 issues
• package-lock.json - 0 issues

---

_{Reviewed by minimax-m3 · Input: 27K · Output: 2K · Cached: 222.7K}