GeezerVison

Summary

• Next.js 16.4.1 → 16.4.5, the security release for seven advisories (cross-tenant use cache disclosure, cache poisoning of fallback shells, response injection when forwarding fetched responses, SVG optimizer bypass, Edge HttpOnly cookie exposure). @next/env and the @next/swc-* optional pins move with it. 16.4.6 is left out: it changes route-handler compression and is not yet a week old
• Re-pinned the Vary-preservation patch to [email protected]; it applies unchanged to both patch-set-header.js builds
• node-gyp's undici 6.28.1 → 6.29.1 within its own ^6.25.0 range (TLS-option bypass, content-encoding and renegotiation DoS)
• Dropped the four Trigger.dev minimumReleaseAgeExcludes entries: 4.8.3 cleared the 7-day threshold on 2026-11-06
• In-range patch bumps, each published at least 7 days ago: @modelcontextprotocol/sdk 1.32.2, @xyflow/react 12.12.1, mysql2 3.24.6, postcss 8.5.32, tldts 7.4.19, electron-updater 6.8.12, @marsidev/react-turnstile 1.6.3, hast-util-to-jsx-runtime 2.3.7, @types/bun 1.4.4, @types/chrome 0.3.7, @types/busboy 1.5.5, @types/mdx 2.0.14
• @types/busboy 1.5.5 types FileInfo.filename as string | undefined, matching busboy: an application/octet-stream part without a filename is still treated as a file. readMultipart passed that undefined through as a string, and both table import routes call file.filename.split('.'), so such a request threw instead of returning 400. The parser now rejects it with NO_FILE, which the routes already map to 400
• bun audit: 32 → 27

Not in this PR:

• The undici 8.10.2 copies pinned exactly by @earendil-works/pi-coding-agent and aliased by e2b (undici8). Nested overrides would patch the pi copy, but they move bun.lock to v3 with map-valued overrides that turbo 2.9 cannot parse, which breaks turbo prune for the app and realtime images. Bun does not apply overrides to an npm-alias optional dependency at all. Both need their package upgrades (pi 1.x, or e2b 2.60+, which drops undici 7, removes the SDK in-flight cap, and changes files.write streaming), each in its own PR with an E2E run
• drizzle-kit 0.31.11: no security content, and its version-pinned push patch would need re-porting and re-proving against Postgres
• better-auth stays in chore(deps): upgrade better-auth to 1.7.12 #9465; zod stays on the patched 4.3.6

Type of Change

• Bug fix
• Dependency update / security

Testing

• lib/core/utils/multipart.test.ts: new case for a filename-less octet-stream part; fails on the old parser (resolves with filename: undefined) and passes with the fix. Table import route tests pass
• bun install --frozen-lockfile clean with Bun 1.4.4 (lockfile stays v1); Next patch applied to the ESM and CommonJS builds
• turbo prune for the app and realtime packages and check:realtime-prune pass; pre-push type-check passes
• Lint, check:audits, the workspace suites, and the docs content-negotiation E2E (which exercises the Next patch) run in CI

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)