chore(deps): bump next from 16.2.6 to 16.2.11

[dependabot]

Bumps next from 16.2.6 to 16.2.11.

Release notes

Sourced from next's releases.

v16.2.11

This release contains security fixes for the following advisories:

High:

• Denial of Service in App Router using Server Actions
• Middleware / Proxy bypass in App Router applications using Turbopack and single locale
• Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
• Server-Side Request Forgery in Server Actions on custom servers

Moderate:

• Cache confusion of response bodies for requests with bodies
• Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences
• Denial of Service in the Image Optimization API using SVGs
• Unauthenticated disclosure of internal Server Function endpoints
• Unbounded Server Action payload in Edge runtime

v16.2.10

Contains no changes except publishing @next/swc-wasm-web which was accidentally not published since 16.2.4.

Commits

• 9beca08 v16.2.11
• 3c48c7a [16.x] Fix Turbopack middleware matcher with i18n single locale
• ac1eff3 [16.x] Improve performance of checking valid MPA form submissions
• 9a4651e [16.x] Enforce serverActions.bodySizeLimit for Server Actions in Edge runtime
• b512063 [16.x] Set correct origin for internal redirects in custom server
• d303326 [16.x] Ensure exotic rewrite param values are properly encoded
• 73b9487 [16.x] fix(fetch-cache): key fetch(Request, init) by the effective request
• bf9d17f [16.x] fix(incremental-cache): byte-exact fetch cache key for binary bodies
• fe28768 [16.x] fix(next/image): improve performance of detectContentType()
• d8afb8d [16.x] Performance improvements when decoding React Server function payloads
• Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[codesandbox-ci]

This pull request is automatically built and testable in CodeSandbox.

To see build info of the built libraries, click here or the icon next to each commit SHA.

[pkg-pr-new]

Open in StackBlitz

@faststore/api

npm i https://pkg.pr.new/vtex/faststore/@faststore/api@67b521d

@faststore/cli

npm i https://pkg.pr.new/vtex/faststore/@faststore/cli@67b521d

@faststore/components

npm i https://pkg.pr.new/vtex/faststore/@faststore/components@67b521d

@faststore/core

npm i https://pkg.pr.new/vtex/faststore/@faststore/core@67b521d

@faststore/diagnostics

npm i https://pkg.pr.new/vtex/faststore/@faststore/diagnostics@67b521d

@faststore/lighthouse

npm i https://pkg.pr.new/vtex/faststore/@faststore/lighthouse@67b521d

@faststore/sdk

npm i https://pkg.pr.new/vtex/faststore/@faststore/sdk@67b521d

@faststore/ui

npm i https://pkg.pr.new/vtex/faststore/@faststore/ui@67b521d

commit: 67b521d

[renatomaurovtex]

Security-motivated patch bump, safe to take:

• Lockfile-only and in-range: the workspace catalog pins next: ^16.2.6, so 16.2.11 resolves without touching any manifest. next is already a runtime dependency of @faststore/core — no new dependency, no Dependency Discipline checklist needed.
• The advisories are worth it: 16.2.11 fixes 4 High (DoS via Server Actions, middleware/proxy bypass, 2× SSRF) and 5 Moderate advisories. Several are App Router/Turbopack-specific and don't apply to FastStore's Pages Router setup, but the two cache-confusion-of-response-bodies fixes and the Image Optimization SVG DoS fix are relevant to stores on Pages Router — good reason to merge rather than wait.
• The ±26k line churn is the usual pnpm lockfile reflow, same pattern as #3416/#3418.
• The red FastStore check is only the "Publish to Chromatic" step failing with ✖ Missing project token (dependabot PRs don't get the secret — known pattern, #3361 tracks it). SonarQube and all turbo build/test tasks are green.

---

Verdict: Approved

Blocking (🔴/🟠):

• None.

Non-blocking (🟡/💬):

• 💬 Red FastStore check = Chromatic token pattern on dependabot PRs, not a regression.

Checks to confirm before merge: none beyond existing CI — lockfile-only.

[dependabot]

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.

[dependabot]

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.

[sonar-workflows]

Quality Gate passed

Issues

• 0 New Issues
• 0 Fixed Issues
• 0 Accepted Issues

Measures

• 0 Security Hotspots
• No data about coverage (35.90% Estimated after merge)
• No data about duplications (1.40% Estimated after merge)

Project ID: vtex_faststore_f0a862d5-9557-49f9-8d09-de40caa76622

View in SonarQube