[bgramaje]

Pull Request

Description

Update next and eslint-config-next from 16.3.0 to 16.4.1 and regenerate pnpm-lock.yaml with the repository's pnpm 12.3.4. Keep the static-export configuration and application code unchanged.

Next.js 16.3.8 fixed the September security advisories, including SSRF in Image Optimization and cache poisoning/information disclosure issues, but it remains within the affected ranges of the October advisories. The official October security update recommends 16.4.1 for the 16.x line:
https://nextjs.org/blog/nextjs-security-update-october-14-2026

The dependency update includes fixes for:

• Critical — GHSA-673q-mjm6-r5xr (CVSS 9.5): unauthenticated remote code execution in App Router Cache Components when a use cache function returns multiple typed arrays. Patched in 16.4.1.
  GHSA-673q-mjm6-r5xr
• Critical — CVE-2026-96889 / GHSA-2464-fhr4-w9xw (CVSS 9.5): potential remote code execution in Image Optimization through an upstream image-processing library on glibc-based Linux. Next.js 16.4.1 ensures a patched sharp version; the regenerated lockfile resolves sharp to 0.35.5.
  GHSA-2464-fhr4-w9xw
• High — GHSA-p3m5-59mp-jv5r (CVSS 8.2): denial of service from excessive CPU usage in App Router applications using Server Actions. Patched in 16.4.1.
  GHSA-p3m5-59mp-jv5r

Applicability: this console currently uses output: "export" and images.unoptimized: true. The advisories above concern Next.js server-side features; this PR does not claim those attack paths are reachable in the statically exported RustFS console. It updates the build dependency baseline to the vendor-recommended patched version without changing the deployment model.

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Code refactoring
• Performance improvement
• Test improvements
• Security fix

Testing

Verified using Node 22.23.4 and pnpm 12.3.4:

• corepack pnpm install --frozen-lockfile — passed.
• corepack pnpm type-check — passed.
• corepack pnpm lint — passed.
• corepack pnpm format:check — passed.
• corepack pnpm test:run — 787 passed, 0 failed.
• corepack pnpm build — passed with Next.js 16.4.1; static export generated successfully.
• Served the production out/ directory locally; visually checked /rustfs/console/auth/login/ in Chromium and switched between Key Login and STS Login successfully.

No backend authentication or S3 operations were exercised. The static-only smoke server produced an aborted HEAD request to /rustfs/console/config/; no RustFS API backend was attached.

• Unit tests added/updated (dependency-only change; existing suite run)
• Manual testing completed (static login surface and tab interaction only)

Checklist

• Code follows the project's style guidelines
• Self-review completed
• TypeScript types are properly defined (no application/type changes)
• All commit messages are in English (Conventional Commits): fix(deps): upgrade Next.js to 16.4.1 security baseline
• All existing tests pass
• No new dependencies added, or they are justified (existing direct dependency upgrades only)

Related Issues

Related issue: #277 (#277).

This supersedes the original report in rustfs/rustfs#8840, now closed with a reference to the console issue.

Screenshots (if applicable)

No intentional UI changes.

Additional Notes

RustFS release maintainers will need to publish and embed a console release containing this update for downstream RustFS images to include it. Updating a console source dependency alone does not replace already published server images.

[bgramaje]

Related release-tracking issue: rustfs/rustfs#8840 (rustfs/rustfs#8840).

This PR implements the console dependency update. The issue tracks publishing a console release and embedding it in official RustFS releases/images, so it should remain open after this PR is merged until those artifacts are available.

[bgramaje]

Updated tracking issue: #277 (#277).

This replaces the previous reference to rustfs/rustfs#8840, which is now closed with a link to the new issue. The PR description and the new issue both link to each other.