fix(deps): patch criticals on prod paths: next RCEs, sentry tunnel bypass, handlebars injection

- next 16.3.6 -> 16.4.3: two unauthenticated RCEs (use cache typed arrays,
  Image Optimization SVG) plus SSRF/DoS, in the dashboard and website
- @sentry/nextjs 10.47.0 -> 10.75.3: middleware bypass via the tunnel
  route, which apps/web enables at /monitoring
- handlebars 4.7.9 -> 4.7.10: JS injection in compile, which
  template-render runs on customer templates
- dompurify >= 3.4.17, undici >= 7.30.1, zod 4.6.7: browser-shipped
  sanitizer bypass, and DoS on api/web request paths

OpenNext 3.9.14's verified ceiling moves to 16.4: selfhost:build builds
and serves apps/web on 16.4.3. Not yet deployed to a test stage.

Left alone: seroval (only via better-auth's unused solid-js integration)
and proxy-addr (the CLI's express server never sets trust proxy).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pmXJyeVGnGP6dxRxJTiyQ

Author: stewartjarod

apps/web/package.json

@@ -63,7 +63,7 @@
     "@radix-ui/react-tooltip": "^1.2.16",
     "@react-email/components": "catalog:",
     "@react-email/render": "catalog:",
-    "@sentry/nextjs": "10.47.0",
+    "@sentry/nextjs": "10.75.3",
     "@shadcn/react": "0.2.0",
     "@tailwindcss/postcss": "^4.3.3",
     "@tanstack/pacer": "0.21.1",
@@ -108,7 +108,7 @@
     "lucide-react": "^1.27.0",
     "mailparser": "3.9.15",
     "motion": "12.23.24",
-    "next": "16.3.6",
+    "next": "16.4.3",
     "next-themes": "^0.4.6",
     "nuqs": "2.7.3",
     "pino": "10.1.0",

apps/website/package.json

@@ -62,7 +62,7 @@
     "date-fns": "^4.4.0",
     "lucide-react": "^1.27.0",
     "motion": "12.23.24",
-    "next": "16.3.6",
+    "next": "16.4.3",
     "next-themes": "^0.4.6",
     "nuqs": "2.7.3",
     "posthog-js": "1.367.0",

packages/auth/package.json

@@ -34,7 +34,7 @@
     "@better-auth/sso": "1.7.5",
     "@better-auth/stripe": "1.7.5",
     "@better-auth/utils": "0.4.2",
-    "@sentry/nextjs": "10.47.0",
+    "@sentry/nextjs": "10.75.3",
     "@vercel/oidc-aws-credentials-provider": "3.0.4",
     "@wraps.dev/better-auth": "^0.2.1",
     "@wraps.dev/client": "0.10.1",