fix(deps): bump next to 16.3.0 to pull patched postcss (GHSA-6g55-p6wh-862q, GHSA-r28c-9q8g-f849)

[osama-rizk]

Description of changes

Resolves two high-severity Dependabot alerts (#287, #288) for the transitive postcss dependency — both path-traversal / arbitrary-file-read issues in PostCSS's sourceMappingURL auto-loading:

• CVE-2026-45623 / GHSA-6g55-p6wh-862q — arbitrary file read & information disclosure via attacker-controlled sourceMappingURL (patched in 8.5.12).
• GHSA-r28c-9q8g-f849 — path traversal in previous-source-map auto-loading leading to arbitrary .map file disclosure (patched in 8.5.18).

postcss was pinned to 8.4.31 in yarn.lock, pulled in transitively by next (a peer/dev dependency of @aws-amplify/adapter-nextjs, constrained to >= 13.5.0 <17.0.0).

Rather than force a postcss resolution override, this bumps next — the package that brings postcss in. next@16.3.0 (released 2026-08-03, now latest) pins postcss@8.5.23, which satisfies both advisories. Since the existing peer/dev constraint already allows < 17.0.0, this is just a lockfile re-resolution — no manifest constraint change required.

Change: yarn.lock only — next re-resolves 16.2.11 → 16.3.0, which brings postcss 8.4.31 → 8.5.23 (single deduped entry).

Issue #, if available

Dependabot alerts #287 and #288.

Description of how you validated changes

• Confirmed next@16.3.0 declares postcss@8.5.23 (npm view next@16.3.0 dependencies.postcss), above the patched versions for both advisories.
• Regenerated yarn.lock; verified next resolves to 16.3.0 and the single postcss entry is now 8.5.23 (no 8.4.31 remaining).
• Change is limited to yarn.lock; no manifest or source changes. CI will exercise the full yarn test suite against the updated tree.

Checklist

• PR description included
• yarn test passes
• Unit Tests are changed or added
• Relevant documentation is changed or added (and PR referenced)

Note: dependency-only security fix (transitive lockfile re-resolution via a next minor bump). No unit tests or docs are affected.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 2836561

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[osama-rizk]

Good call — done. next@16.3.0 (released yesterday) pins postcss@8.5.23, and since @aws-amplify/adapter-nextjs's peer/dev range already allows < 17.0.0, I dropped the postcss resolution override and just let next re-resolve 16.2.11 → 16.3.0 in the lockfile. That pulls postcss 8.4.31 → 8.5.23, which clears both alerts (#287 needs ≥8.5.12, #288 needs ≥8.5.18). The diff is now yarn.lock-only with no manifest change.