fix(deps): update dependency next (16.2.7 → 16.2.9)

[its-miso]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
next (source)	16.2.7 → 16.2.9

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

vercel/next.js (next)

v16.2.9

Compare Source

Empty release to ensure next@latest points at a stable release. Next.js only allows publishing with Trusted Publishing enabled. In order to fix NPM dist-tags, we have to release a new version. Updating dist-tags is not possible with Trusted Publishing.

v16.2.8

Compare Source

Release with no changes in an attempt to fix next@latest pointing at a prerelease version.

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

Superseded by a newer automated review for this pull request.

Superseded by a newer automated review for this pull request.

Superseded by a newer automated review for this pull request.

Superseded by a newer automated review for this pull request.

Superseded by a newer automated review for this pull request.

Superseded by a newer automated review for this pull request.

Superseded by a newer automated review for this pull request.

[its-saffron]

AI Automated Review

Full PR review.

Analysis engine: MiniMax-M2.7@https://litellm.jory.dev/v1 (anthropic) — escalated (fast_low_confidence)

PR Review: next 16.2.7 → 16.2.9

Recommendation: Approve

This is a low-risk patch-level dependency update. Both intermediate releases (16.2.8 and 16.2.9) are explicitly documented as empty releases with no functional code changes — they exist solely to fix NPM dist-tags for next@latest pointing at an unstable version.

---

Change Summary

The diff updates package-lock.json to pin Next.js and its platform-specific SWC binaries from 16.2.7 to 16.2.9. No source files are touched.

---

Required Check 1: Breaking API Changes

Status: Verified — No breaking changes

Evidence from official release notes and GitHub compare metadata:

• v16.2.8 release body: "Release with no changes in an attempt to fix next@latest pointing at a prerelease version."
• v16.2.9 release body: "Empty release to ensure next@latest points at a stable release."

The GitHub compare between v16.2.7→v16.2.8 shows only internal CI/CD workflow updates (GitHub Actions versions for checkout, setup-node, cache, upload-artifact, rust-cache) — these are Next.js's own pipeline changes, not library API changes. The v16.2.8→v16.2.9 compare shows only version number bumps in package.json files. No runtime code, API surface, or type definitions changed.

---

Required Check 2: Run Full Test Suite After Upgrade

Status: Not verifiable from corpus

The tool harness attempted npm test but the command was not allowlisted, so no test results are available. Per the AGENTS.md release cut process, npm run test is a required validation step before merging version bumps. Without test evidence, this review cannot confirm the upgrade was validated against the project's test suite.

This is noted as a limitation of the review environment, not a defect in the PR itself.

---

Standards Compliance

• No agent-specific names in generic docs: N/A — no docs changed.
• Prisma schema: N/A — no schema changes.
• API routes: N/A — no route changes.
• Error handling: N/A — no code changes.
• Validation: N/A — no code changes.
• No commit of secrets: Package lock update is appropriate.

The change is a clean dependency pin update following standard Renovate conventions.

---

Linked Issue Fit

No linked issues were present in the PR body, so no acceptance criteria comparison is applicable.

---

Evidence Provider Findings

No evidence providers were configured for this review.

---

Tool Harness Findings

• web_fetch (GitHub releases page): OK — confirmed v16.2.8 and v16.2.9 release metadata.
• web_fetch (v16.2.9 release): OK — confirmed empty release notes.
• run_command (npm test): Error — command not allowlisted. Test results unavailable.

---

Known Security Note

The repository's SECURITY-ACCEPTED-RISKS.md documents that next@16.2.7 bundles a vulnerable postcss@8.4.31 (< 8.5.10). Since both 16.2.8 and 16.2.9 are empty releases with no code changes, this vulnerability is not resolved by this upgrade. The accepted-risk record would need to be updated to reflect the new version if the risk is to remain acknowledged but unchanged. This is informational — the risk was already accepted for the prior version.

---

Unknowns / Needs Verification

1. Test suite execution: Cannot verify npm run test passed without allowlisted test execution. Recommend running locally before merge: npm run lint && npm run typecheck && npm run test && npm run build.
2. PostCSS vulnerability resolution: If resolving the bundled postcss vulnerability is desired, a newer Next.js version beyond 16.2.9 would be needed.