[narcisonunez]

Resolves Dependabot alerts #311–#320. Dependabot opened them when #215 merged and rescanned against new advisories. #215 didn't change the next or zod versions.

• next 16.3.8 → 16.4.2 in apps/website and apps/docs (alerts #311–#319):

  • GHSA-673q-mjm6-r5xr (critical): remote code execution in use cache functions.
  • GHSA-2464-fhr4-w9xw (critical): remote code execution in the Image Optimization API with SVGs.
  • GHSA-p3m5-59mp-jv5r (high): denial of service via Server Actions.

  16.4.1 is the security release. 16.4.2 adds only LTS backports (Turbopack and docs fixes). 16.4.3 was published today, so I skipped it. The 16.4 removals all affect experimental or internal code paths (appNewScrollHandler, legacy PPR, unstable_eager), and neither app uses any of them.

• zod 4.1.11 / 4.1.13 → 4.6.7 (alert #320, GHSA-mrhx-c7xc-m3w5): zod is only a transitive dependency (fumadocs-core, fumadocs-mdx, @scalar/openapi-types). @scalar/openapi-types pins 4.1.11 exactly, so I added a zod@<4.6.6 override in the same style as the existing ones. It's a semver-minor bump within 4.x.

• Lockfile diff: only next, its @next/swc-* binaries and zod. caniuse-lite drops out because next 16.4 no longer depends on it.

No breaking changes

• pnpm biome ci and pnpm typecheck pass (same steps as CI).
• apps/website and apps/docs both build. The build logs show the same 4 blog CMS fetch errors as main, because the CMS isn't reachable locally.
• E2E on the production builds:
  • Website: /, /blog, /pricing and /contact return 200, and the home page renders fully in the browser.
  • Docs: /docs/core, /docs/api and an OpenAPI endpoint page render with fumadocs (which uses zod), and /api/search returns results.
  • Image optimizer: /_next/image returns 200 image/png on both apps.
  • Browser console: no errors.