[FrkAk]

Summary

Task Reference: none

Updates dependencies to fix the critical and high advisories reported by bun audit.

• next and eslint-config-next ~16.3.8 → ~16.4.2: fixes two unauthenticated RCEs (GHSA-2464-fhr4-w9xw, GHSA-673q-mjm6-r5xr) and a Server Actions DoS (GHSA-p3m5-59mp-jv5r).
• @opennextjs/cloudflare ^1.20.2 → ^1.20.12, the first adapter release that supports Next 16.4.
• zod 4.5.1 → 4.6.7 (GHSA-mrhx-c7xc-m3w5).
• New glob >=10.5.0 security floor in overrides (GHSA-5j98-mcp5-4vw2), since @node-minify/core (via @opennextjs/aws) pins glob@10.3.3.
• Lockfile refresh for transitive hono, ip-address and fast-uri advisories.

Type of change

• Bug fix
• New feature
• Refactor / cleanup
• Documentation

Testing

• Tested locally with bun run dev
• Linting passes (bun run lint)
• Typecheck passes (bun run typecheck)
• Workers smoke passes (bun run build:cf && bun run smoke:cf) — required when this PR touches app/api/**, middleware.ts, worker-cf.ts, or a .node.ts / .workers.ts pair

bun run test and next build pass as well.

Notes for reviewer

• Next is pinned to 16.4.2 instead of 16.4.3 because 16.4.3 is still inside the minimumReleaseAge window in bunfig.toml.
• The glob override moves @node-minify/core from glob 10 to glob 13. It only calls globSync, which glob 13 still exports, and the Workers smoke covers it.
• One moderate advisory remains: esbuild 0.18 via drizzle-kit, which only affects the dev server.

Docs impact

• none

Compliance impact

• none