Next.js 16.4.0: clear published security advisories

next 16.1.6 -> 16.4.0, eslint-config-next 16.1.6 -> 16.4.0 (pinned exact).
React stays at 19.2.3 (next 16.4.0 peer range is ^19.0.0). Version 0.1.0 -> 0.1.1.

Advisories cleared: all 35 npm audit listed against next 16.1.6
(2 critical, 13 high, 16 moderate, 4 low). Critical:
- GHSA-p293-qw3h-jr36 unauthenticated RCE on Windows-hosted servers
- GHSA-2xp9-vwfh-vxw4 unauthenticated RCE in the Image Optimization API (AVIF)
npm audit --omit=dev now reports nothing against next; remaining:
source-map-js (high, GHSA-68fv-2mgg-jv7q) and yaml (moderate), both transitive.

Verification: tsc --noEmit clean; build clean (same 2 routes as baseline);
lint has the same 2 pre-existing no-empty-object-type errors in
components/ui/color-mode.tsx as baseline. next start: / 200, /?q=test 200,
/favicon.ico 200, unknown route 404, no server errors. Chrome at 1280 and 390:
home and /?query=glock render, scrollWidth == clientWidth, no console errors;
"Search on GCI" server action POST 200 and the generated link renders.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015TH5RRwUukmnBav9aoro9S

package.json

@@ -1,6 +1,6 @@
 {
   "name": "lmgcitfy",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Helping people use the search feature on GunCAD Index",
   "private": true,
   "scripts": {
@@ -12,7 +12,7 @@
   "dependencies": {
     "@chakra-ui/react": "^3.32.0",
     "@emotion/react": "^11.14.0",
-    "next": "16.1.6",
+    "next": "16.4.0",
     "next-themes": "^0.4.6",
     "react": "19.2.3",
     "react-dom": "19.2.3",
@@ -24,7 +24,7 @@
     "@types/react": "^19",
     "@types/react-dom": "^19",
     "eslint": "^9",
-    "eslint-config-next": "16.1.6",
+    "eslint-config-next": "16.4.0",
     "tailwindcss": "^4",
     "typescript": "^5"
   }