[sitole]

Summary

Upgrade Next.js to 16.4.5 to address GHSA-2464-fhr4-w9xw and GHSA-673q-mjm6-r5xr. Both advisories were first patched in 16.4.1.

Changes

• Pin next and @next/env from 16.3.6 to 16.4.5 in package.json.
• Update bun.lock with Next.js, env, and SWC packages at 16.4.5.
• Update sharp and @img packages from 0.35.4 to 0.35.5, as required by Next.js 16.4.5.

Verification

Passed with Bun 1.4.4:

• bunx bun@1.4.4 install
• bunx bun@1.4.4 install --frozen-lockfile
• bunx biome ci --formatter-enabled=false --linter-enabled=true . — 0 errors, 131 warnings, 1 info; not compared against the baseline.
• bunx biome check --linter-enabled=false --assist-enabled=true .
• bun run knip:ci
• PUBLIC_E2B_DOMAIN=smoke.invalid bun run build — confirmed Next.js 16.4.5; warnings from @opentelemetry/instrumentation-winston and e2b.
• bunx tsc --noEmit — after the build generated PageProps types.
• bun run test:unit — 318 tests across 31 files.
• ./scripts/container-smoke.sh — local image confirmed Next.js 16.4.5.

Not verified

• Integration tests were not run.
• Deployed images were not verified because the GCP endpoint at 127.0.0.1:18080 was unavailable.
• Vanta flagged Next.js 16.3.6 in dashboard image digest c4291f5e0da1b3511a521bf19f302cadfbcf39bf9f5f91ac390a4b33b8f98cbd. This PR and local build do not fix old immutable images. Rollout and scan confirmation follow separately.