chore(deps): upgrade all dependencies; next 16.4.3 (RCE GHSA-2464-fhr4-w9xw)

.nixpacks/Dockerfile

@@ -11,7 +11,7 @@
 # inside the container, answers / for the deploy health check, reads its secrets
 # from app.env at run time. NEXT_PUBLIC_BASE_URL arrives as a compose build arg.
 
-FROM oven/bun:1.4.0-slim AS deps
+FROM oven/bun:1.4.4-slim AS deps
 WORKDIR /app
 # The whole workspace manifest set: bun installs per-package trees.
 COPY package.json bun.lock ./
@@ -27,7 +27,7 @@ ENV NEXT_TELEMETRY_DISABLED=1 TURBO_TELEMETRY_DISABLED=1
 # turbo -> `bun --bun next build` in apps/web: Next builds on Bun, not Node.
 RUN bun run build:web
 
-FROM oven/bun:1.4.0-slim AS runtime
+FROM oven/bun:1.4.4-slim AS runtime
 WORKDIR /app
 ENV NODE_ENV=production
 ENV NEXT_TELEMETRY_DISABLED=1

apps/cli/package.json

@@ -15,14 +15,14 @@
     "clean": "rm -rf dist node_modules"
   },
   "dependencies": {
-    "commander": "^12.0.0",
-    "chalk": "^5.3.0",
-    "ora": "^8.0.0",
-    "dotenv": "^16.0.0"
+    "commander": "^15.0.0",
+    "chalk": "^6.0.1",
+    "ora": "^9.4.1",
+    "dotenv": "^18.0.9"
   },
   "devDependencies": {
-    "@types/node": "^22",
-    "tsx": "^4.19.0",
-    "typescript": "^5.7.0"
+    "@types/node": "^26.6.5",
+    "tsx": "^4.23.15",
+    "typescript": "^7.0.2"
   }
 }

apps/cli/tsconfig.json

@@ -8,7 +8,8 @@
     "strict": true,
     "esModuleInterop": true,
     "skipLibCheck": true,
-    "declaration": true
+    "declaration": true,
+    "types": ["node"]
   },
   "include": ["src/**/*"],
   "exclude": ["node_modules", "dist"]

apps/web/package.json

@@ -14,30 +14,30 @@
     "clean": "rm -rf .next out node_modules"
   },
   "dependencies": {
-    "@anthropic-ai/sdk": "^0.104.1",
-    "@profullstack/bridges": "^0.1.0",
+    "@anthropic-ai/sdk": "^1.3.0",
+    "@profullstack/bridges": "^0.2.0",
     "@profullstack/footer": "latest",
     "@profullstack/libsql-pg": "^0.1.4",
     "@profullstack/stack": "0.5.0",
-    "@profullstack/x402-gateway": "^0.11.0",
-    "@serwist/next": "^9.5.0",
-    "next": "16.3.8",
-    "posthog-js": "^1.381.0",
-    "react": "19.2.4",
-    "react-dom": "19.2.4",
-    "sanitize-html": "^2.17.5",
-    "serwist": "^9.5.0"
+    "@profullstack/x402-gateway": "^0.13.1",
+    "@serwist/next": "^9.5.13",
+    "next": "16.4.3",
+    "posthog-js": "^1.438.23",
+    "react": "19.3.1",
+    "react-dom": "19.3.1",
+    "sanitize-html": "^2.18.1",
+    "serwist": "^9.5.13"
   },
   "devDependencies": {
-    "@libsql/client": "^0.17.4",
-    "@tailwindcss/postcss": "^4",
-    "@types/node": "^22",
-    "@types/react": "^19",
-    "@types/react-dom": "^19",
-    "@types/sanitize-html": "^2.16.1",
-    "eslint": "^9",
-    "eslint-config-next": "16.3.8",
-    "tailwindcss": "^4",
-    "typescript": "^5"
+    "@libsql/client": "^0.18.0",
+    "@tailwindcss/postcss": "^4.3.3",
+    "@types/node": "^26.6.5",
+    "@types/react": "^19.3.0",
+    "@types/react-dom": "^19.3.0",
+    "@types/sanitize-html": "^2.16.2",
+    "eslint": "^10.13.0",
+    "eslint-config-next": "16.4.3",
+    "tailwindcss": "^4.3.3",
+    "typescript": "^6.0.3"
   }
 }