[ericzakariasson]

Fixes every advisory reported by Dependabot and bun audit. After this PR, bun audit reports no vulnerabilities.

Next.js 16.2.6 -> 16.4.3

Covers all 20 open Dependabot alerts, including the critical RCEs in next/og ImageResponse (GHSA-vcvr-r3jv-pc5j) and the Image Optimization API for SVG/AVIF (GHSA-2464-fhr4-w9xw, GHSA-2xp9-vwfh-vxw4), plus several high-severity SSRF and DoS issues. Also brings sharp 0.35.5, which clears its libvips advisories. 16.4.4 is newer, but its @next/* packages are still inside bunfig's minimumReleaseAge window.

Transitive advisories (only visible to bun audit)

bun audit reported 54 more advisories (1 critical, 27 high) in packages Dependabot doesn't surface from bun.lock:

• @cursor/sdk 1.0.12 -> 1.2.0 drops sqlite3 and its node-gyp/prebuild tree, which removes the undici, tar@6, @fastify/busboy, ip-address, brace-expansion and @tootallnate/once advisories.
• next-safe-action 8.5.2 -> 8.7.3 drops deepmerge-ts.
• tar, nanoid, postcss, zod bumped to patched versions. The root zod override/resolution moves to 4.6.7 so nested copies stay on one version (the reason it was pinned in the first place).
• Stale nested lockfile entries for postcss, nanoid, source-map-js and baseline-browser-mapping now resolve to the patched hoisted versions.

Code change: plugin scan state root

SDK 1.2.0 removed the platform option the scan used to keep the SDK's run store on writable tmpfs (#395). The scan now opens a SqliteLocalAgentStore (built on node:sqlite, no native module) at the same tmp stateRoot, passes it as local.store, and disposes it when the scan finishes.

Testing

• bunx biome ci . and bun run typecheck pass.
• bun install --frozen-lockfile succeeds and bun audit is clean.
• next build compiles and typechecks. Locally it then stops at the known empty-database generateStaticParams check, so the Vercel preview is the full build check.
• Smoke test: SqliteLocalAgentStore opens index.db under a tmp state root and disposes cleanly on Node 24.
• End-to-end scan under next dev (Node): queued a test plugin pointing at octocat/Hello-World, triggered /api/queue/plugin-scans/drain, and the scan downloaded the repo, ran composer-2 through Agent.prompt with the new store, and wrote a safe verdict. The SDK state landed in <tmp>/cursor-sdk-home/sdk-agent-store/index.db, and the store closed cleanly.