build(deps): bump next from 15.5.21 to 16.2.12

[dependabot]

Bumps next from 15.5.21 to 16.2.12.

Release notes

Sourced from next's releases.

v16.2.12

What's Changed

• Backport/docs fixes 16.2 - July round by @​icyJoseph in vercel/next.js#96031
• [Backport] Fixes to support TypeScript 7 by @​lukesandberg in vercel/next.js#95831

Full Changelog: vercel/next.js@v16.2.11...v16.2.12

v16.2.11

This release contains security fixes for the following advisories:

High:

• Denial of Service in App Router using Server Actions
• Middleware / Proxy bypass in App Router applications using Turbopack and single locale
• Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
• Server-Side Request Forgery in Server Actions on custom servers

Moderate:

• Cache confusion of response bodies for requests with bodies
• Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences
• Denial of Service in the Image Optimization API using SVGs
• Unauthenticated disclosure of internal Server Function endpoints
• Unbounded Server Action payload in Edge runtime

v16.2.10

Contains no changes except publishing @next/swc-wasm-web which was accidentally not published since 16.2.4.

v16.2.9

Empty release to ensure next@latest points at a stable release. Next.js only allows publishing with Trusted Publishing enabled. In order to fix NPM dist-tags, we have to release a new version. Updating dist-tags is not possible with Trusted Publishing.

v16.2.8

Release with no changes in an attempt to fix next@latest pointing at a prerelease version.

v16.2.7

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• Backport documentation fixes for v16.2 (#93804)
• [backport] Patch playwright-core to resolve _finishedPromise on requestFailed (#93920)
• [backport] Fix dev mode hydration failure when page is served from HTTP cache (#93492)
• [backport] Fix catch-all router.query corruption with basePath + rewrites (#93917)
• [backport] Encode non-ASCII characters in cache tags at construction (#93918)
• [backport] Fix server action forwarding loop with middleware rewrites (#93919)
• [backport] Turbopack: switch from base40 to base38 hash encoding (#93932)
• [ci] Disable hanging node 24 typescript tests on 16.2 backport branch (#94164)

... (truncated)

Commits

• 2234717 v16.2.12
• 957f5ed [Backport] Fixes to support TypeScript 7 (#95831)
• b56eb16 Backport/docs fixes 16.2 - July round (#96031)
• 9beca08 v16.2.11
• 3c48c7a [16.x] Fix Turbopack middleware matcher with i18n single locale
• ac1eff3 [16.x] Improve performance of checking valid MPA form submissions
• 9a4651e [16.x] Enforce serverActions.bodySizeLimit for Server Actions in Edge runtime
• b512063 [16.x] Set correct origin for internal redirects in custom server
• d303326 [16.x] Ensure exotic rewrite param values are properly encoded
• 73b9487 [16.x] fix(fetch-cache): key fetch(Request, init) by the effective request
• Additional commits viewable in compare view

[openai-sdks]

OkTest Summary

✅ 237/237 SDK tests passed in 9.064s for Node SDK PR #2156.

Test results — 42 files

Test	Result	Time
tests/chat-completions-complex-body.test.ts	✅ Passed	149ms
tests/chat-completions-create.test.ts	✅ Passed	195ms
tests/chat-completions-stream.test.ts	✅ Passed	203ms
tests/files-content-binary.test.ts	✅ Passed	140ms
tests/files-create-multipart.test.ts	✅ Passed	159ms
tests/files-list-pagination.test.ts	✅ Passed	164ms
tests/initialize-config.test.ts	✅ Passed	129ms
tests/instance-isolation.test.ts	✅ Passed	77ms
tests/models-list.test.ts	✅ Passed	119ms
tests/responses-background-lifecycle.test.ts	✅ Passed	147ms
tests/responses-body-method-errors.test.ts	✅ Passed	278ms
tests/responses-cancel-timeout.test.ts	✅ Passed	191ms
tests/responses-cancel.test.ts	✅ Passed	142ms
tests/responses-compact-retries.test.ts	✅ Passed	178ms
tests/responses-compact.test.ts	✅ Passed	158ms
tests/responses-create-advanced-stream.test.ts	✅ Passed	84ms
tests/responses-create-advanced.test.ts	✅ Passed	116ms
tests/responses-create-disconnect.test.ts	✅ Passed	1.107s
tests/responses-create-errors.test.ts	✅ Passed	174ms
tests/responses-create-malformed-api-responses.test.ts	✅ Passed	171ms
tests/responses-create-retries.test.ts	✅ Passed	192ms
tests/responses-create-stream-failures.test.ts	✅ Passed	214ms
tests/responses-create-stream-timeout.test.ts	✅ Passed	2.144s
tests/responses-create-stream-wire.test.ts	✅ Passed	2.043s
tests/responses-create-stream.test.ts	✅ Passed	59ms
tests/responses-create-terminal-states.test.ts	✅ Passed	204ms
tests/responses-create-timeout.test.ts	✅ Passed	184ms
tests/responses-create.test.ts	✅ Passed	117ms
tests/responses-delete.test.ts	✅ Passed	261ms
tests/responses-input-items-errors.test.ts	✅ Passed	273ms
tests/responses-input-items-list.test.ts	✅ Passed	141ms
tests/responses-input-items-options.test.ts	✅ Passed	80ms
tests/responses-input-tokens-count-timeout.test.ts	✅ Passed	198ms
tests/responses-input-tokens-count.test.ts	✅ Passed	171ms
tests/responses-malformed-inputs.test.ts	✅ Passed	1.699s
tests/responses-not-found-errors.test.ts	✅ Passed	232ms
tests/responses-parse.test.ts	✅ Passed	142ms
tests/responses-retrieve-retries.test.ts	✅ Passed	273ms
tests/responses-retrieve.test.ts	✅ Passed	176ms
tests/responses-stored-method-errors.test.ts	✅ Passed	548ms
tests/retry-behavior.test.ts	✅ Passed	2.959s
tests/sdk-error-shape.test.ts	✅ Passed	252ms

View OkTest run #31429968540

_{SDK merge (c1d434f67002) · head (19219e769b46) · base (f79329f7a7d2) · OkTest (91635c6a2723)}

[jbeckwith-oai]

Blocking install regression in pnpm-lock.yaml: at exact head 4f0fe35, CI=true pnpm install --frozen-lockfile with the repository-pinned pnpm 11.5.1 fails ERR_PNPM_TRUST_DOWNGRADE on the standard OpenAI internal npm registry. The new entries baseline-browser-mapping@2.11.13 (line 1585), caniuse-lite@1.0.30001809 (line 1650), and postcss@8.5.26 (line 2791) all lack publish-time metadata there. The identical frozen install on current main passes all 711 supply-chain policy checks, while the public-registry GitHub CI passes, so this PR introduces a local/internal-registry bootstrap failure that CI does not expose. Please regenerate or constrain the lockfile through the supported internal resolution path so the frozen install satisfies the checked-in minimumReleaseAge/trustPolicy without bypasses or broad exclusions, then rerun the full checks.

[jbeckwith-oai]

Re-reviewed the refreshed exact head. The prior internal-registry trust blocker is resolved: the repository-pinned pnpm 11.5.1 now verifies all 711 lockfile entries against the configured OpenAI registry without a trust downgrade. The Next 16 dependency graph and runtime/peer floors are compatible here, and exact-head build, lint, examples, ecosystem, breaking-change, and Node 22/24/26 checks are green.