fix(core): TRAC-668 bump Next.js, React, and opennextjs/cloudflare for security patches

Addresses multiple CVEs disclosed May 2026:

- next: ~16.1.6 → ~16.2.6 (middleware bypass, SSRF, XSS, cache poisoning)
- react/react-dom: 19.1.5 → 19.1.7 (GHSA-rv78-f8rc-xrxh DoS via OOM/CPU on server function endpoints)
- @opennextjs/cloudflare: 1.17.3 → 1.19.8 in native-hosting workflow

eslint-config-next intentionally left at 15.5.10 — @16.x requires ESLint 9+/flat config migration.

Fixes TRAC-668
Co-Authored-By: Claude <noreply@anthropic.com>

Author: chanceaclark

.github/workflows/native-hosting.yml

@@ -2,7 +2,7 @@ name: Native Hosting
 
 on:
   push:
-    branches: [canary]
+    branches: [canary, TRAC-668/security-bump-nextjs-react]
 
 jobs:
   build-and-deploy:
@@ -26,7 +26,7 @@ jobs:
         run: pnpm install --frozen-lockfile
 
       - name: Install Catalyst CLI
-        run: pnpm add @bigcommerce/catalyst@alpha @opennextjs/cloudflare@1.17.3
+        run: pnpm add @bigcommerce/catalyst@alpha @opennextjs/cloudflare@1.19.8
         working-directory: core
 
       - name: Convert proxy.ts to middleware.ts

core/instrumentation.ts

@@ -51,8 +51,11 @@ import { registerOTel } from '@vercel/otel';
  * - Official Next.js guide: https://nextjs.org/docs/app/guides/open-telemetry
  */
 export function register() {
-  // Service name is pulled from the OTEL_SERVICE_NAME env var.
-  // If you wish to manually set it, you can remove the env var and set it here:
-  // registerOTel({ serviceName: 'catalyst-storefront' });
-  registerOTel();
+  // @vercel/otel only works in Node.js — guard against Cloudflare Workers / edge runtimes
+  if (process.env.NEXT_RUNTIME === 'nodejs') {
+    // Service name is pulled from the OTEL_SERVICE_NAME env var.
+    // If you wish to manually set it, you can remove the env var and set it here:
+    // registerOTel({ serviceName: 'catalyst-storefront' });
+    registerOTel();
+  }
 }

core/package.json

@@ -60,14 +60,14 @@
     "lodash.debounce": "^4.0.8",
     "lru-cache": "^11.1.0",
     "lucide-react": "^0.474.0",
-    "next": "~16.1.6",
+    "next": "~16.2.6",
     "next-auth": "5.0.0-beta.30",
     "next-intl": "^4.6.1",
     "nuqs": "^2.4.3",
     "p-lazy": "^5.0.0",
-    "react": "19.1.5",
+    "react": "19.1.7",
     "react-day-picker": "^9.7.0",
-    "react-dom": "19.1.5",
+    "react-dom": "19.1.7",
     "react-google-recaptcha": "^3.1.0",
     "react-headroom": "^3.2.1",
     "schema-dts": "^1.1.5",