fix(deps): bump next to 16.3.3 for August 2026 security release

[devin-ai-integration]

Summary

The August 2026 Next.js security release patches two critical RCEs, fixed only in 16.3.3 (Active LTS) and 15.5.24 (Maintenance LTS). This repo was on ^16.2.7, so next and @next/env move to ^16.3.3.

• GHSA-2xp9-vwfh-vxw4 — RCE via libheif in sharp when Image Optimization processes an attacker-controlled AVIF. Relevant here: this dashboard is self-hosted, so unlike our Vercel-hosted apps it had no platform-level mitigation. 16.3.3 fixes it by not optimizing AVIF inputs at all (served as-is) until libheif is patched upstream, so AVIF images are no longer resized.
• CVE-2026-75604 / GHSA-p293-qw3h-jr36 — RCE limited to Windows-filesystem servers, not reachable for Linux deployments.

Dependency and lockfile changes only, no app code. The lockfile diff is confined to next/@next/*/@swc/helpers plus sharp 0.34.5 → 0.35.4 and its @img/* platform packages. It was regenerated with bun 1.2.20 (the version pinned in CI) rather than a newer local bun, which otherwise prunes unrelated entries.

Companion PR for the belt apps (console, orbit, orbit-global): e2b-dev/belt#2314.

Verification

• bun install and bun install --frozen-lockfile under bun 1.2.20: clean, next@16.3.3 and @next/env@16.3.3 resolved.
• bun run lint: passes (129 warnings, unchanged from base).
• npx tsc --noEmit: fails on generated route types — identical failure on the base commit, since those types require a build.
• bun run build: could not run locally; the prebuild env check requires NEXT_PUBLIC_E2B_DOMAIN, which is not available here. CI's build is the gate.

Link to Devin session: https://app.devin.ai/sessions/907b6486d5044625b594e7ce62bbd08a

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[claude]

LGTM, straightforward dependency version bump.

What was reviewed: confirmed the diff touches only package.json and bun.lock, with next/@ next/env moved from ^16.2.7 to ^16.3.3. Verified the lockfile churn is confined to next, @ next/*, @ swc/helpers, sharp/@ img/*, and their transitive deps (postcss, nanoid, picocolors, source-map-js, tslib, semver, @ emnapi/runtime) — no unrelated packages or version drift. No application source, config, or tests were modified.

Extended reasoning...

Overview

The diff is limited to package.json and bun.lock, bumping next and @ next/env from ^16.2.7 to ^16.3.3. The regenerated lockfile shows the expected transitive updates: @ next/swc-* platform packages to 16.3.3, sharp 0.34.5 → 0.35.4 with its @ img/sharp-*/@ img/sharp-libvips-* platform packages to matching versions, @ swc/helpers 0.5.15 → 0.5.23, and minor bumps to postcss, nanoid, picocolors, source-map-js, semver, and @ emnapi/runtime (a new nested dependency of the wasm32 sharp build). No application source files, configuration, or tests were touched.

Security risks

None introduced by this diff itself — it is a dependency bump, and per the PR description it is motivated by a Next.js security release (RCE fixes in image optimization and Windows-filesystem handling). I did not independently verify the CVE claims against the upstream advisories, but the change itself (version constraint bump + lockfile regen) carries no new risk beyond whatever risk is inherent in adopting the new Next.js/sharp versions, which is normal and expected for a security-motivated dependency upgrade.

Level of scrutiny

Low. This is exactly the kind of mechanical, self-contained change (version bump, lockfile regen, no code changes) that the approval guidelines describe as approvable without requiring human review. I verified the diff contains no unrelated or unexpected package changes by grepping the added lockfile lines for anything outside the next/sharp/@ img/@ swc dependency family, and found none.

Other factors

The PR author notes CI (bun install --frozen-lockfile, lint) passes, and that tsc --noEmit/bun run build failures are pre-existing environment limitations unrelated to this change (missing generated route types / required env var), not regressions from the bump. There is no indication of any outstanding reviewer objection in the conversation timeline, and no CODEOWNERS concern for package.json/bun.lock was found.