chore: bump Next.js from 16.3.4 to 16.3.5

[cursor]

Track

Weekly keep-modern: patch/minor dependency bumps. pnpm format:check is already clean on main (format-gate PR #10), so this run takes the next highest-value track.

Why

next@16.3.4 is one Active LTS patch behind v16.3.5 (2026-09-11). This storefront uses next/image for product, cart, search, and layout images, so the disk-cache hardening is in scope.

Changelog (16.3.4 → 16.3.5)

Patch-only backport. No major migration, no middleware.ts reintroduction (proxy.ts stays).

• next/image: skip 0-byte entries when initializing the disk LRU cache (#98185) — avoids a poisoned cache singleton from a single empty file.
• next/image: reject empty images when reading/writing the disk cache (#98186).
• Emit whole-app server NFTs when output: 'standalone' is used with an adapter (#98167) — we do not set output: 'standalone'.
• Add CSP nonce to script tags of loading and template files (#98403).
• Fix use cache prerender signal retention (#98448) — we do not use use cache yet.

Bumps

Package	From	To	Notes
next	16.3.4	16.3.5	Patch. proxy.ts still registered as Proxy (Middleware).

Highlighted packages already at latest in-range: react/react-dom 19.2.8, @finqu/storefront-sdk 1.3.0, @puckeditor/core 0.21.3, tailwindcss 4.3.3.

Intentionally not bumped

• React 19.3.0 — Next 16.3.5 still peers ^18.2.0 || ^19.0.0 with no 19.3 callout. Stay on 19.2.8 until Next documents it.
• Puck 0.23 — SDK 1.3 still peers @puckeditor/core@^0.21.0 (^0.21 does not include 0.22/0.23).
• lucide-react 1.x, @finqu/cli 3.x, typescript 7.x — majors without a migration pass.

Verification

• pnpm format:check passes.
• pnpm typecheck passes once .storefront/ is generated (finqu storefront build --components=./blocks). That directory is gitignored and not in this PR.
• next build on 16.3.5 compiles; all routes remain dynamic; Proxy still detected. Live storefront was not smoked (no Finqu credentials in this environment).

Follow-ups

• Refresh Finqu agent skills, or add optimizePackageImports for lucide-react.
• Puck 0.23 after the SDK raises its peer range.
• React 19.3 once Next 16.3.x (or 16.4) documents support.

  

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
theme-headless-nexus	Ready	Preview	Sep 17, 2026 6:19am UTC

[cursor]

Left a non-blocking comment: GitHub blocked approval because this is a self-authored Cursor PR, and Cursor Bugbot was not present after the first check poll. Remaining signals were clean; no reviewers were assigned.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}