deps(apps/web): bump next 16.2.6 -> 16.4.0 to clear 17 Next.js advisories (2/5)

[martyy-code]

Summary

Second of a 5-PR stacked series to clear the 101 open Dependabot alerts on deessejs/errors. This PR bumps next in the docs site to clear the 17 direct and transitive Next.js advisories.

Changes

Package	From	To
next	16.2.6	16.4.0

Plus pnpm-lock.yaml regenerated.

Alerts cleared

17 Next.js advisories (GHSA-2xp9-vwfh-vxw4 and 16 others; full list in .changeset/fix-dep-next-16-4-0.md). About 50 of the 101 open alerts trace back to this bump via apps/web/package-lock.json + pnpm-lock.yaml.

Validation

pnpm install --no-frozen-lockfile   # postinstall passes
pnpm build                          # turbo: 2 successful, ~13s
pnpm --filter errors test           # 146/146 tests, ~1.6s

Dependencies

Sits on top of staging. The companion PR #101 (fix/dep-fumadocs-mdx-15.4.7) bumps fumadocs-{core,mdx,ui} — that PR is independent and rebases cleanly behind this one. Order in the series:

1. deps(apps/web): bump fumadocs-{core,mdx,ui} to clear transitive vulns (1/5) #101 deps(apps/web): bump fumadocs-{core,mdx,ui}
2. This PR deps(apps/web): bump next
3. PR (open) deps(packages/errors): bump vitest + apps/web tailwindcss
4. PR (open) deps(pnpm): override sprintf-js
5. PR (open) chore(ci): re-enable dependabot_security_updates

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
deessejs-errors-documentation	Error		Oct 9, 2026 2:49pm UTC

[martyy-code]

Scope clarification: this PR only updates pnpm-lock.yaml and apps/web/package.json. apps/web/package-lock.json still pins next: 16.2.6; regenerating it requires clearing the apps/web/node_modules pnpm residue and is documented as a follow-up in #105.

Validated locally: pnpm install --no-frozen-lockfile, pnpm build (turbo 2 successful), pnpm --filter errors test (146/146). The 17 Next.js GHSAs (16.2.11, 16.3.3, 16.3.6, 16.3.8 patch lines) are all closed by 16.4.0 in the pnpm-resolved tree.

Note for the cherry-pick: this PR and #101 must be rebase-merged in the order (101, 102) because pnpm-lock.yaml is generated by each pnpm install and the lockfile resolution from #102 assumes the bumped fumadocs peer constraints from #101. They are independent at the package.json level so a 3-way merge works, but rebase is cleaner.

[martyy-code]

CI note: the failing Vercel check is unrelated to this PR. Root cause is a vercel.json drift between main and staging (PR #100 fixed the outputDirectory on main but it never propagated to staging). The changeset-check GitHub Actions job (the only CI gate defined in ci.yml for PRs to staging) passes. No code change needed in this PR to address Vercel — the issue resolves itself once staging catches up with main's vercel.json.