chore(deps): bump next from 16.1.7 to 16.2.11

[dependabot]

Bumps next from 16.1.7 to 16.2.11.

Release notes

Sourced from next's releases.

v16.2.11

This release contains security fixes for the following advisories:

High:

• Denial of Service in App Router using Server Actions
• Middleware / Proxy bypass in App Router applications using Turbopack and single locale
• Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
• Server-Side Request Forgery in Server Actions on custom servers

Moderate:

• Cache confusion of response bodies for requests with bodies
• Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences
• Denial of Service in the Image Optimization API using SVGs
• Unauthenticated disclosure of internal Server Function endpoints
• Unbounded Server Action payload in Edge runtime

v16.2.10

Contains no changes except publishing @next/swc-wasm-web which was accidentally not published since 16.2.4.

v16.2.9

Empty release to ensure next@latest points at a stable release. Next.js only allows publishing with Trusted Publishing enabled. In order to fix NPM dist-tags, we have to release a new version. Updating dist-tags is not possible with Trusted Publishing.

v16.2.8

Release with no changes in an attempt to fix next@latest pointing at a prerelease version.

v16.2.7

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• Backport documentation fixes for v16.2 (#93804)
• [backport] Patch playwright-core to resolve _finishedPromise on requestFailed (#93920)
• [backport] Fix dev mode hydration failure when page is served from HTTP cache (#93492)
• [backport] Fix catch-all router.query corruption with basePath + rewrites (#93917)
• [backport] Encode non-ASCII characters in cache tags at construction (#93918)
• [backport] Fix server action forwarding loop with middleware rewrites (#93919)
• [backport] Turbopack: switch from base40 to base38 hash encoding (#93932)
• [ci] Disable hanging node 24 typescript tests on 16.2 backport branch (#94164)
• [backport] Fix "type: module" in project dir when using standalone or adapters (#94050)
• [backport] Propagate adapter preferred regions (#94200)
• [16.2.x] Don't drop FormData entries (#94240)
• [backport] feat(turbopack): add LocalPathOrProjectPath PostCSS config resolution (#94284)

Credits

Huge thanks to @​eps1lon, @​icyJoseph, @​unstubbable, @​mischnic, @​bgw, @​timneutkens, and @​lukesandberg for helping!

... (truncated)

Commits

• 9beca08 v16.2.11
• 3c48c7a [16.x] Fix Turbopack middleware matcher with i18n single locale
• ac1eff3 [16.x] Improve performance of checking valid MPA form submissions
• 9a4651e [16.x] Enforce serverActions.bodySizeLimit for Server Actions in Edge runtime
• b512063 [16.x] Set correct origin for internal redirects in custom server
• d303326 [16.x] Ensure exotic rewrite param values are properly encoded
• 73b9487 [16.x] fix(fetch-cache): key fetch(Request, init) by the effective request
• bf9d17f [16.x] fix(incremental-cache): byte-exact fetch cache key for binary bodies
• fe28768 [16.x] fix(next/image): improve performance of detectContentType()
• d8afb8d [16.x] Performance improvements when decoding React Server function payloads
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 0807e71

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[greptile-apps]

PR author is in the excluded authors list.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hyperdx-oss	Ready	Preview, Comment	Jul 23, 2026 10:58pm
hyperdx-storybook	Ready	Preview, Comment	Jul 23, 2026 10:58pm

[github-actions]

🟢 Tier 1 — Trivial

Docs, images, lock files, or a dependency bump. No functional code changes detected.

Why this tier:

• Bot author: dependabot[bot]

Review process: Auto-merge once CI passes. No human review required.
SLA: Resolves automatically.

Stats

• Production files changed: 1
• Production lines changed: 2
• Branch: dependabot/npm_and_yarn/next-16.2.11
• Author: dependabot[bot]

To override this classification, remove the review/tier-1 label and apply a different review/tier-* label. Manual overrides are preserved on subsequent pushes.

[github-actions]

Deep Review

✅ No critical issues found.

This PR is a Dependabot dependency bump of next from 16.1.7 to 16.2.11, scoped to the @hyperdx/app workspace. The manifest change is a single caret-range line in packages/app/package.json ("next": "^16.2.11", the only workspace that depends on next) plus the resolved version in yarn.lock. No application or source code is modified, and the target release is a security-patch line, so the bump moves the floor onto patched versions rather than introducing behavioral risk.

No P0/P1/P2 findings were identified against the changed manifest.

🔵 P3 nitpicks (1)

• packages/app/package.json:73 — the bump raises the caret floor to ^16.2.11; since the security fixes land in the 16.2.x line, confirm yarn.lock actually resolves next to 16.2.11 (or higher within 16.x) so the patched build is what ships, not merely what is permitted.
  • Fix: Verify the resolved next entry in yarn.lock is at 16.2.11 and run an install to confirm the lockfile is consistent with the manifest floor.

---

Reviewers (0): The multi-agent reviewer fan-out did not execute. Every shell/git command in this environment fails at sandbox construction with bwrap: Can't create file at /home/.mcp.json: Permission denied — this affects the orchestrator and every dispatched sub-agent, so the diff could not be computed and no persona reviewer could run. The assessment above is based solely on direct file-read inspection of the workspace manifests, not on a completed review.

Testing gaps: Dependency-only bump with no code changes — no new tests are warranted; CI (typecheck, lint, unit, e2e) against the resolved 16.2.11 is the relevant gate. Note that this report could not be corroborated by the standard reviewer set due to the environment failure above.

[github-actions]

E2E Test Results

✅ All tests passed • 242 passed • 1 skipped • 1068s

Status	Count
✅ Passed	242
❌ Failed	0
⚠️ Flaky	1
⏭️ Skipped	1

Tests ran across 4 shards in parallel.

View full report →