Next.js 16.4.0: clear published security advisories

next 16.3.6 -> 16.4.0, eslint-config-next 16.3.6 -> 16.4.0 (exact pins kept).
React unchanged at 19.2.8 (satisfies next 16.4.0 peer range ^19.0.0).

Advisories cleared: 6 against next 16.0.0-16.3.7, none critical:
- high: SSRF in Image Optimization
- moderate: cache poisoning of SSG/ISR pages (self-hosted)
- moderate: SSG/ISR cross-user content substitution and persistent DoS
- moderate: use cache fill leaking Draft Mode content
- moderate: metadata image routes dynamicParams bypass
- low: dev server MCP endpoint information disclosure

Verification: tsc, eslint and next build clean before and after; next start
served / 200, /favicon.ico 200, /_next/image 200, unknown route 404, no
server errors. Chrome at 1280 and 390: no horizontal overflow, no console
errors. npm audit --omit=dev: no next advisories remain.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015TH5RRwUukmnBav9aoro9S

package.json

@@ -1,6 +1,6 @@
 {
   "name": "fedifund",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "private": true,
   "scripts": {
     "dev": "next dev",
@@ -13,7 +13,7 @@
     "class-variance-authority": "^0.7.1",
     "cn": "^0.4.0",
     "lucide-react": "^1.48.0",
-    "next": "16.3.6",
+    "next": "16.4.0",
     "react": "19.2.8",
     "react-dom": "19.2.8",
     "shadcn": "^4.21.0",
@@ -25,7 +25,7 @@
     "@types/react": "^19",
     "@types/react-dom": "^19",
     "eslint": "^9",
-    "eslint-config-next": "16.3.6",
+    "eslint-config-next": "16.4.0",
     "tailwindcss": "^4",
     "typescript": "^5"
   }