v0.4.1 - Next.js 16.3.6 for the next/og advisory

A security release. Upgrade if you run 0.4.0 or earlier: blysis update,
and nothing to do afterwards.

Next.js 16.3.6

GHSA-vcvr-r3jv-pc5j
(CVE-2026-94545, critical) covers next from 16.2.0 up to but not including
16.3.6. The Node ImageResponse from next/og can execute code when a value
from a request reaches SVG content, attributes or styles while an image is
generated. 0.4.0 shipped 16.3.4.

Neither core nor any module shipped with Blysis imports next/og, so a stock
installation did not expose the vulnerable path. A module you installed from
elsewhere may, and the dependency floor is now ^16.3.6, so no install can
resolve an affected version.

Also updated

The dependency updates that were waiting within their declared ranges,
including next-intl 4.14.6, zod 4.6.5, resend 6.28.1, marked 18.0.14,
isomorphic-dompurify 4.3.0, lucide-react 1.47.0 and the AWS S3 client.
No behaviour change.

Image

ghcr.io/inovixi/blysis:0.4.1, also tagged 0.4, 0 and latest.