[lawmight]

Security bump (DRAFT — do not merge without Tom's yes)

Changes

• next + eslint-config-next: 16.3.8 / 16.2.4 → 16.4.1
• Lockfile: package-lock.json (primary; bun.lock left untouched — older/stale)

Advisories

• GHSA-673q-mjm6-r5xr — Next.js: Unauthenticated RCE in use cache functions returning typed arrays
• GHSA-2464-fhr4-w9xw — Next.js: Unauthenticated RCE in Image Optimization API when SVG files are allowed
• GHSA-p3m5-59mp-jv5r — Next.js: DoS in App Router using Server Actions
• Source: https://nextjs.org/blog/nextjs-security-update-october-14-2026

Verification

• npm ci && npm run build — PASS (Next.js 16.4.1 / Turbopack)
• npm test (vitest) — PASS (8 files / 41 tests)

Not done

• Not merged / not deployed
• No secrets edited