deps: bump the production group across 1 directory with 11 updates (#11440)

Validated in a combined dependabot worktree off release/v3.8.51 tip alongside #11426 and #11428 — a fresh npm install of all three combined (2437 packages, 0 vulnerabilities) plus full-suite validation:
- typecheck:core, file-size, changelog-integrity, complexity, cognitive-complexity, check:cycles — all OK
- npm run lint — 0 errors (after also draining an unrelated stale-suppressions cascade, see #11596)
- npm run test:vitest — 451/452 pass; the 1 failure (auto/glm materialization) is a pre-existing timing-flaky test, reproduced 11/11 pass ×3 in isolation, unrelated to this bump

11 production-group updates (aws-sdk bedrock-runtime, dompurify, fumadocs-core/ui, jose, lucide-react, marked, mermaid, next, onnxruntime-node, wreq-js), all patch/minor within their existing major lines.

package.json

@@ -263,7 +263,7 @@
     "alibaba:sync-allowlist": "node --import tsx/esm scripts/ops/sync-alibaba-allowlist.mjs"
   },
   "dependencies": {
-    "@aws-sdk/client-bedrock-runtime": "^3.1112.0",
+    "@aws-sdk/client-bedrock-runtime": "^3.1116.0",
     "@dnd-kit/core": "^6.3.1",
     "@dnd-kit/sortable": "^10.0.0",
     "@dnd-kit/utilities": "^3.2.2",
@@ -282,29 +282,29 @@
     "commander": "^15.0.0",
     "cron-parser": "^5.10.0",
     "csv-stringify": "^6.8.3",
-    "dompurify": "^3.4.13",
+    "dompurify": "^3.4.14",
     "express": "^5.2.1",
     "fetch-socks": "^1.3.3",
     "fflate": "^0.8.3",
-    "fumadocs-core": "^16.14.4",
-    "fumadocs-ui": "^16.14.4",
+    "fumadocs-core": "^16.15.0",
+    "fumadocs-ui": "^16.15.0",
     "http-proxy-middleware": "^4.0.0",
     "https-proxy-agent": "^9.0.0",
     "ink": "^7.0.3",
     "ink-spinner": "^5.0.0",
     "ink-text-input": "^6.0.0",
     "ioredis": "^5.10.1",
-    "jose": "^6.2.9",
+    "jose": "^6.2.10",
     "js-yaml": "^5.3.0",
     "jsonc-parser": "^3.3.1",
     "lowdb": "^7.0.1",
-    "lucide-react": "^1.21.0",
-    "marked": "^18.0.9",
+    "lucide-react": "^1.33.0",
+    "marked": "^18.0.10",
     "marked-terminal": "^7.3.0",
     "material-symbols": "^0.46.0",
-    "mermaid": "^11.15.0",
+    "mermaid": "^11.17.0",
     "monaco-editor": "^0.56.0",
-    "next": "16.3.1",
+    "next": "16.3.2",
     "next-intl": "^4.13.7",
     "next-themes": "^0.4.6",
     "node-machine-id": "^1.1.12",
@@ -347,10 +347,10 @@
     "better-sqlite3": "^13.0.2",
     "js-tiktoken": "^1.0.20",
     "keytar": "^7.9.0",
-    "onnxruntime-node": "1.24.3",
+    "onnxruntime-node": "1.27.0",
     "sqlite-vec": "^0.1.9",
     "tls-client-node": "^0.2.0",
-    "wreq-js": "^3.0.0"
+    "wreq-js": "^3.1.0"
   },
   "devDependencies": {
     "@axe-core/playwright": "^4.13.0",
@@ -436,7 +436,7 @@
     "unrs-resolver": true
   },
   "overrides": {
-    "onnxruntime-node": "1.24.3",
+    "onnxruntime-node": "1.27.0",
     "fast-xml-parser": "^5.10.1",
     "sharp": "^0.35.3",
     "postcss": "^8.5.18",