fix(deps): bump next to 16.3.6 for GHSA-vcvr-r3jv-pc5j

[yigitdot]

Bumps next 16.3.4 → 16.3.6, the out-of-band patch Vercel shipped on 2026-09-22 for GHSA-vcvr-r3jv-pc5j.

The advisory

Critical, CVSS v4 9.5 — RCE in the Node implementation of ImageResponse from next/og, triggered when attacker-controlled values reach SVG content, attributes, or styles. Affected: 16.2.0 – 16.3.5. Fixed in 16.3.6 (and 15.5.26 on the 15 line). The Edge implementation is unaffected.

Why it applies to us

We do call the vulnerable code path. app/blog/[slug]/opengraph-image.tsx imports ImageResponse from next/og, and no route under app/ sets export const runtime = "edge" — so it is the affected Node implementation, not the unaffected Edge one.

Runtime exposure is nil: under output: "export" the card renders at build time only and there is no server. The interpolated values (post.title, dottedDate(post.date), seriesLabel(post.seriesNumber)) all come from our own committed MDX frontmatter.

The one non-theoretical path is CI. .github/workflows/website.yml runs pnpm build on pull_request, including from forks, so a fork PR adding a post with a crafted title would render attacker-supplied text through the vulnerable renderer on the runner. Blast radius is narrow — it is pull_request (not pull_request_target) with permissions: contents: read, so no secrets are exposed and the runner is ephemeral — but it is reason enough not to sit on a 9.5.

Scope

next only. The lockfile diff touches next, @next/env, the eight @next/swc-* binaries, and drops nanoid@3.3.18 (16.3.6 no longer depends on it). Nothing else moves.

eslint-config-next stays at 16.2.10 — dev-only, unrelated to this advisory, and left for the monthly Dependabot dev-dependencies group rather than mixed into a security patch.

Verification

Full CI sequence run locally, all green:

Step	Result
resolved next version	16.3.6
pnpm lint	clean
pnpm format:check	all files match Prettier
pnpm typecheck	clean
pnpm test	473 passed / 24 files
pnpm build + check:out + check:og-image	16 pages, 48 same-origin URLs verified against out/

Since next/og is the package that changed, the 8 regenerated blog cards were also checked by hand — all 1200×630, and the longest title (Stablecoin Settlement Is Not a Footnote) still renders its eyebrow, two-line 60px auto-shrunk title, and the date · §05 · whisper-dot row inside the canvas. No layout shift from the Satori bump.

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[cloudflare-workers-and-pages]

Deploying website with    Cloudflare Pages

Latest commit:	c92dc1c
Status:	✅  Deploy successful!
Preview URL:	https://f12e8cd5.website-70y.pages.dev
Branch Preview URL:	https://claude-nextjs-security-relea.website-70y.pages.dev

View logs