deps: bump next from 16.2.10 to 16.2.11

[dependabot]

Bumps next from 16.2.10 to 16.2.11.

Release notes

Sourced from next's releases.

v16.2.11

This release contains security fixes for the following advisories:

High:

• Denial of Service in App Router using Server Actions
• Middleware / Proxy bypass in App Router applications using Turbopack and single locale
• Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
• Server-Side Request Forgery in Server Actions on custom servers

Moderate:

• Cache confusion of response bodies for requests with bodies
• Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences
• Denial of Service in the Image Optimization API using SVGs
• Unauthenticated disclosure of internal Server Function endpoints
• Unbounded Server Action payload in Edge runtime

Commits

• 9beca08 v16.2.11
• 3c48c7a [16.x] Fix Turbopack middleware matcher with i18n single locale
• ac1eff3 [16.x] Improve performance of checking valid MPA form submissions
• 9a4651e [16.x] Enforce serverActions.bodySizeLimit for Server Actions in Edge runtime
• b512063 [16.x] Set correct origin for internal redirects in custom server
• d303326 [16.x] Ensure exotic rewrite param values are properly encoded
• 73b9487 [16.x] fix(fetch-cache): key fetch(Request, init) by the effective request
• bf9d17f [16.x] fix(incremental-cache): byte-exact fetch cache key for binary bodies
• fe28768 [16.x] fix(next/image): improve performance of detectContentType()
• d8afb8d [16.x] Performance improvements when decoding React Server function payloads
• Additional commits viewable in compare view

[service-samwise]

This PR addresses the CVEs listed in VUL-25749:

Package	CVE	Severity	Description	Fixed in
next	CVE-2026-64641	High	Denial of Service in App Router using Server Actions	15.5.21
next	CVE-2026-64642	High	Middleware/Proxy bypass in App Router using Turbopack	16.2.11
next	CVE-2026-64643	High	SSRF in rewrites via attacker-controlled destination hostname	15.5.21
next	CVE-2026-64644	High	Unbounded Server Action payload in Edge runtime	15.5.21
next	CVE-2026-64645	High	SSRF in Server Actions on custom servers	15.5.21
next	CVE-2026-64647	High	Cache confusion of response bodies for requests with bodies	15.5.21
next	CVE-2026-64648	High	Cache confusion for requests with invalid UTF-8 byte sequences	15.5.21
next	CVE-2026-64649	High	Unauthenticated disclosure of internal Server Function endpoints	15.5.21

All 8 CVEs are resolved by bumping next to 16.2.11. next is a peerDependency in the root package.json (>=14.0.0) — this bump updates the lockfile-pinned version only, which is correct.

Merging this PR will close VUL-25749.

[service-samwise]

This PR addresses CVE-2026-64646 (next 16.x path — vulnerable range >= 16.0.0, < 16.2.11) which is tracked in VUL-25888. The fix here (bumping next to 16.2.11) resolves that CVE. A separate PR #85 handles the postcss CWE-22 finding from the same ticket.