v0.13.0

Security

pnpm audit goes from 54 vulnerabilities (2 critical, 19 high) to 20 (0 critical, 1 high):

• Next.js 16.3.5 fixes two critical unauthenticated remote code execution advisories (Image Optimization API; Windows-hosted servers).
• Transitive fixes in sharp (libvips / libheif), postcss, hono / @hono/node-server, fast-uri, ip-address, brace-expansion, js-yaml, qs, and nanoid.

Changed

• Updated dependencies to their latest patch/minor releases within the current major versions, including the AWS SDK clients (3.1137.0), Next.js and eslint-config-next (16.3.5), React and React DOM (19.3.0), Zod (4.6.5), @modelcontextprotocol/sdk (1.30.0), Radix UI primitives, @upstash/ratelimit (2.1.0), @upstash/redis (1.39.0), Zustand, Yjs, Framer Motion (12.43.0), tailwind-merge (3.7.0), and the TypeScript ESLint toolchain (8.70.1).

Fixed

• next dev no longer fails at startup: @ducanh2912/next-pwa injects a webpack config while Turbopack is the default dev bundler in Next.js 16, so an empty turbopack: {} config was added. Production builds still use --webpack.

Added

• Next.js-generated agent rules files (AGENTS.md + pointer file) that direct coding agents to the version-matched docs in node_modules/next/dist/docs/.

Deferred

• Major upgrades pending dedicated migration: TypeScript 7, Tailwind CSS 4, ESLint 10, Framer Motion 13, @vercel/analytics 2, dotenv 18, @types/node 26, lucide-react 1.x, and elkjs 0.12.
• Remaining transitive advisories: dompurify (via monaco-editor) and serialize-javascript (via next-pwa, build-time only).

Full changes: #52, #53