Upgrade Next.js to 16.4.1 to address published security advisories #277

Summary

The console currently pins next and eslint-config-next to 16.3.0. Please update both dependencies to 16.4.1, regenerate the pnpm lockfile, and publish a console release containing the change.

Implementation PR: #276.

Security rationale

Next.js 16.3.8 addressed September advisories but is still within the affected ranges of the October security advisories. The official security update recommends 16.4.1 for the 16.x line:
https://nextjs.org/blog/nextjs-security-update-october-14-2026

• Critical (CVSS 9.5): GHSA-673q-mjm6-r5xr — unauthenticated RCE in App Router Cache Components when a use cache function returns multiple typed arrays. Patched in 16.4.1. GHSA-673q-mjm6-r5xr
• Critical (CVSS 9.5): CVE-2026-96889 / GHSA-2464-fhr4-w9xw — potential RCE in Image Optimization through an upstream image-processing library on glibc-based Linux. Next.js 16.4.1 ensures patched sharp; the PR lockfile resolves 0.35.5. GHSA-2464-fhr4-w9xw
• High (CVSS 8.2): GHSA-p3m5-59mp-jv5r — DoS in App Router applications using Server Actions. Patched in 16.4.1. GHSA-p3m5-59mp-jv5r

Applicability

This console uses output: "export" and images.unoptimized: true. These public advisories concern Next.js server-side features; this issue does not claim those attack paths are reachable in the statically exported RustFS console. The change updates the dependency baseline without changing the deployment model.

Verification of the proposed fix

PR #276 passed type checking, lint, formatting, all 787 existing tests, and the production static-export build under Node 22.23.4 / pnpm 12.3.4. The compiled login page and switching between Key Login and STS Login were smoke-checked in Chromium. Backend authentication and S3 operations were not exercised.

Original report

Recreated here from rustfs/rustfs#8840 because the dependency is maintained in this repository. Native GitHub transfer requires maintainer permissions; the original report and its comments remain available at that link. Official RustFS images will need to embed a console release containing the fix to deliver it downstream.