fix: align patched Next runtime and Cloudflare build tools

[ephraimduncan]

Main declares Next 16.3.3 in web and 16.3.6 in auth, but its committed lockfile still resolves 16.2.4. CI currently rewrites that lockfile during installation. Align both workspaces and the lockfile (including @next/env and native SWC packages) to 16.3.8, which contains the GHSA-vcvr-r3jv-pc5j fix and the additional 16.3.8 security fixes.

Update OpenNext Cloudflare 1.19.5 → 1.20.9 for Next 16.3 compatibility and its cache/request-context fixes, with Wrangler 4.87.0 → 4.125.0 to satisfy the adapter peer requirement. Only these dependency trees change; unrelated Lightning CSS and AJV lock entries are preserved. Use frozen installs in all CI jobs and add a Cloudflare Worker build job on Node 22 (the build tools require Node 22.12+ on the Node 22 line).

Validation on the final dependency versions:

• CI on commit 40e074e: all four Actions jobs pass, including 10/10 browser tests. The separate Workers Builds check also passes.
• Frozen install passes without changing the lockfile.
• 144 unit/integration tests pass; uncached lint, root typecheck, and all 10 package typechecks pass.
• Next production build and OpenNext Worker build pass.
• Local Worker smoke checks pass for homepage, repeated login rendering, PNG icon, unauthenticated dashboard redirect and session API. No remote resources or live email used.
• Broad web/tests typechecks retain exactly the existing 12/14 diagnostics; no new diagnostics. Next already skips type validation during builds.

OpenNext emits three nonfatal Failed to copy messages because its workerd export-map transformer uses in on string exports. All 36 traced package files are present and identical in the Worker output, the modules are bundled, and local runtime checks pass. The existing static ImageResponse icon takes no attacker-controlled SVG; this change does not claim exploitation occurred.

The failed main Cloudflare check exposes no diagnostic cause through GitHub. Cloudflare account build-log access was previously denied, so its specific cause remains unverified. This draft does not merge or deploy production.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	formbase-web	40e074e	Oct 06 2026, 10:33 PM