chore(deps): apply compatible runtime security updates

[BillLeoutsakosvl346]

Summary

• Update Next.js and matching env/SWC pins to 16.3.3 across workspaces, and sharp to 0.35.4.
• Apply compatible security updates for nodemailer, js-yaml, fast-uri, hono, and the shared xmldom dependency.
• Keep root overrides and bun.lock consistent; preserve the existing OAuth-provider patch. This is the staging-targeted companion to chore(deps): bump the npm_and_yarn group across 2 directories with 5 updates #7616, not a replacement for its main-targeted work.

Scope and remaining advisories

• The lockfile audit decreases from 44 to 20 distinct advisories: 0 critical, 4 high, 15 moderate, 1 low remain. No audit suppression or CI-policy changes.
• Remaining packages include legacy/transitive image-size, undici, js-yaml 3.x, csv-parse, file-type, fflate, qs, uuid, OpenTelemetry, AI SDK utilities, OAuth-provider, and development tooling. Major-version migrations and compatibility-sensitive replacements are deferred, not declared fixed.

Testing

• 62 app tests and 109 CLI configuration tests passed.
• Actual-library image, XML, YAML, mail serialization, Hono, and URI smoke checks passed without external sends.
• App type-check, changed-manifest Biome, API validation, frozen-lockfile install, and git diff --check passed.
• Complete remote CI remains to run; audit remains nonzero for the explicitly listed backlog.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Existing focused tests passing; no new version-assertion tests
• No unrelated runtime or generated-documentation changes
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Sep 8, 2026 11:25pm UTC

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge; no concrete correctness, security, compatibility, or repository-rule failure remains.

Summary

• Advances Next.js, @next/env, and matching SWC packages to 16.3.3.
• Updates direct YAML, mail, and image-processing dependencies.
• Pins compatible patched versions of shared XML, Hono, and URI dependencies through root overrides.
• Preserves the existing OAuth-provider patch and previously added Next.js optimizer safeguards.