chore(deps): bump next from 16.3.3 to 16.3.6

[dependabot]

Bumps next from 16.3.3 to 16.3.6.

Release notes

Sourced from next's releases.

v16.3.6

This release contains a security fix for GHSA-vcvr-r3jv-pc5j: Remote Code Execution in next/og ImageResponse

v16.3.5

The following bug fixes have been backported. It does not include all pending features/changes on canary.

• next/image: Skip 0-byte entries when initializing disk LRU cache (#98185)
• next/image: Reject empty images when reading/writing to the disk cache (#98186)
• Emit whole-app server NFTs when output: 'standalone' is used with an adapter (#98167)
• Add CSP nonce to script tags of loading and template files (#98403)
• Fix use cache prerender signal retention (#98448)

v16.3.4

Follow-up release to v16.3.3 re-enabling AVIF Image Optimization (#97949).

The following bug fixes have been backported. It does not include all pending features/changes on canary.

• testmode: Fix infinite recursion in testmode passthrough fetch (#97691)
• Fix build error when aliasing typescript to @​typescript/typescript6 (#97997)
• Fix unset crossOrigin in Turbopack manifests (#97930)

Credits

Huge thanks to @​eps1lon, @​mischnic, and @​timneutkens for helping!

Commits

• a758ffc v16.3.6
• 868fad3 [active-lts] Harden next/og SVG serialization
• 8c81cbb [lts-active] test: remove unsupported deployment ID builder cases (#98821)
• ca2c75e v16.3.5
• 14fb290 [backport] Fix use cache prerender signal retention (#98448)
• 2b1f28d [16.3.x] Add CSP nonce to script tags of loading and template files (#98403)
• 4b56cee [16.3.x] Backport docs fixes (#98317)
• 5568a02 [backport] docs: local development: Rewrite docker section, add Windows Dev D...
• 93249ab [16.3.X] Emit whole-app server NFTs when output: 'standalone' is used with ...
• 6549fd7 [16.3.x] next/image: reject empty image on read/write to disk cache (#98186)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	next@​16.3.3 ⏵ 16.3.6		+75	+1

View full report

[github-actions]

Audit d'accessibilité ultra11y — RGAA

✅ Aucune non-conformité relevée par le moteur statique.

2026-10-04 · 351 fichiers · 2/106 critères tranchés dans ce run · 2 moteur · 104 à compléter par scan ou adjudication

Périmètre de ce run — 0 page rendue : aucun test rendered n'a été exécuté
27 test(s) static — critères : 1.1 · 2.1 · 5.7 · 5.8 · 6.2 · 7.1 · 8.2 · 8.3 · 8.4 · 8.5 · 8.10 · 9.3 · 10.1 · 10.12 · 11.1 · 11.5 · 11.6 · 11.8 · 11.9
3 test(s) rendered prévus — critères : 1.1 · 8.1 · 10.7
Couverture moteur : 49 critère(s) reçoivent un signal normatif — 21 critère(s) peuvent produire un NC décisif · 41 reçoivent des preuves candidates (avec chevauchement) · 1 autre reçoit une recommandation advisory
228 test(s) judgment sur 92 critère(s), tous transmis à l'IA tant qu'ils ne sont pas tranchés

Rapport complet (HTML, captures annotées) : artefact ultra11y-pr-static du run.

Voir le run et son résumé de job

[github-actions]

🧪 Recette E2E — grille 185 coordonnées

Date	Commit	Périmètre	Durée	Résultat
2026-10-04	b9e83bc	tous les cas (185 coordonnées)	0s	0 passé / 0 échoué / 185 non joués sur 185

➡️ Grille complète dans le résumé du run · Rapport Playwright et traces

[iterion-forge-egapro]

Revi — aucun problème détecté dans le périmètre revu.

_{Détails du run IA · Iterion}

Run : 01a106d8-3bd0-7d18-b00c-11f145ecc540

Tokens du run au moment de publier : 120 534.

Périmètre revu : correctness: packages/app/package.json — next spec ^16.2.11 -> ^16.3.6 consistent with lockfile, only next pin in monorepo ; supply-chain/security: pnpm-lock.yaml — all resolution entries use registry integrity hashes, no tarball/git/URL sources, no unknown packages, no downgrades, every dropped entry has a same-name replacement or dedup (@swc/helpers 0.5.21 dropped, 0.5.23 retained) ; consistency: no stale next@16.3.3 references left in lockfile, manifests or .github/workflows ; requirements: forge-native lookup on PR #4719 — closingIssuesReferences empty, no ticket refs in title/body/branch ; context: grep of packages/app/src for next/og|ImageResponse — no direct usage (CVE fix is defense-in-depth)

Vérifications de ticket indisponibles :

• (no ticket refs): unverifiable — no ticket reference found in PR title/body or branch name (forge reports no closing issues on PR #4719; ticket-less dependabot PR, which is normal)

Revue mono (single model family).

Étape	Modèle	Harness	Effort demandé	Tokens
Revue GLM	glm-5.3	claude_code	max	75 718
Synthèse · GLM	glm-5.3	claude_code	medium	44 816

_{Tokens cumulés des appels IA, pas la taille du contexte. L’effort indiqué est le réglage demandé au modèle.}