feat: bump next from 16.2.10 to 16.2.11

[dependabot]

Bumps next from 16.2.10 to 16.2.11.

Release notes

Sourced from next's releases.

v16.2.11

This release contains security fixes for the following advisories:

High:

• Denial of Service in App Router using Server Actions
• Middleware / Proxy bypass in App Router applications using Turbopack and single locale
• Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
• Server-Side Request Forgery in Server Actions on custom servers

Moderate:

• Cache confusion of response bodies for requests with bodies
• Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences
• Denial of Service in the Image Optimization API using SVGs
• Unauthenticated disclosure of internal Server Function endpoints
• Unbounded Server Action payload in Edge runtime

Commits

• 9beca08 v16.2.11
• 3c48c7a [16.x] Fix Turbopack middleware matcher with i18n single locale
• ac1eff3 [16.x] Improve performance of checking valid MPA form submissions
• 9a4651e [16.x] Enforce serverActions.bodySizeLimit for Server Actions in Edge runtime
• b512063 [16.x] Set correct origin for internal redirects in custom server
• d303326 [16.x] Ensure exotic rewrite param values are properly encoded
• 73b9487 [16.x] fix(fetch-cache): key fetch(Request, init) by the effective request
• bf9d17f [16.x] fix(incremental-cache): byte-exact fetch cache key for binary bodies
• fe28768 [16.x] fix(next/image): improve performance of detectContentType()
• d8afb8d [16.x] Performance improvements when decoding React Server function payloads
• Additional commits viewable in compare view

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
orpc	Ready	Preview, Comment	Jul 25, 2026 9:48am

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[pkg-pr-new]

More templates

• @orpc/bun-playground
• @orpc/cloudflare-playground
• @orpc/nest-playground
• @orpc/next-playground

@orpc/ai-sdk

npm i https://pkg.pr.new/@orpc/ai-sdk@1719

@orpc/arktype

npm i https://pkg.pr.new/@orpc/arktype@1719

@orpc/bun

npm i https://pkg.pr.new/@orpc/bun@1719

@orpc/client

npm i https://pkg.pr.new/@orpc/client@1719

@orpc/cloudflare

npm i https://pkg.pr.new/@orpc/cloudflare@1719

@orpc/contract

npm i https://pkg.pr.new/@orpc/contract@1719

@orpc/experimental-effect

npm i https://pkg.pr.new/@orpc/experimental-effect@1719

@orpc/evlog

npm i https://pkg.pr.new/@orpc/evlog@1719

@orpc/json-schema

npm i https://pkg.pr.new/@orpc/json-schema@1719

@orpc/nest

npm i https://pkg.pr.new/@orpc/nest@1719

@orpc/next

npm i https://pkg.pr.new/@orpc/next@1719

@orpc/openapi

npm i https://pkg.pr.new/@orpc/openapi@1719

@orpc/opentelemetry

npm i https://pkg.pr.new/@orpc/opentelemetry@1719

@orpc/pinia-colada

npm i https://pkg.pr.new/@orpc/pinia-colada@1719

@orpc/pino

npm i https://pkg.pr.new/@orpc/pino@1719

@orpc/publisher

npm i https://pkg.pr.new/@orpc/publisher@1719

@orpc/ratelimit

npm i https://pkg.pr.new/@orpc/ratelimit@1719

@orpc/server

npm i https://pkg.pr.new/@orpc/server@1719

@orpc/shared

npm i https://pkg.pr.new/@orpc/shared@1719

@orpc/swr

npm i https://pkg.pr.new/@orpc/swr@1719

@orpc/tanstack-query

npm i https://pkg.pr.new/@orpc/tanstack-query@1719

@orpc/trpc

npm i https://pkg.pr.new/@orpc/trpc@1719

@orpc/valibot

npm i https://pkg.pr.new/@orpc/valibot@1719

@orpc/zod

npm i https://pkg.pr.new/@orpc/zod@1719

commit: e17006e

[codspeed-hq]

Merging this PR will not alter performance

✅ 18 untouched benchmarks

---

_{Comparing dependabot/npm_and_yarn/next-16.2.11 (e17006e) with main (d438821)¹}

Footnotes

1. No successful run was found on main (7208cf8) during the generation of this report, so d438821 was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩

[dependabot]

Looks like next is up-to-date now, so this is no longer needed.