[everton-dgn]

Atualiza Next.js de 16.1.3 para 16.4.1 e regenera o lockfile com sharp 0.35.5/libvips 8.18.7. Mantém React e as demais dependências diretas.

Corrige as versões afetadas por:

• GHSA-2464-fhr4-w9xw
• GHSA-673q-mjm6-r5xr
• GHSA-p3m5-59mp-jv5r

Validação local: instalação frozen-lockfile, lint, typecheck e 4 testes unitários passaram. Confirmada a resolução de Next 16.4.1/sharp 0.35.5; conversão SVG benigno para WebP passou. Revisão independente do diff sem achados.

Limitações: build normal bloqueado pelo proxy ao baixar Inter do Google Fonts (HTTP 403). Build suplementar passou com NEXT_FONT_GOOGLE_MOCKED_RESPONSES apontando para fixture temporária fora do repositório; não valida fontes reais nem produção. Download do navegador Playwright bloqueado pelo ambiente. Validação suplementar dos 3 E2E passou usando Chromium do sistema e respostas de fontes simuladas, com configuração temporária fora do repositório. O workflow Playwright Tests no GitHub concluiu com sucesso: https://github.com/everton-dgn/boilerplate_nextjs_app/actions/runs/38688443580. Não foi executado exploit dos avisos; evidência de remediação baseada nas versões oficiais e no lockfile.

Sem merge ou deploy.

Summary by CodeRabbit

• Maintenance
  • This update contains no specifically noted changes to the app’s features or interface. No new user-facing capabilities or fixes are described in the available release information.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 3c7497df-36df-45b1-8ba5-8219661fc8b7

📥 Commits

Reviewing files that changed from the base of the PR and between 7d445e2 and 50aea77.

⛔ Files ignored due to path filters: 1

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing: 1

• package.json

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

The next dependency in package.json was upgraded from version 16.1.3 to 16.4.1.

Changes: Next.js Dependency Upgrade

Layer / File(s)	Summary
Update Next.js version package.json	The next dependency version changes from 16.1.3 to 16.4.1.

Priority: ⬆️ High

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 50aea

The dependency update resolves to a version patched for the three reported advisories. No concrete merge-blocking risk is established; the real Google Fonts build path remains subject to normal CI validation.

Pre-merge checks: 5

Passed checks: 5 passed

Check name	Status	Explanation
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: upgrading Next.js to version 16.4.1 as a security update.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🎉 This PR is included in version 1.1.1 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀