chore(deps): upgrade Next.js to 16.3.8

[charlesrhoward]

Upgrade Next.js from 16.3.6 to 16.3.8 and match eslint-config-next to 16.3.8. Regenerate the pnpm lockfile so the runtime, env helper, SWC packages, and Next ESLint plugin resolve the requested patch version.

Next.js 16.3.8 release notes

Validation: pnpm lint, pnpm types:check, all 18 existing tests, and pnpm build passed on Node 22.23.3. Verified installed Next.js and eslint-config-next are both 16.3.8.

No-tests: Dependency-only patch upgrade; existing tests/*.test.mjs, typecheck, lint, and production build cover the docs content and build contract.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
mogplex-docs	Ready	Preview	Oct 1, 2026 11:20pm UTC

[mogplex]

Mogplex PR Review

Status: No material issues found

Approve-ready: this is a correct and complete security bump of next and eslint-config-next from 16.3.6 to 16.3.8, Next.js's September 2026 security release fixing 7 CVEs including high-severity CVE-2026-94483. The regenerated pnpm-lock.yaml resolves every touched package consistently and contains no unrelated changes. The only finding is a non-blocking suggestion to surface the security-release framing in the PR title/description.

Affected files

• package.json
• pnpm-lock.yaml

Suggestions

• Surface the security-release nature of the 16.3.8 bump in the PR title/description (package.json:L38)
  • Next.js 16.3.8 is Vercel's September 2026 security release, not a routine patch release (https://nextjs.org/blog/september-2026-security-release).
  • It fixes 7 vulnerabilities, including high-severity SSRF in Image Optimization (CVE-2026-94483, exploitable only when images.remotePatterns is configured).
  • It also fixes cache poisoning of self-hosted SSG/ISR pages (CVE-2026-94543, CVE-2026-94484).
  • It also fixes App Router metadata image-route info disclosure via dynamicParams bypass (CVE-2026-94485, webpack builds only).
  • It also fixes two Cache Components cache-key and Draft Mode leaks (GHSA-h694-7cp9-m8p3, CVE-2026-94544).
  • It also fixes dev-server MCP endpoint info disclosure (CVE-2026-94486).
  • The chore(deps) title and description convey none of this, and security patches usually deserve different merge/deploy prioritization and changelog treatment than routine dependency maintenance.
  • Consider a title such as fix(deps): upgrade Next.js to 16.3.8 (September 2026 security release) with a description bullet listing the fixed CVEs.
  • The same announcement notes that fixes for one critical and one high-severity vulnerability are still pending upstream coordination, so plan a follow-up bump when that release ships.
  • Non-blocking: the dependency change itself is correct and complete.

View check run