build(deps-dev): Bump next from 16.2.11 to 16.2.12

[dependabot]

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

---

Bumps next from 16.2.11 to 16.2.12.

Release notes

Sourced from next's releases.

v16.2.12

What's Changed

• Backport/docs fixes 16.2 - July round by @​icyJoseph in vercel/next.js#96031
• [Backport] Fixes to support TypeScript 7 by @​lukesandberg in vercel/next.js#95831

Full Changelog: vercel/next.js@v16.2.11...v16.2.12

Commits

• 2234717 v16.2.12
• 957f5ed [Backport] Fixes to support TypeScript 7 (#95831)
• b56eb16 Backport/docs fixes 16.2 - July round (#96031)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	next@​16.2.11 ⏵ 16.2.12	-12		-12

View full report

[hermes-exosphere]

✅ Auto-approved: all 10 CI checks passing. Ready to merge.

[hermes-exosphere]

Automated code review started - full review. Results will be posted here.

[hermes-exosphere]

Automated Code Review

Summary

This is a straightforward dependabot lockfile-only bump of next from 16.2.11 to 16.2.12. The package.json range (^16.2.11) already covers 16.2.12 — only bun.lock was updated to pin the new resolution. The release contains backported TypeScript 7 support and docs fixes; no breaking changes, no security patches.

Change Architecture

graph TD
    A[package.json: ^16.2.11] -->|"semver range already covers 16.2.12"| B[bun.lock resolution]
    B -->|"pinned: 16.2.12"| C[@next/env 16.2.12]
    B -->|"pinned: 16.2.12"| D[8x @next/swc binaries 16.2.12]
    B -->|"pinned: 16.2.12"| E[next 16.2.12]
    C --> F[CI: build + test + e2e + quality + docs]
    D --> F
    E --> F
    style B fill:#90EE90
    style F fill:#87CEEB

Loading

Legend: Green = New | Blue = Verification

Breaking Changes

No breaking changes detected. This is a lockfile-only update; the semver range in package.json is unchanged. No API changes, no config changes, no schema changes.

Issues Found

None. The diff is clean — 20 lines changed in bun.lock (10 insertions, 10 deletions) representing version bumps of @next/env, 8 platform-specific @next/swc-* binaries, and next itself. All checksums changed atomically.

Logical / Bug Analysis

• The package.json constraint ^16.2.11 correctly admits 16.2.12. No version constraint mismatch.
• No stale sub-dependencies — all 8 @next/swc-* optionalDependencies and @next/env were bumped together with the same version.
• bun.lock is a machine-generated file; no hand-editing errors possible.

Evidence — Build & Test Results

Build Output

bun install succeeded (next 16.2.12 resolved)
bun build (CLI): 185 modules in 42ms, cli.mjs 0.80 MB
bun build (API): 3 modules in 5ms, index.js 2.19 KB
Next.js production build: timed out (resource constraint on review machine)
  → CI build job passed in 1m8s (see GitHub Actions)

Test Results

Test Files  131 passed (131)
     Tests  2357 passed (2357)
  Duration  89.32s

CI Status

build          pass  1m8s
docs           pass  1m52s
quality        pass  1m5s
test (default)          pass  1m14s
test (hook-log-file)    pass  1m30s
test (log-debug, debug) pass  1m23s
test-e2e                 pass  51s
OSV-Scanner              pass  17s
Socket Security: Project Report  pass  5s
Socket Security: Pull Request Alerts  pass  7s

All 10 checks passing.

Issue Linkage

No linked issues. This is a routine dependabot version bump.

Human Review Feedback

No human review comments on this PR. The only prior comment is from hermes-exosphere (bot) marking the start of automated review.

Suggestions

• Consider enabling dependabot auto-merge for patch-version lockfile-only bumps. The ^16.2.11 constraint already gates compatibility, and CI + test evidence shows no regressions. Auto-merging these would reduce review overhead for routine updates.

Verdict

VERDICT: APPROVED

[hermes-exosphere]

Automated review: APPROVED. Dependabot lockfile-only bump of next 16.2.11 -> 16.2.12. No breaking changes. All 10 CI checks pass (build, test, e2e, quality, docs, OSV, Socket). 2357 unit tests pass locally. Package.json semver range unchanged. Clean.

[hermes-exosphere]

Automated review: Approved. ✅