v1.6.2 - Next.js advisories closed

A security patch: Next.js, zod and the test tooling move to fixed versions, and the image is rebuilt on a patched Alpine base.

Upgrading

Nothing to do. There is no migration, and environment variables, port and the Alpine image base are unchanged.

Security

• next 16.3.8 to 16.4.3. This closes GHSA-2464-fhr4-w9xw and GHSA-673q-mjm6-r5xr (critical) and CVE-2026-94482 (high), found by Trivy in the 1.6.1 image. None of them was reachable in Gardik: image optimization is disabled, the image runs on musl rather than glibc, and the app uses neither use cache nor Server Actions.
• zod 4.6.5 to 4.6.7 closes GHSA-mrhx-c7xc-m3w5 (high), a memory exhaustion when validating oversized constrained collections. zod runs in production through better-auth.
• fast-uri 3.1.8 to 3.1.9 (override) closes four moderate URI parsing advisories.
• vitest and @vitest/coverage-v8 5.0.1 to 5.0.5, with vite 8.3.5, close GHSA-qxg6-89mg-rqv8 and GHSA-xp26-3454-mjgp. These only run in development and tests.
• musl 1.2.6-r2 to 1.2.6-r3 (CVE-2026-107891) through the rebuilt node:26-alpine base.

Licenses

• THIRD-PARTY-NOTICES.md now lists 539 runtime packages instead of 542, following the dependency changes.