fix(deps): update consumer fixture dependencies

[nocoo]

Four consumer fixtures still requested Lucide 1.48.0 even though the catalog had moved to 1.49.0. Align those fixture declarations and patch the Next consumer from 16.3.6 to 16.3.8, which fixes six newly reported advisories. Keep the existing exact-version contract assertions and fixture documentation aligned. The root dependency graph is unchanged.

Issues

Closes #532
Closes #534

Validation

• Normal pre-commit: package build, strict typecheck/lint, staged secret scan, 217 test files / 1878 tests passed; all four coverage metrics remain above95%.
• Frozen install, catalog/package builds, public types, package verification, strict publint, root OSV and Gitleaks passed.
• Isolated tarball consumers: install, typecheck, build and lockfile security scans; all four consumers passed at the candidate head.
• Current-head CI must pass the full configured package, HTTP and browser consumer gates before merge. No local browser suite or production deployment was run.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	theme-basalt	28a0309	Oct 07 2026, 10:21 PM