[waleedlatif1]

Summary

• Next.js 16.4.0 → 16.4.1 (with @next/env and the swc binaries). 16.4.1 fixes two critical advisories and one high (GHSA-2464-fhr4-w9xw, GHSA-673q-mjm6-r5xr, GHSA-p3m5-59mp-jv5r). Sim was not exposed to any of them: sharp is already 0.35.5 (the image-optimizer workaround), and the app has no 'use cache' functions or Server Actions. 16.4.2 adds only Turbopack and docs fixes and is still inside the 7-day release-age gate
• patches/next@16.4.0.patch (Vary merging, see patches/README.md) is now next@16.4.1.patch. bun keys patches by exact version and silently dropped it on the bump, which docs HTTP's header E2E caught. The patched patch-set-header.js files are byte-identical in 16.4.0 and 16.4.1, and the patch applies cleanly
• parseOfficeText now refuses anything that isn't a ZIP package. officeparser 5 sniffs every buffer with file-type 16, whose ASF detector loops forever on a zero-size sub-header (GHSA-5v7r-6r5c-r473; no 16.x fix, and officeparser 8 is a rewrite). A 55-byte upload named .docx or .odt reached that path once mammoth or the ODF walker rejected it, and stalled the event loop. Every format routed to officeparser is a ZIP package, so nothing legitimate is turned away
• Patched transitive versions through root overrides:
  • @ai-sdk/provider-utils 3.0.28: response bodies get a size limit (Stagehand's AI SDK providers)
  • image-size 2.0.4: pptxgenjs declares it but only references it in commented-out code
  • source-map-js 1.2.2, fast-copy 4.2.0 and baseline-browser-mapping 2.11.28: build and dev tooling
• electron joins next in minimumReleaseAgeExcludes. Its exact security pin (43.8.1, from fix(tls): distrust the roots behind the compromised eMudhra intermediates #9248) is under 7 days old until Oct 27. Vercel builds with bun 1.3.14, which re-checks that pin against the gate whenever the lockfile changes, so the docs preview failed in bun install. Reproduced with 1.3.14 locally; the exclusion fixes it and leaves the lockfile unchanged

Remaining bun audit findings, checked and not reachable

• braces (no fix): Sim only calls micromatch.isMatch/matcher, which go through picomatch; braces is reached only by build tooling (fast-glob, chokidar)
• http-cache-semantics (no fix): only through got in electron's download step and artillery; no shared cache
• file-type: covered by the guard above
• js-yaml 3.x: gray-matter on our own content, and artillery. Sim's own YAML parsing is on 4.3.2
• fflate 0.4/0.7: posthog-js and opentype.js never call unzip
• uuid 9: gaxios and teeny-request only call v4(), with no buf argument
• @opentelemetry/core 2.7.1: inside Trigger.dev workers, which take no inbound HTTP baggage
• sprintf-js: tedious and roarr only use constant format strings
• csv-parse, moment, esbuild 0.18, vite 8.0, postcss-selector-parser, katex: dev, load-test or build tooling, or need prototype pollution that already exists
• @better-auth/oauth-provider GHSA-p2fr: not exploitable here; fixed only in 1.7.x

Type of Change

• Bug fix

Testing

• apps/docs test:headers:e2e: 16/16 checks pass with the patch carried to 16.4.1 (failed in CI without it)
• officeparser-module.test.ts: the 55-byte ASF payload is refused with invalid_format before officeparser receives it. With the guard reverted, the test fails in milliseconds. Locally, against the real docx and odt parsers, the payload hung the process until a 60s watchdog killed it; with the guard, both settle
• bun audit before and after: the Next.js, ai-sdk, image-size, source-map-js, fast-copy and baseline-browser-mapping findings are gone
• Lockfile diff contains only the versions listed above

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Oct 22, 2026 8:31pm UTC

[cubic-dev-ai]

All reported issues were addressed

<sub>Heads up: you’re close to your flex budget. Increase your flex budget so reviews don’t pause.

Turn on auto-fix | Re-trigger cubic</sub>

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; both previous findings are addressed and no new actionable issue was found.

Summary

Updates Next.js to 16.4.1, patches several transitive dependencies, and rejects non-ZIP input before it reaches officeparser.

• Office parser fallbacks reject buffers that are not ZIP packages.
• The workspace uses Next.js 16.4.1 with its Vary header patch.
• Workspace installs now resolve patched versions of selected shared packages.
• Bun lets the pinned Electron release skip the age wait.

_{Reviews (2) · Last reviewed commit: "test(file-parsers): prove the ZIP guard ..." · Reviewed by Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 12 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

<sub>Heads up: you’re close to your flex budget. Increase your flex budget so reviews don’t pause.

Turn on auto-fix | Re-trigger cubic</sub>