chore(deps): take the Next.js 16.4.5 security release, patch node-gyp's undici, and refresh in-range patches

apps/desktop/package.json

@@ -40,11 +40,11 @@
     "@sim/terminal-protocol": "workspace:*",
     "@sim/utils": "workspace:*",
     "@xterm/headless": "6.0.0",
-    "electron-updater": "6.8.9",
+    "electron-updater": "6.8.12",
     "lru-cache": "11.5.3",
     "micromatch": "4.0.8",
     "safe-regex2": "5.1.2",
-    "tldts": "7.4.18",
+    "tldts": "7.4.19",
     "pdf-lib": "1.17.1",
     "@sim/auth-ui": "workspace:*"
   },

apps/docs/package.json

@@ -33,8 +33,8 @@
     "@sim/logger": "workspace:*",
     "@sim/utils": "workspace:*",
     "@sim/workflow-renderer": "workspace:*",
-    "@xyflow/react": "12.12.0",
-    "next": "16.4.1",
+    "@xyflow/react": "12.12.1",
+    "next": "16.4.5",
     "next-themes": "^0.4.6",
     "react": "19.2.4",
     "react-dom": "19.2.4",
@@ -59,7 +59,7 @@
     "server-only": "0.0.1",
     "postgres": "3.4.9",
     "remark-rehype": "11.1.2",
-    "hast-util-to-jsx-runtime": "2.3.6",
+    "hast-util-to-jsx-runtime": "2.3.7",
     "clsx": "2.1.1",
     "tailwind-merge": "3.7.0",
     "mdast-util-gfm": "3.1.0",
@@ -80,7 +80,7 @@
     "vitest": "^5.0.4",
     "@modelcontextprotocol/client": "2.3.1",
     "@types/mdast": "4.0.4",
-    "@types/mdx": "2.0.13",
+    "@types/mdx": "2.0.14",
     "htmlparser2": "10.1.0",
     "@types/hast": "3.0.5"
   }

apps/extension/package.json

@@ -26,8 +26,8 @@
   "devDependencies": {
     "@playwright/test": "1.64.1",
     "@sim/tsconfig": "workspace:*",
-    "@types/bun": "1.4.3",
-    "@types/chrome": "0.3.6",
+    "@types/bun": "1.4.4",
+    "@types/chrome": "0.3.7",
     "@types/react": "^19",
     "@types/react-dom": "^19",
     "esbuild": "0.28.2",

apps/sim/lib/core/utils/multipart.test.ts

@@ -5,6 +5,7 @@ import { isMultipartError, type MultipartError, readMultipart } from '@/lib/core
 type Part =
   | { name: string; value: string }
   | { name: string; filename: string; value: string; contentType?: string }
+  | { name: string; value: string; contentType: string }
 
 const BOUNDARY = '----testboundary1234'
 
@@ -14,6 +15,8 @@ function buildBody(parts: Part[], boundary = BOUNDARY): Buffer {
     let header = `--${boundary}\r\nContent-Disposition: form-data; name="${part.name}"`
     if ('filename' in part) {
       header += `; filename="${part.filename}"\r\nContent-Type: ${part.contentType ?? 'text/csv'}`
+    } else if ('contentType' in part) {
+      header += `\r\nContent-Type: ${part.contentType}`
     }
     header += '\r\n\r\n'
     segments.push(Buffer.from(header, 'utf8'), Buffer.from(part.value, 'utf8'), Buffer.from('\r\n'))
@@ -121,6 +124,18 @@ describe('readMultipart', () => {
     )
   })
 
+  it('rejects NO_FILE when the file part carries no filename', async () => {
+    const request = makeRequest([
+      { name: 'file', value: 'name\nAlice\n', contentType: 'application/octet-stream' },
+    ])
+    await readMultipart(request, { maxFileBytes: 1024 }).then(
+      () => {
+        throw new Error('expected rejection')
+      },
+      (err) => expectCode(err, 'NO_FILE')
+    )
+  })
+
   it('rejects NOT_MULTIPART for a non-multipart content type', async () => {
     const request = {
       headers: new Headers({ 'content-type': 'application/json' }),

apps/sim/lib/core/utils/multipart.ts

@@ -178,6 +178,15 @@ export function readMultipart(
         return
       }
 
+      // busboy treats an `application/octet-stream` part without a filename as a file.
+      const { filename } = info
+      if (filename === undefined) {
+        stream.resume()
+        nodeStream.destroy()
+        settle(() => reject(new MultipartError('NO_FILE', 'File part has no filename')))
+        return
+      }
+
       const missing = requiredFieldsBeforeFile.filter((field) => !(field in fields))
       if (missing.length > 0) {
         stream.resume()
@@ -218,7 +227,7 @@ export function readMultipart(
         }
         resolve({
           fields,
-          file: { fieldName: name, filename: info.filename, mimeType: info.mimeType, stream },
+          file: { fieldName: name, filename, mimeType: info.mimeType, stream },
         })
       })
     })

apps/sim/package.json

@@ -113,8 +113,8 @@
     "@google/genai": "2.28.0",
     "@hookform/resolvers": "5.9.1",
     "@linear/sdk": "97.1.0",
-    "@marsidev/react-turnstile": "1.6.2",
-    "@modelcontextprotocol/sdk": "1.32.1",
+    "@marsidev/react-turnstile": "1.6.3",
+    "@modelcontextprotocol/sdk": "1.32.2",
     "@monaco-editor/react": "4.7.0",
     "@napi-rs/canvas": "0.1.100",
     "@opentelemetry/api": "^1.9.0",
@@ -191,7 +191,7 @@
     "@xterm/addon-web-links": "0.12.0",
     "@xterm/addon-webgl": "0.19.0",
     "@xterm/xterm": "6.0.0",
-    "@xyflow/react": "12.12.0",
+    "@xyflow/react": "12.12.1",
     "ajv": "8.20.0",
     "archiver": "8.0.0",
     "better-auth": "1.6.27",
@@ -242,9 +242,9 @@
     "monaco-editor": "0.55.1",
     "mongodb": "6.21.0",
     "mssql": "12.7.4",
-    "mysql2": "3.24.5",
+    "mysql2": "3.24.6",
     "neo4j-driver": "6.0.1",
-    "next": "16.4.1",
+    "next": "16.4.5",
     "next-mdx-remote": "^6.0.0",
     "next-themes": "^0.4.6",
     "nodemailer": "10.1.7",
@@ -280,7 +280,7 @@
     "ssh2": "^1.17.0",
     "streamdown": "2.5.0",
     "stripe": "18.5.0",
-    "tldts": "7.4.18",
+    "tldts": "7.4.19",
     "twilio": "6.2.0",
     "typebox": "1.3.27",
     "undici": "7.30.1",
@@ -296,7 +296,7 @@
     "@sim/auth-ui": "workspace:*"
   },
   "devDependencies": {
-    "@next/env": "16.4.1",
+    "@next/env": "16.4.5",
     "@opentelemetry/context-async-hooks": "2.10.0",
     "@playwright/test": "1.64.1",
     "@sim/testing": "workspace:*",
@@ -306,8 +306,8 @@
     "@testing-library/jest-dom": "^6.10.0",
     "@trigger.dev/build": "4.8.3",
     "@types/archiver": "8.0.0",
-    "@types/busboy": "1.5.4",
-    "@types/chrome": "0.3.6",
+    "@types/busboy": "1.5.5",
+    "@types/chrome": "0.3.7",
     "@types/hast": "3.0.5",
     "@types/heic-convert": "2.1.1",
     "@types/html-to-text": "9.0.4",