From 2e355dd0b9c18c30defa148d94eaaba8221f4fb2 Mon Sep 17 00:00:00 2001 From: Diego Rodrigues de Sa e Souza Date: Fri, 24 Jul 2026 11:43:44 -0300 Subject: [PATCH] chore(deps): bump next to 16.2.11 (9 security advisories) (#8265) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Closes 9 Dependabot alerts (#135-#143) — Next.js 16.0.0..<16.2.11: SSRF in Server Actions/rewrites, cache confusion, DoS (Server Actions, Image Optimization SVG, Edge payload), middleware/proxy bypass, and unauthenticated Server Function endpoint disclosure. Lockfile bump within the existing ^16.2.6 range (now floored at ^16.2.11); no production code touched. Co-authored-by: rafaumeu --- package-lock.json | 2 +- package.json | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/package-lock.json b/package-lock.json index efe6a95956..a668a06640 100644 --- a/package-lock.json +++ b/package-lock.json @@ -53,7 +53,7 @@ "material-symbols": "^0.45.2", "mermaid": "^11.15.0", "monaco-editor": "^0.56.0", - "next": "^16.2.6", + "next": "^16.2.11", "next-intl": "^4.12.0", "next-themes": "^0.4.6", "node-machine-id": "^1.1.12", diff --git a/package.json b/package.json index de8fb48691..80b95385ca 100644 --- a/package.json +++ b/package.json @@ -274,7 +274,7 @@ "material-symbols": "^0.45.2", "mermaid": "^11.15.0", "monaco-editor": "^0.56.0", - "next": "^16.2.6", + "next": "^16.2.11", "next-intl": "^4.12.0", "next-themes": "^0.4.6", "node-machine-id": "^1.1.12",