chore(deps): bump the runtime group with 5 updates

[dependabot]

Bumps the runtime group with 5 updates:

Package	From	To
sharp	0.35.4	0.35.5
@redis/client	6.2.1	6.3.0
lucide-react	1.48.0	1.49.0
next	16.3.6	16.3.8
qr	0.7.0	0.7.2

Updates sharp from 0.35.4 to 0.35.5

Release notes

Sourced from sharp's releases.

v0.35.5

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.4

• Add upper bounds check on length of linear and GIF delay arrays.

• Improve error handing when WebAssembly fallback also fails. #4593 @​lazerg

• TypeScript: Allow multi-frame options for JXL output. #4602 @​ramin-010

• TypeScript: Remove non-existent named export. #4604

• Increase accepted dimensions when extending an image. #4605

• Improve gain map support for extract and rotate operations. #4606

• Tests: Ensure composite tests pass on big endian platforms. #4609

v0.35.5-rc.1

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.4-rc.1

• Add upper bounds check on length of linear and GIF delay arrays.

• Improve error handing when WebAssembly fallback also fails. #4593 @​lazerg

• TypeScript: Allow multi-frame options for JXL output. #4602 @​ramin-010

• TypeScript: Remove non-existent named export. #4604

• Increase accepted dimensions when extending an image. #4605

• Improve gain map support for extract operation. #4606

... (truncated)

Commits

• 51a990f Release v0.35.5
• 96de105 Upgrade to sharp-libvips v1.3.4
• 3a61390 CI: Configure Dependabot with all package.json locations
• 4940c50 Improve gain map support for rotate/flip/flop ops
• 20654aa Prerelease v0.35.5-rc.1
• ef4f934 CI: Upgrade to Ubuntu 26.04
• 358df95 Upgrade to libvips v8.18.7
• 49f4903 Improve gain map support for rotate-then-extract #4606
• 0e2e55e Silence a couple of compiler/static analysis warnings
• cef3b8c Improve gain map support for extract operation #4606
• Additional commits viewable in compare view

Updates @redis/client from 6.2.1 to 6.3.0

Commits

• 6b63940 Release json@6.3.0
• 7b732cd Release bloom@6.3.0
• badfdf0 Release client@6.3.0
• bfdd485 ci: use npm trusted publishing for releases (#3480)
• 0afa8d8 chore(deps): bump brace-expansion (#3485)
• 6ee8ca2 chore(deps): bump ip-address from 10.4.0 to 10.7.2 (#3482)
• d28309b feat(client): add bless commands family (#3483)
• 307dee9 fix(client): keep String.prototype in fast mode after defining VerbatimString...
• c2494d0 fix: replace deprecated npm -ws shorthand (#3477)
• 8450162 fix(otel): fix disabled and inaccurate metrics (#3229) (#3474)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​redis/client since your current version.

Updates lucide-react from 1.48.0 to 1.49.0

Release notes

Sourced from lucide-react's releases.

Version 1.49.0

What's Changed

• feat(icons): added letters icon by @​karsa-mistmere in lucide-icons/lucide#4779
• fix(packages): declare @types/react as an optional peer dependency by @​unrevised6419 in lucide-icons/lucide#4892
• feat(icons): added bangladeshi-taka icon by @​TanvirMahin24 in lucide-icons/lucide#4869
• feat(icons): added printer-3d icon by @​Azuzula in lucide-icons/lucide#4414

New Contributors

• @​unrevised6419 made their first contribution in lucide-icons/lucide#4892
• @​TanvirMahin24 made their first contribution in lucide-icons/lucide#4869
• @​Azuzula made their first contribution in lucide-icons/lucide#4414

Full Changelog: lucide-icons/lucide@1.48.0...1.49.0

Commits

• e042fec fix(packages): declare @types/react as an optional peer dependency (#4892)
• See full diff in compare view

Updates next from 16.3.6 to 16.3.8

Release notes

Sourced from next's releases.

v16.3.8

This release contains security fixes for the following advisories:

High:

• Server-Side Request Forgery in Image Optimization

Medium:

• Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass
• Cache poisoning of SSG and ISR pages in self-hosted Next.js applications
• Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service
• Pending use cache fill can leak Draft Mode content into regular responses and persisted pages
• Cache leak across root param values in nested 'use cache' functions

Low:

• Information disclosure in the Next.js development server's Model Context Protocol endpoint

v16.3.7

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• turbo-tasks-backend: fix strongly consistent read hanging on a canceled task (#98931)

Credits

Huge thanks to @​lukesandberg for helping!

Commits

• b0fad0d v16.3.8
• 719e4c6 [lts-active] Scope response cache keys to their source route (#218)
• e92db45 [lts-active] Fix metadata propagation for deduplicated nested caches (#223)
• 40c2ba9 [lts-active] Match Next data paths case-sensitively (#196)
• 2d9f50a [lts-active] Fix MCP middleware DNS rebinding (#213)
• bd9214f [lts-active] Fix draft mode leaks through cross-request 'use cache' dedupli...
• 8db4a62 [lts-active][webpack] Ensure dynamicParams is respected in `opengraph-image...
• e002ad6 [lts-active] fix(next/image): Pin DNS resolution when fetching external image...
• 4c20699 v16.3.7
• 2521aec [backport] turbo-tasks-backend: fix strongly consistent read hanging on a can...
• See full diff in compare view

Updates qr from 0.7.0 to 0.7.2

Release notes

Sourced from qr's releases.

0.7.2

• Decoder: additional large speed-up on small symbols, 2x on camera frames
• Decoder: opt-in nativeLimit to skip full-resolution finder search
• Decoder: read mirror images
• Encoder: 30% speed-up; 3x for svg
• DOM: fix native VideoFrame path being disabled for a stream started before its first frame

Full Changelog: paulmillr/qr@0.7.0...0.7.2

0.7.1

• Decoder: additional large speed-up on small symbols, 2x on camera frames
• Decoder: opt-in nativeLimit to skip full-resolution finder search
• Decoder: read mirror images
• Encoder: 30% speed-up; 3x for svg
• DOM: fix native VideoFrame path being disabled for a stream started before its first frame

Full Changelog: paulmillr/qr@0.7.0...0.7.1

Changelog

Sourced from qr's changelog.

0.7.2 (2026-09-28)

• Decoder: additional large speed-up on small symbols, 2x on camera frames
• Decoder: opt-in nativeLimit to skip full-resolution finder search
• Decoder: read mirror images
• Encoder: 30% speed-up; 3x for svg
• DOM: fix native VideoFrame path being disabled for a stream started before its first frame

Commits

• 951806d Release 0.7.2.
• 671fd2b Minor bugfixes
• 9985d62 Release 0.7.1.
• e90a06b Merge pull request #40 from shreeve/mirror
• 16d1df5 decoder: read mirror images by retrying on the transposed grid
• 2fcb00c Merge pull request #39 from shreeve/perf
• 4b86f34 changelog: note the decoder, encoder and DOM changes
• 023913d decoder: opt-in nativeLimit skips the full-resolution finder search
• 16c02b1 decoder: size version scratch to the symbol actually attempted
• d3a5667 decoder: grow finder records on demand
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions