Upgrade Next.js to 16.3.8 (critical RCE advisories)

[ralyodio]

Bumps next in apps/web from ^16.2.6 (locked 16.2.6) to exact 16.3.8. No @next/* or eslint-config-next deps.

Advisories patched:

• GHSA-vcvr-r3jv-pc5j (next/og ImageResponse RCE, >=16.2.0 <16.3.6)
• GHSA-2xp9-vwfh-vxw4 (Image Optimization, 16.0.0 - <16.3.3)
• GHSA-p293-qw3h-jr36 (Windows)

Lockfile: only next, @next/env, @next/swc-, sharp 0.35.5 + @img/, postcss 8.5.23 (next's own, replacing its pinned 8.4.31), nanoid, semver, @swc/helpers, @emnapi/runtime.

Verified locally:

• bun install --frozen-lockfile, tsc --noEmit in apps/web, bun test in apps/tui (10 pass)
• bun run build (shared + web) on Next.js 16.3.8
• Booted with bunx next start (what railway-web-start.sh runs in the dev2 image): /, /status, /terms, /zero-token, /api/status, /robots.txt, /sitemap.xml all 200 with the same titles as live. No next/og or next/image usage.

🤖 Generated with Claude Code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​next@​16.2.6 ⏵ 16.3.8	-2	+75	+1

View full report

[github-actions]

ThreatCrush Security Scan

8 finding(s)

MEDIUM: 8

Severity	Rule	Location
MEDIUM	js-unescaped-html-sink	apps/web/src/app/blog/[slug]/page.tsx:53
MEDIUM	js-unescaped-html-sink	apps/web/src/app/layout.tsx:91
MEDIUM	sh-remote-script-execution	scripts/dev-setup.sh:25
MEDIUM	sh-eval-expansion	scripts/dev-setup.sh:35
MEDIUM	sh-remote-script-execution	scripts/install.sh:159
MEDIUM	sh-remote-script-execution	scripts/install.sh:184
MEDIUM	sh-remote-script-execution	scripts/install.sh:277
MEDIUM	sh-remote-script-execution	scripts/install.sh:294

Snippets are redacted; ThreatCrush never prints matched credential material.