chore: Bump vulnerable deps (#37244)

* Bump brace-expansion.

* Bump next to non-vuln version.

* Remove old version of @vercel/flags.

* Try to bump prismjs again.

* Bump fastify.

* Dedupe graphql.

* Bump form-data.

apps/studio/package.json

@@ -65,7 +65,6 @@
     "@tanstack/react-query-devtools": "4.35.7",
     "@tanstack/react-table": "^8.21.3",
     "@uidotdev/usehooks": "^2.4.1",
-    "@vercel/flags": "^2.6.0",
     "@vercel/functions": "^2.1.0",
     "@vitejs/plugin-react": "^4.3.4",
     "@zip.js/zip.js": "^2.7.29",

package.json

@@ -70,7 +70,8 @@
       "@tanstack/directive-functions-plugin>vite": "catalog:",
       "@tanstack/react-start-plugin>vite": "catalog:",
       "esbuild": "^0.25.2",
-      "payload>image-size": "1.2.1"
+      "payload>image-size": "1.2.1",
+      "@redocly/respect-core>form-data": "^4.0.4"
     },
     "neverBuiltDependencies": ["libpg-query"]
   },

packages/ui-patterns/package.json

@@ -544,6 +544,6 @@
     "vitest": "^3.0.5"
   },
   "peerDependencies": {
-    "next": "*"
+    "next": "catalog:"
   }
 }

pnpm-workspace.yaml

@@ -8,7 +8,7 @@ catalog:
   '@supabase/auth-js': 2.71.1-rc.1
   '@supabase/supabase-js': ^2.47.14
   '@supabase/realtime-js': ^2.11.3
-  next: 15.3.1
+  next: 15.3.3
   'react': '^18.3.0'
   'react-dom': '^18.3.0'
   '@types/react': '^18.3.0'