[irparent]

Moves iris-eval.com to Next.js 16.4.2.

Two Next.js advisories published on 2026-10-22 cover every release up to 16.4.0:

• GHSA-2464-fhr4-w9xw (critical): remote code execution in image optimization through sharp on glibc Linux. The website already resolves sharp 0.35.5, the advisory's stated workaround; this release makes the fixed pairing the locked one.
• GHSA-p3m5-59mp-jv5r (high): denial of service through Server Actions in the App Router.

The website lockfile changes only next and its @next/* packages (regenerated on Linux, node:24); no entry is added or removed. eslint-config-next stays at 16.3.8, so lint behaviour is unchanged. This supersedes #870, which moves to 16.4.0.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
website	Ready	Preview	Oct 22, 2026 4:45pm UTC

[github-actions]

Iris gate — 1 of 2 tripped --fail-on detector_veto

iris-eval ingest: 3 stored, 1 tripped --fail-on detector_veto (2 of 3 evaluated in dataset "release-gate")

Trace	Verdict	Basis	Rules, classes or missing inputs	Evidence
7e961da48e851797b8ed9bd2bdc8925b	failed	detector_veto + risk_over_loss	no_pii, pii_leak, credential_leak	no_pii: AWS Access Key (output 45–65)

Verdict basis	Traces
detector_veto	2
clean	1

Unjudged questions: task_completed (3), tool_use_correct (3) — a trace that did not carry what a rule needs.

_{tests/fixtures/ci-gate/traces.ndjson · 3 evaluated · dataset release-gate: 2 in the gate · exit 1 · what the bases mean}

[github-actions]

Iris gate — 1 stored, nothing tripped --fail-on any

iris-eval ingest: 1 stored, 0 tripped --fail-on any

Verdict basis	Traces
clean	1

Unjudged questions: task_completed (1), tool_use_correct (1) — a trace that did not carry what a rule needs.

_{tests/fixtures/ci-gate/clean.ndjson · 1 evaluated · exit 0 · what the bases mean}