chore(deps): bump next from 16.2.9 to 16.2.11

[dependabot]

Bumps next from 16.2.9 to 16.2.11.

Release notes

Sourced from next's releases.

v16.2.11

This release contains security fixes for the following advisories:

High:

• Denial of Service in App Router using Server Actions
• Middleware / Proxy bypass in App Router applications using Turbopack and single locale
• Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
• Server-Side Request Forgery in Server Actions on custom servers

Moderate:

• Cache confusion of response bodies for requests with bodies
• Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences
• Denial of Service in the Image Optimization API using SVGs
• Unauthenticated disclosure of internal Server Function endpoints
• Unbounded Server Action payload in Edge runtime

v16.2.10

Contains no changes except publishing @next/swc-wasm-web which was accidentally not published since 16.2.4.

Commits

• 9beca08 v16.2.11
• 3c48c7a [16.x] Fix Turbopack middleware matcher with i18n single locale
• ac1eff3 [16.x] Improve performance of checking valid MPA form submissions
• 9a4651e [16.x] Enforce serverActions.bodySizeLimit for Server Actions in Edge runtime
• b512063 [16.x] Set correct origin for internal redirects in custom server
• d303326 [16.x] Ensure exotic rewrite param values are properly encoded
• 73b9487 [16.x] fix(fetch-cache): key fetch(Request, init) by the effective request
• bf9d17f [16.x] fix(incremental-cache): byte-exact fetch cache key for binary bodies
• fe28768 [16.x] fix(next/image): improve performance of detectContentType()
• d8afb8d [16.x] Performance improvements when decoding React Server function payloads
• Additional commits viewable in compare view

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: cfafb691a9

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Update the Bun lockfile with the Next.js bump

This changes package.json to require next 16.2.11, but bun.lock still pins the root manifest and the next package/SWC optional deps to 16.2.9. I checked Bun's local help for --frozen-lockfile (Disallow changes to lockfile), and the repo's CI/Docker paths install with bun install --frozen-lockfile (.github/workflows/ci.yml and Dockerfile), so those fresh installs need a lockfile update and will fail rather than applying this security bump.

Useful? React with 👍 / 👎.

[krishagel]

🤖 pr-fix routine: blocked, not by missing feedback

I diagnosed the failing checks (Test, Lint, and Type Check, Unified Content PostgreSQL Lifecycle, Validate CDK Infrastructure, claude-review) — they all fail at the same step:

error: lockfile had changes, but lockfile is frozen
note: try re-running without --frozen-lockfile and commit the updated lockfile

Root cause: this PR bumps next from 16.2.9 → 16.2.11 in package.json, but bun.lock still pins next (and its @next/swc-* optional deps) to 16.2.9. CI installs with bun install --frozen-lockfile, so it fails until bun.lock is regenerated. Codex's automated review already flagged this exact issue in an inline comment on package.json:190.

Why I can't fix it myself: the fix requires running bun install to re-resolve next@16.2.11 and update the lockfile's hashes. This routine's execution environment has no network egress to registry.npmjs.org — direct requests and requests through the configured proxy both return 403 Host not in allowlist. I can't safely hand-edit bun.lock (wrong sha512 hashes would silently corrupt installs), so I have no way to regenerate it here.

This is likely the same root cause behind the other dependency-bump PRs in this repo already carrying pr-fix-stuck (#1214, #1275, #1258, #1256, #1211, #1212, #1213, #1215, #1209, #1216, #1217, #1218, #1076) — they're probably all blocked on the same "no npm registry access" limitation, not on missing information.

To unblock: run bun install locally (with real npm registry access) on this branch, commit the updated bun.lock, and push. Or comment ·@·d·ependabot r·ecreate to have Dependabot regenerate the lockfile itself. Once CI is green, remove pr-fix-stuck if you'd like the routine to re-verify.

If you'd like, it may also be worth checking whether this routine's network egress allowlist can be extended to include registry.npmjs.org — that would let it auto-fix this whole class of dependency-bump PRs going forward.

---

Generated by Claude Code