chore(deps): bump next 16.2.12 and refresh lockfile to latest in-range versions

[sergak01]

Summary

• Bump next and eslint-config-next from 16.2.10 to 16.2.12 in template-nextjs and template-nextjs-esm, clearing all 18 currently-open Dependabot security alerts (7 high, 11 moderate) — all traced to next@16.2.10 (middleware/proxy bypass, SSRF in rewrites and Server Actions, DoS in Server Actions and the SVG image optimizer, cache confusion, unauthenticated Server Function endpoint disclosure).
• Ran npm update at the root to refresh package-lock.json to the latest versions already permitted by existing devDependency ranges: eslint, prettier, semantic-release, @typescript-eslint/eslint-plugin, @typescript-eslint/parser, and transitively js-yaml/form-data.

Not included

• typescript 6.0.3 → 7.0.2 was attempted but reverted: @typescript-eslint/parser@8.65.0's peer dependency caps at typescript >=4.8.4 <6.1.0, so installing typescript 7 breaks npm install with an ERESOLVE conflict in every template that lints with @typescript-eslint (confirmed by scaffolding vanilla-ts via the built CLI). Needs to wait for typescript-eslint to add TS7 support.

Dependabot PRs superseded by this change

Security: #217, #218, #219, #220
Routine: #175, #176, #177, #178, #181, #191, #193
Left open (blocked, see above): #199, #200, #202, #205

Testing

• npm run lint
• npm run typecheck
• npm run build
• Scaffolded vanilla, vanilla-ts, react, nextjs, and nextjs-esm via the built CLI against the real npm registry; verified install/build for each

Related to PP-3913.

Merge Request: origin/chore/deps-dependabot-sweep → origin/develop

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 0d98f154-da47-4101-ac18-ba737deccbce

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}