[zjy365]

Both Next.js applications pin 16.2.6, which is in the affected range for CVE-2026-94545. Upgrade next in the product UI and component registry to the patched 16.3.6 release, align @next/third-parties, and regenerate bun.lock with the required transitive dependencies. The current applications have no next/og or ImageResponse routes; this removes the vulnerable dependency version.

Reference: Next.js security advisory GHSA-vcvr-r3jv-pc5j.

Validation:

• Bun 1.3.5: bun install --frozen-lockfile passes.
• bun typecheck, bun check, and bun lint pass.
• Production builds for apps/ui and apps/registry pass; both standalone outputs bundle Next.js 16.3.6.
• A temporary benign regression probe inspects SVG passed by the bundled Node ImageResponse to the rasterizer, with sharp intercepted: a crafted SVG title injects a rectangle on 16.2.6 and is escaped on 16.3.6. No native exploit payload was executed.