fix(core): TRAC-668 bump Next.js, React, and opennextjs/cloudflare for security patches

Addresses multiple CVEs disclosed May 2026:

- next: ~16.1.6 → ~16.2.6 (middleware bypass, SSRF, XSS, cache poisoning)
- react/react-dom: 19.1.5 → 19.1.7 (GHSA-rv78-f8rc-xrxh DoS via OOM/CPU on server function endpoints)
- @opennextjs/cloudflare: 1.17.3 → 1.19.8 in native-hosting workflow

eslint-config-next intentionally left at 15.5.10 — @16.x requires ESLint 9+/flat config migration.

Fixes TRAC-668
Co-Authored-By: Claude <noreply@anthropic.com>

Author: chanceaclark

.github/workflows/native-hosting.yml

@@ -26,7 +26,7 @@ jobs:
         run: pnpm install --frozen-lockfile
 
       - name: Install Catalyst CLI
-        run: pnpm add @bigcommerce/catalyst@alpha @opennextjs/cloudflare@1.17.3
+        run: pnpm add @bigcommerce/catalyst@alpha @opennextjs/cloudflare@1.19.8
         working-directory: core
 
       - name: Convert proxy.ts to middleware.ts

core/package.json

@@ -60,14 +60,14 @@
     "lodash.debounce": "^4.0.8",
     "lru-cache": "^11.1.0",
     "lucide-react": "^0.474.0",
-    "next": "~16.1.6",
+    "next": "~16.2.6",
     "next-auth": "5.0.0-beta.30",
     "next-intl": "^4.6.1",
     "nuqs": "^2.4.3",
     "p-lazy": "^5.0.0",
-    "react": "19.1.5",
+    "react": "19.1.7",
     "react-day-picker": "^9.7.0",
-    "react-dom": "19.1.5",
+    "react-dom": "19.1.7",
     "react-google-recaptcha": "^3.1.0",
     "react-headroom": "^3.2.1",
     "schema-dts": "^1.1.5",