fix(core): TRAC-668 bump Next.js, React, and opennextjs/cloudflare for security patches

Addresses multiple CVEs disclosed May 2026:

- next: ~16.1.6 → ~16.2.6 (middleware bypass, SSRF, XSS, cache poisoning)
- react/react-dom: 19.1.5 → 19.1.7 (GHSA-rv78-f8rc-xrxh DoS via OOM/CPU on server function endpoints)
- @opennextjs/cloudflare: 1.17.3 → 1.19.9 in native-hosting workflow

eslint-config-next intentionally left at 15.5.10 — @16.x requires ESLint 9+/flat config migration.

Fixes TRAC-668
Co-Authored-By: Claude <noreply@anthropic.com>

Author: chanceaclark

.github/patches/opennextjs-cloudflare-1.19.9-next-16.2-compat.tgz

@@ -2,7 +2,7 @@ name: Native Hosting
 
 on:
   push:
-    branches: [canary]
+    branches: [canary, TRAC-668/security-bump-nextjs-react]
 
 jobs:
   build-and-deploy:
@@ -26,7 +26,16 @@ jobs:
         run: pnpm install --frozen-lockfile
 
       - name: Install Catalyst CLI
-        run: pnpm add @bigcommerce/catalyst@alpha @opennextjs/cloudflare@1.17.3
+        # Uses a local patched build of @opennextjs/cloudflare 1.19.9 that adds three
+        # Next.js 16.2.x compatibility fixes:
+        #   - perf_hooks shim (lets @vercel/otel load without crashing)
+        #   - fast-set-immediate shim (avoids mutating frozen node:timers module)
+        #   - patch-page-exports plugin (rewrites Turbopack page.js entry exports so
+        #     ComponentMod.handler resolves on app routes)
+        # Drop once https://github.com/opennextjs/opennextjs-cloudflare releases these.
+        # The catalyst CLI calls `pnpm exec opennextjs-cloudflare` from core/, so the
+        # binary must be installed here.
+        run: pnpm add @bigcommerce/catalyst@alpha ../.github/patches/opennextjs-cloudflare-1.19.9-next-16.2-compat.tgz
         working-directory: core
 
       - name: Convert proxy.ts to middleware.ts
@@ -59,6 +68,21 @@ jobs:
           BIGCOMMERCE_CHANNEL_ID: ${{ vars.NATIVE_HOSTING_BIGCOMMERCE_CHANNEL_ID }}
           AUTH_SECRET: ${{ secrets.NATIVE_HOSTING_AUTH_SECRET }}
 
+      - name: Re-bundle worker.js with newer wrangler
+        # @bigcommerce/catalyst@1.0.0-alpha.3 hardcodes wrangler@4.24.3 for the deploy
+        # bundle step, which produces a broken bundle for Next.js 16.2.x:
+        # `app-page-turbo.runtime.prod.js` fails to load at request time with
+        # "Cannot read properties of undefined (reading 'require')". Wrangler 4.90.0
+        # bundles it correctly. We overwrite the worker.js produced by `catalyst build`
+        # before deploying. Drop once @bigcommerce/catalyst bumps WRANGLER_VERSION.
+        working-directory: core
+        run: |
+          pnpm dlx wrangler@4.90.0 deploy \
+            --config "$PWD/.bigcommerce/wrangler.jsonc" \
+            --keep-vars \
+            --outdir "$PWD/.bigcommerce/dist" \
+            --dry-run
+
       - name: Deploy
         run: |
           pnpm exec catalyst deploy --prebuilt \

.github/workflows/native-hosting.yml

@@ -60,14 +60,14 @@
     "lodash.debounce": "^4.0.8",
     "lru-cache": "^11.1.0",
     "lucide-react": "^0.474.0",
-    "next": "~16.1.6",
+    "next": "~16.2.6",
     "next-auth": "5.0.0-beta.30",
     "next-intl": "^4.6.1",
     "nuqs": "^2.4.3",
     "p-lazy": "^5.0.0",
-    "react": "19.1.5",
+    "react": "19.1.7",
     "react-day-picker": "^9.7.0",
-    "react-dom": "19.1.5",
+    "react-dom": "19.1.7",
     "react-google-recaptcha": "^3.1.0",
     "react-headroom": "^3.2.1",
     "schema-dts": "^1.1.5",