chore(deps): bump next from 16.2.9 to 16.2.11

[dependabot]

Bumps next from 16.2.9 to 16.2.11.

Release notes

Sourced from next's releases.

v16.2.11

This release contains security fixes for the following advisories:

High:

• Denial of Service in App Router using Server Actions
• Middleware / Proxy bypass in App Router applications using Turbopack and single locale
• Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
• Server-Side Request Forgery in Server Actions on custom servers

Moderate:

• Cache confusion of response bodies for requests with bodies
• Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences
• Denial of Service in the Image Optimization API using SVGs
• Unauthenticated disclosure of internal Server Function endpoints
• Unbounded Server Action payload in Edge runtime

v16.2.10

Contains no changes except publishing @next/swc-wasm-web which was accidentally not published since 16.2.4.

Commits

• 9beca08 v16.2.11
• 3c48c7a [16.x] Fix Turbopack middleware matcher with i18n single locale
• ac1eff3 [16.x] Improve performance of checking valid MPA form submissions
• 9a4651e [16.x] Enforce serverActions.bodySizeLimit for Server Actions in Edge runtime
• b512063 [16.x] Set correct origin for internal redirects in custom server
• d303326 [16.x] Ensure exotic rewrite param values are properly encoded
• 73b9487 [16.x] fix(fetch-cache): key fetch(Request, init) by the effective request
• bf9d17f [16.x] fix(incremental-cache): byte-exact fetch cache key for binary bodies
• fe28768 [16.x] fix(next/image): improve performance of detectContentType()
• d8afb8d [16.x] Performance improvements when decoding React Server function payloads
• Additional commits viewable in compare view

[greptile-apps]

Greptile Summary

Updates both Next.js applications to the security-fixed Next.js 16.2.11 release.

• Raises the Next.js dependency range in the backoffice and web applications.
• Refreshes the pnpm lockfile with Next.js 16.2.11, its platform-specific compiler packages, and newly resolved transitive dependencies.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
apps/backoffice-app/package.json	Raises the backoffice application's minimum Next.js 16 version to 16.2.11.
apps/web-app/package.json	Raises the account-deletion web application's minimum Next.js 16 version to 16.2.11.
pnpm-lock.yaml	Resolves both applications to Next.js 16.2.11 and refreshes associated transitive and peer-dependency snapshots.

_{Reviews (5): Last reviewed commit: "chore(deps): bump next from 16.2.9 to 16..." | Re-trigger Greptile}