chore(deps): Bump next from 16.0.7 to 16.0.10 in /web

[dependabot]

Bumps next from 16.0.7 to 16.0.10.

Release notes

Sourced from next's releases.

v16.0.10

Please see the Next.js Security Update for information about this security patch.

v16.0.8

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• Update react version in cna templates (#86950)

Credits

Huge thanks to @​huozhi for helping!

Commits

• 581dee6 v16.0.10
• 9a0dc9c Backport facebook/react#35351 for 16.0.9 (#87085)
• 3f6a39f v16.0.9
• 75e136a Update React Versions (#40)
• 4e20596 Update React Version (#22)
• fa85848 Backport Next.js changes to v16.0.9 (#20)
• 817ee56 v16.0.8
• b298173 Update react version in cna templates (#86950)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

---

Summary by cubic

Upgrade Next.js in the web app from 16.0.7 to 16.0.10 to apply the latest security patch and backported fixes. Only package files changed; no app code updates.

• Dependencies
  • next: 16.0.10 (includes the 2025-12-11 security update)

^{Written for commit a497882. Summary will update automatically on new commits.}

• Override Linear Check

[greptile-apps]

Greptile Overview

Greptile Summary

This PR updates Next.js from 16.0.7 to 16.0.10 to address security vulnerabilities announced in the Next.js Security Update. The update includes:

• Security patch for React (backport of [Flight] Add extra loop protection facebook/react#35351)
• Minor version increment with bug fixes from 16.0.8
• Updated package-lock.json with proper peer dependency metadata

The changes are limited to dependency management files with no code modifications. The update maintains compatibility with the existing React 19.2.1 version used in the project.

Confidence Score: 5/5

• This PR is safe to merge with no risk
• This is a standard security patch from Dependabot that only updates Next.js from 16.0.7 to 16.0.10. The changes are limited to package.json and package-lock.json with no code modifications. The update addresses known security vulnerabilities while maintaining compatibility with the existing React 19.2.1 version. No breaking changes are introduced.
• No files require special attention

Important Files Changed

File Analysis

Filename	Score	Overview
web/package.json	5/5	Bumped Next.js from 16.0.7 to 16.0.10 (security patch)
web/package-lock.json	5/5	Updated lockfile with Next.js 16.0.10 dependencies and peer dependency metadata

Sequence Diagram

sequenceDiagram
    participant Dev as Developer/Dependabot
    participant PM as Package Manager (npm)
    participant Next as Next.js 16.0.10
    participant React as React 19.2.1
    participant App as Onyx Application

    Dev->>PM: Update next dependency to 16.0.10
    PM->>PM: Resolve dependencies
    PM->>Next: Install Next.js 16.0.10 with security fixes
    Note over Next: Includes React security patch<br/>(facebook/react#35351)
    PM->>PM: Update package-lock.json
    PM->>PM: Add peer dependency metadata
    Next->>React: Compatible with React 19.2.1
    React->>App: Enhanced security posture
    Note over App: Security vulnerabilities patched<br/>No breaking changes

Loading

[greptile-apps]

_{1 file reviewed, no comments}

_{Edit Code Review Agent Settings | Greptile}

[cubic-dev-ai]

No issues found across 2 files