[Aikido] Fix security issue in next via minor version upgrade from 16.1.6 to 16.1.6

[aikido-autofix]

Upgrade Next.js to fix DoS vulnerabilities in PPR request buffering, RSC deserialization, and unbounded image cache growth.

⚠️ Breaking changes analysis not available for: next

✅ 3 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue	Severity	Description
CVE-2026-27979	MEDIUM	[next] A vulnerability in Next.js with Partial Prerendering enabled allows attackers to send oversized next-resume POST requests that bypass maxPostponedStateSize limits in non-minimal deployments, causing unbounded memory buffering and potential denial of service. The issue affects applications using the App Router with PPR capability enabled.
GHSA-q4gf-8mx6-v5v3	MEDIUM	[next] A specially crafted HTTP request to App Router Server Function endpoints can trigger excessive CPU usage during deserialization, causing denial of service (DoS).
CVE-2026-27980	LOW	[next] The default image optimization disk cache in Next.js lacks an upper bound, allowing attackers to exhaust disk space by generating many unique image variants, causing denial of service. This is fixed by implementing an LRU-backed cache with a configurable maximum size limit and automatic eviction of least-recently-used entries.

[ash-bluepollution95]

@coderabbitai can you check and see if this breaks anything

[coderabbitai]

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Check package.json for Next.js version details
cat package.json 2>/dev/null || fd -i "package.json" --max-depth 2 --exec cat {}

# Check for next.config files
fd -i "next.config" --exec cat {}

# Check if PPR (Partial Prerendering) is enabled anywhere
rg -n "ppr|partial.*prerender|PPR" --type ts --type tsx --type js -C2 2>/dev/null || rg -rn "ppr|partial.*prerender|PPR" -C2

# Check for App Router usage (app directory)
fd -t d "app" --max-depth 3

# Check for next/image usage
rg -n "next/image" -C2

# Check for Server Actions / Server Functions usage
rg -n "use server" -C2

# Check if there's a lockfile to confirm version
cat package-lock.json 2>/dev/null | python3 -c "import json,sys; d=json.load(sys.stdin); pkgs=d.get('packages',{}); nxt={k:v for k,v in pkgs.items() if 'next' in k.lower() and 'version' in v}; [print(k,v['version']) for k,v in list(nxt.items())[:10]]" 2>/dev/null || \
cat yarn.lock 2>/dev/null | grep -A1 "^next@" | head -20

Length of output: 5471

---

@duskfallcrew: I've inspected the codebase and this upgrade looks safe. Here's a breakdown:

---

🔍 What's Actually Changing

The PR title has a typo — the real upgrade is Next.js 16.1.6 → ^16.2.3 (a minor/patch bump). This is confirmed by package.json ("next": "^16.2.3") vs. node_modules/next 16.1.6 currently installed. Minor version bumps in Next.js 16.x are not expected to introduce breaking changes.

---

✅ CVE Applicability to This Project

CVE	Description	Applies?	Reason
CVE-2026-27979	PPR request buffering DoS	❌ No	PPR (experimental.ppr) is not enabled in next.config.js
GHSA-q4gf-8mx6-v5v3	RSC deserialization DoS	✅ Yes	App Router is used (app/ directory, app/api/metadata/route.ts) — the fix is server-side and transparent
CVE-2026-27980	Unbounded image disk cache DoS	❌ No	images: { unoptimized: true } disables the image optimization disk cache entirely

---

🛡️ Risk Assessment

• No breaking changes expected — this is a minor bump with targeted security patches.
• next/image is used in components/ui/not-found.tsx, but since unoptimized: true is set, the image cache fix is a no-op for this project.
• No "use server" directives were found in the codebase, meaning no explicit Server Actions are defined. The App Router API route handlers will silently benefit from the RSC deserialization fix.
• typescript: { ignoreBuildErrors: true } in next.config.js also provides a safety net against any unexpected type-level churn.

Bottom line: safe to merge. 🟢