next 16.3.6 -> 16.4.0, eslint-config-next 16.3.6 -> 16.4.0 (exact pins kept).
React unchanged at 19.2.8 (satisfies next 16.4.0 peer range ^19.0.0).
Advisories cleared: 6 against next 16.0.0-16.3.7, none critical:
- high: SSRF in Image Optimization
- moderate: cache poisoning of SSG/ISR pages (self-hosted)
- moderate: SSG/ISR cross-user content substitution and persistent DoS
- moderate: use cache fill leaking Draft Mode content
- moderate: metadata image routes dynamicParams bypass
- low: dev server MCP endpoint information disclosure
Verification: tsc, eslint and next build clean before and after; next start
served / 200, /favicon.ico 200, /_next/image 200, unknown route 404, no
server errors. Chrome at 1280 and 390: no horizontal overflow, no console
errors. npm audit --omit=dev: no next advisories remain.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015TH5RRwUukmnBav9aoro9S
mattyandClaude Opus 5.5