chore(deps): bump next to 16.2.11 to clear security advisories (#5890)

* chore(deps): bump next to 16.2.11 to clear security advisories

Patches SSRF, cache confusion, DoS, and middleware-bypass advisories
(GHSA-89xv-2m56-2m9x et al.) affecting next < 16.2.11 across apps/sim,
apps/docs, and packages/emcn. Excludes next/@next/env from the
minimum-release-age gate until the 7-day window elapses on 2026-07-28.

* chore(deps): drop aged-out typescript entries from release-age excludes

typescript and @typescript/typescript6 passed the 7-day minimum-release-age
gate (aged out 2026-07-15 and 2026-07-13), so their exclusions are no longer
needed. Keeps @typescript/native-preview (permanent nightly builds) and the
Pi packages (age out 2026-07-24).

Author: waleedlatif1

apps/docs/package.json

@@ -30,7 +30,7 @@
     "fumadocs-openapi": "10.8.1",
     "fumadocs-ui": "16.8.5",
     "lucide-react": "^0.511.0",
-    "next": "16.2.6",
+    "next": "16.2.11",
     "next-themes": "^0.4.6",
     "postgres": "^3.4.5",
     "react": "19.2.4",

apps/sim/package.json

@@ -178,7 +178,7 @@
     "mongodb": "6.19.0",
     "mysql2": "3.14.3",
     "neo4j-driver": "6.0.1",
-    "next": "16.2.6",
+    "next": "16.2.11",
     "next-mdx-remote": "^6.0.0",
     "next-runtime-env": "3.3.0",
     "next-themes": "^0.4.6",
@@ -264,8 +264,8 @@
     "sharp"
   ],
   "overrides": {
-    "next": "16.2.6",
-    "@next/env": "16.2.6",
+    "next": "16.2.11",
+    "@next/env": "16.2.11",
     "mermaid": "11.15.0",
     "react-floater": {
       "react": "$react",

bun.lock

@@ -5,18 +5,20 @@ exact = true
 minimumReleaseAge = 604800
 # @typescript/native-preview stays excluded permanently: it only publishes nightly
 # dev builds, so every version is structurally younger than any age gate.
-# typescript@7.0.2 and @typescript/typescript6@6.0.2 were vetted in #5521; they age
-# out of the gate on 2026-07-15 and 2026-07-13 — drop those two entries after that.
 # The exactly pinned Pi 0.80.10 packages were vetted for the cloud-review SDK
 # migration; they age out of the gate on 2026-07-24 — drop these four entries then.
+# next@16.2.11 and @next/env@16.2.11 are the official Vercel security patch for the
+# July 2026 advisories (SSRF, cache confusion, DoS, middleware bypass — GHSA-89xv-2m56-2m9x
+# et al.); published 2026-07-21, they age out of the gate on 2026-07-28 — drop these two
+# entries then.
 minimumReleaseAgeExcludes = [
-  "typescript",
-  "@typescript/typescript6",
   "@typescript/native-preview",
   "@earendil-works/pi-agent-core",
   "@earendil-works/pi-ai",
   "@earendil-works/pi-coding-agent",
   "@earendil-works/pi-tui",
+  "next",
+  "@next/env",
 ]
 
 [run]

bunfig.toml

@@ -63,8 +63,8 @@
   "overrides": {
     "react": "19.2.4",
     "react-dom": "19.2.4",
-    "next": "16.2.6",
-    "@next/env": "16.2.6",
+    "next": "16.2.11",
+    "@next/env": "16.2.11",
     "drizzle-orm": "^0.45.2",
     "postgres": "^3.4.5",
     "minimatch": "^10.2.5",

package.json

@@ -57,7 +57,7 @@
     "framer-motion": "^12.5.0",
     "input-otp": "^1.4.2",
     "lucide-react": "^0.479.0",
-    "next": "16.2.6",
+    "next": "16.2.11",
     "prismjs": "^1.30.0",
     "react": "19.2.4",
     "react-dom": "19.2.4",