fix(deps): pin next to 16.4.1 to release v4.7

Merged
CL
21h ago
+51-51

Requested via Slack thread

Description

Before: On release/v4.7, web and examples/widget pin next 16.3.8, which is affected by GHSA-2464-fhr4-w9xw and GHSA-673q-mjm6-r5xr.

After: next is pinned to 16.4.1 in web/package.json and examples/widget/package.json. web/bun.lock and the root bun.lock resolve next/@next/* 16.4.1. No app code changes.

Cherry-pick of #16511 (0429af73f15d6f39c6dad9172d9814dccab98a14)

Conflict resolution: Root bun.lock conflicted. web/bun.lock auto-merged, but I did not trust a textual lockfile merge, so I restored both lockfiles from release/v4.7 and regenerated them with bun 1.3.13 using bun install --lockfile-only after taking the two package.json bumps. In the root lockfile, sharp and @img/* also move from 0.35.4 to 0.35.5, because next 16.4.1 requires sharp ^0.35.5.

How: Same dependency pins as #16511, applied on top of release/v4.7, with the lockfiles regenerated from that branch's own lockfiles. web/lib/opal's next >=14.0.0 peer range is unchanged, as in the source PR.

How Has This Been Tested?

  • bun install --frozen-lockfile --lockfile-only passes in web/ and at the repo root with bun 1.3.13.
  • Checked both lockfiles: no next/@next/* 16.3.8 entries remain.
  • Did not run a full build; relying on CI.

Additional Options

  • [Optional] Please cherry-pick this PR to the latest release version.

Generated by Claude Code

Summary by cubic

Pins next to 16.4.1 in web/ and examples/widget to address security advisories, and regenerates web/bun.lock and the root bun.lock accordingly. The root lockfile also updates sharp and @img/* to 0.35.5 because next 16.4.1 requires sharp ^0.35.5.