chore(deps): upgrade next 16.2.11 -> 16.2.12 (#6077)

16.2.12 is the current stable (published 2026-07-25) and its entire
changelog is two PRs: a docs backport and vercel/next.js#95831, "Fixes to
support TypeScript 7".

That second one matters here. `apps/sim` declares `typescript: ^7.0.2` and
the lockfile resolves 7.0.2, while 16.2.11 predates any TS7 handling — not
even the actionable-error guard (#95837), which was never merged. The
upstream symptom is `next build` dying with a silent SIGSEGV during its
type-check step, because the legacy TypeScript JS API that Next called is
gone in TS7. Builds pass today only because Next detects
@typescript/native-preview as the compiler and takes a different path, so
we are accidentally-working rather than supported. 16.2.12 adds the
`experimental.useTypeScriptCli` backend that makes this configuration
official.

Zero build-performance content in the patch, so this is not a speed change.

Bumps all eight pins in lockstep — next, @next/env and the four
@next/swc-* binaries at the root, plus the three app/package copies. The
swc binaries must move with next: they are platform-gated
optionalDependencies, so a version skew or a gate exclusion leaves them out
of bun.lock entirely and `bun install --frozen-lockfile` installs no
compiler at all (the #5945 failure).

Also re-dates the bunfig.toml gate note, which said to drop the next
entries on 2026-07-28 — yesterday. 16.2.12 is inside the 7-day window until
2026-08-01, so following that instruction would have blocked this bump and
re-triggered the missing-compiler failure. Re-date on future bumps rather
than deleting the entries early.

Author: waleedlatif1

apps/docs/package.json

@@ -29,7 +29,7 @@
     "fumadocs-openapi": "10.8.1",
     "fumadocs-ui": "16.8.5",
     "lucide-react": "^0.511.0",
-    "next": "16.2.11",
+    "next": "16.2.12",
     "next-themes": "^0.4.6",
     "react": "19.2.4",
     "react-dom": "19.2.4",

apps/sim/package.json

@@ -188,7 +188,7 @@
     "mongodb": "6.19.0",
     "mysql2": "3.14.3",
     "neo4j-driver": "6.0.1",
-    "next": "16.2.11",
+    "next": "16.2.12",
     "next-mdx-remote": "^6.0.0",
     "next-runtime-env": "3.3.0",
     "next-themes": "^0.4.6",

bun.lock

@@ -7,10 +7,15 @@ minimumReleaseAge = 604800
 # dev builds, so every version is structurally younger than any age gate.
 # The exactly pinned Pi 0.80.10 packages were vetted for the cloud-review SDK
 # migration; they age out of the gate on 2026-07-24 — drop these four entries then.
-# next@16.2.11, @next/env@16.2.11 and the @next/swc-* binaries are the official Vercel
-# security patch for the July 2026 advisories (SSRF, cache confusion, DoS, middleware
-# bypass — GHSA-89xv-2m56-2m9x et al.); published 2026-07-21, they age out of the gate on
-# 2026-07-28 — drop these entries then. The swc binaries ship in lockstep with next and
+# next@16.2.12, @next/env@16.2.12 and the @next/swc-* binaries carry the July 2026 security
+# advisories (SSRF, cache confusion, DoS, middleware bypass — GHSA-89xv-2m56-2m9x et al.,
+# fixed in 16.2.11) plus the TypeScript 7 support backport (vercel/next.js#95831) that
+# 16.2.11 lacks — this repo resolves typescript to 7.x, and on 16.2.11 `next build`'s
+# type-check step can die with a silent SIGSEGV because the legacy TS JS API is gone in TS7.
+# Published 2026-07-25, they age out of the gate on 2026-08-01 — drop these entries then,
+# and re-date this note on any further bump rather than deleting the entries early: removing
+# them while the pinned version is still inside the 7-day window blocks the bump outright.
+# The swc binaries ship in lockstep with next and
 # MUST be excluded alongside it: they are next's platform-gated optionalDependencies, so
 # gating them out leaves them absent from bun.lock entirely, and `bun install
 # --frozen-lockfile` then installs no compiler at all — next falls back to downloading one

bunfig.toml

@@ -76,8 +76,8 @@
   "overrides": {
     "react": "19.2.4",
     "react-dom": "19.2.4",
-    "next": "16.2.11",
-    "@next/env": "16.2.11",
+    "next": "16.2.12",
+    "@next/env": "16.2.12",
     "drizzle-orm": "^0.45.2",
     "postgres": "^3.4.5",
     "minimatch": "^10.2.5",
@@ -86,10 +86,10 @@
     "e2b": "^2.36.1"
   },
   "optionalDependencies": {
-    "@next/swc-darwin-arm64": "16.2.11",
-    "@next/swc-darwin-x64": "16.2.11",
-    "@next/swc-linux-arm64-gnu": "16.2.11",
-    "@next/swc-linux-x64-gnu": "16.2.11"
+    "@next/swc-darwin-arm64": "16.2.12",
+    "@next/swc-darwin-x64": "16.2.12",
+    "@next/swc-linux-arm64-gnu": "16.2.12",
+    "@next/swc-linux-x64-gnu": "16.2.12"
   },
   "devDependencies": {
     "@biomejs/biome": "2.0.0-beta.5",

package.json

@@ -84,7 +84,7 @@
     "framer-motion": "^12.5.0",
     "input-otp": "^1.4.2",
     "lucide-react": "^0.511.0",
-    "next": "16.2.11",
+    "next": "16.2.12",
     "prismjs": "^1.30.0",
     "react": "19.2.4",
     "react-dom": "19.2.4",