fix(security): npm security fixes (2026-09-14)

[github-actions]

Included fixes

• GHSA-wmmp-3585-3rmp (moderate): Nodemailer IDN/Punycode allow-list bypass — nodemailer 9.0.1 → 9.1.1
• GHSA-2x7j-588g-ccc2 (high): Nodemailer quadratic address parsing denial of service — nodemailer 9.0.1 → 9.1.1
• GHSA-2x7j-588g-ccc2 (moderate): Nodemailer legacy resolveContent access-control bypass — nodemailer 9.0.1 → 9.1.1
• GHSA-cc9r-2j5m-2m83 (moderate): Nodemailer recipient-domain validation bypass — nodemailer 9.0.1 → 9.1.1
• GHSA-rgj7-g3m4-5g8c (high): sharp bundled libheif vulnerabilities — sharp 0.35.3 → 0.35.4
• CVE-2026-84375 (high): js-yaml empty merge-source CPU denial of service — js-yaml 4.3.1 → 4.3.2
• GHSA-2xp9-vwfh-vxw4 (critical): Next.js AVIF image-optimization remote code execution — next 16.2.12 → 16.3.5
• CVE-2026-75604 (critical): Next.js Windows remote code execution — next 16.2.12 → 16.3.5
• CVE-2026-84373 (moderate): Vitest redirect-mock path traversal / arbitrary file read — vitest and @vitest/mocker 4.1.4 → 4.1.11
• CVE-2026-45819 (moderate): baseline-browser-mapping invalid-input denial of service — 2.10.38 → 2.11.21
• CVE-2026-84364 (moderate): Hono parseBody memory exhaustion — hono 4.13.1 → 4.13.7
• CVE-2026-84365 (moderate): Hono toSSG output-directory traversal — hono 4.13.1 → 4.13.7
• CVE-2026-84363 (moderate): Hono query-fragment parser differential — hono 4.13.1 → 4.13.7
• CVE-2026-84369 (moderate): SVGO foreignObject executable HTML sanitization bypass — svgo 4.0.2 → 4.1.0
• CVE-2026-84370 (high): SVGO executable-link sanitization bypass — svgo 4.0.2 → 4.1.0

Risks

None. All included upgrades stay within their existing major versions.

Skipped

• CVE-2026-40345 / GHSA-ggr8-5vv4-36mx: deepmerge-ts remains at 7.1.5. The upstream advisory confirms 8.0.0 as the first patch and no 7.x backport; its only parent, @prisma/config 6.19.3, pins the 7.x line. No compatible parent release was verified, so forcing the major dependency would be unsafe.

Verification

• pnpm install --no-frozen-lockfile