[goetchstone]

Why

Advisories published since #130 fail the npm audit gate on main, which blocks every open PR:

Package	Advisory	Severity	Fixed in
next ≤16.4.0	GHSA-2464-fhr4-w9xw: unauthenticated RCE in image optimization (SVG)	critical	16.4.1
next ≤16.4.0	GHSA-673q-mjm6-r5xr: unauthenticated RCE in use cache functions returning typed arrays	critical	16.4.1
next ≤16.4.0	GHSA-p3m5-59mp-jv5r: DoS in App Router via Server Actions	high	16.4.1
zod <4.6.6	GHSA-mrhx-c7xc-m3w5: memory exhaustion validating oversized constrained collections	high	4.6.6
nodemailer <10.1.4	GHSA-8c8m-p3m8-cjg8, GHSA-m943-m63m-w62w, GHSA-85x2-q946-cp5h: addressparser turns display text into recipients	moderate	10.1.4

The image optimizer is off here (images.unoptimized), and the app has no use cache, but the Server Actions DoS and zod apply to every public form.

Changes

• next 16.3.8 → 16.4.3 and eslint-config-next 16.4.3. The 16.4 notes list no breaking changes for existing apps, and Cache Components stay opt-in.
• zod 4.4.3 → 4.6.7.
• nodemailer 10.0.13 → 10.1.7: the newest patch past the repo's Dependabot cooldown. 10.2.x is a 6-day-old minor.
• The lockfile diff touches only these packages.

Supersedes #128. Dependabot's prod-deps PR (#127) stops at nodemailer 10.1.1, which is still vulnerable.

Verification (Node 24.22.1, real images)

• tsc, vitest (124/124), and npm audit --omit=dev all pass, with 0 vulnerabilities.
• production and migrator images against throwaway Postgres + Mailpit:
  • schema push, seed, and all blog seeds
  • all public pages and all 19 dashboard pages (logged in as admin)
  • three lead-magnet PDFs, and DMARC live DNS
• Lead form submit: both the visitor email and the owner notification arrive in Mailpit. A malformed address (a@b.com>; c@d.com) gets a 400 from Zod.

🤖 Generated with Claude Code