[vqsierra]

What changed

Package	From	To
next, eslint-config-next	16.3.4	16.4.6
react, react-dom, react-server-dom-webpack	19.2.6	19.3.1
vinext	1.0.0-beta.5	1.4.5
zod	3.25.76	4.6.7
vite	8.0.13	8.3.8
wrangler, @cloudflare/vite-plugin, @cloudflare/workers-types	4.92.0, 1.37.1, 4.x	4.162.0, 1.69.1, 5.x
@vitejs/plugin-rsc, @vitejs/plugin-react	0.5.26, 6.0.2	0.5.39, 6.3.0

npm audit goes from 30 findings (2 critical, 14 high) to 11 moderate. Those are in @vercel/og (through fflate and satori) and the TypeScript lint tools (through minimatch), and have no non-breaking fix yet.

Code changes

• worker/index.ts: the development server's policy allows eval, which React 19.3's development build needs. The built site's policy is unchanged.
• scripts/check-build.mjs:
  • asserts the built Worker never allows eval;
  • finds the Worker code in the chunk Vinext 1.4 now writes it to;
  • records three references that are never loaded: Vinext's http://n placeholder base, and the JSON Schema version names inside Zod 4.
• THIRD_PARTY_NOTICES.md: versions and license counts from the new lockfile.

Checks

• npm run verify passes (22 tests, lint, types, build, build check).
• On the development server and on the built site under local Wrangler: the relay lifecycle test and the phone-size participant test pass. The console test passes on the local console.
• The built site sends the same security headers as before.
• wrangler deploy --dry-run packages the new build layout. Nothing was deployed.